Zero Trust in action: A cyber expert´s guide to securing modern workspaces

all right then Al righty I think we are live just gonna see if we have some people coming in keep this in my com section perfect though all righty all right welcome good day everyone uh welcome to today's highly anticipated webinar zero trust in Action a cyber experts guide to securing modern workspaces my name is tasim Ahmed and I'm thrilled to be your host for today's discussion as a business development representative at parallels I've had the privilege of working with organizations across Industries as they navigate the complexities of today's modern it environments today we're going to talk about something that's on every organization's mind security and not just any security but the transformative model of zero trust before diving in I want to firstly of course express my gratitude to all of you for taking your time today for joining us whether you're here to learn validate your strategies or explore new ideas I promise you will leave this discussion with some actionable insights so let's begin by quickly giving you an overview of where we come from or where I come from as a company of course uh from the parallels side of things um yeah for those of you who are not familiar with parallels a quick introduction uh we are basically at the Forefront of simplifying application delivery and enabling secure remote access to resources for organizations of all sizes our Solutions particularly uh parallels Remote application server or Parallels secure workspace empowers it teams to streamline operations enhance remote work security and deliver seamless and user experiences wherever their teams may be working from we believe in providing secure flexible and cost-effective solutions that align in the modern work demands and today's topic on zero trust perfectly complements that mission to quickly give you an overview of what the agenda or the snapshot of of the agenda really looks like or things we'll cover today along with our special guest of course that we have in the panel which I'll quickly introduce in a bit we'll basically be diving deeper into the introduction side of things of what Z trust really is how it works and why it's critical in today's security landscape we'll touch up upon real world applications and its role in the modern Workforce we'll explore how organizations are putting zero trust into action and what the future really holds for this principle and I'll also quickly give you an overview of how we really enabling this princip principle of zero trust at parallels a quick look into our approach and solutions and of course towards the end we'll give you an opportunity to ask our expert anything in regards to this subject and address those questions as well so please feel free to drop your questions in the comment section or share your thoughts in the chat and we'll address them as we go towards the end I hope that sounds fair having said that I'd love to quickly introduce our distinguished guest for today's uh chat it's my pleasure to introduce him Dr Chase Cunningham better known in the industry as Dr zero trust um Chase is one of the most respected voices in cyber security with a PhD in computer and information system security he has been a trusted adviser to countless organizations guiding them on their journey to implement robust Zer trust Frameworks he's also the co-author of an internationally best-selling book # hacked 2 where he along with the great panel of experts explore the ever evolving world of cyber security threats also as you can see he's a very cool podcaster with an interesting channel on Spotify that you should really check out so Chase it's really an honor to have you with us today how are you doing thank you for having me on here I appreciate it uh yeah that's uh that's one of my favorite pictures from when I was doing stuff at the Pentagon looks like it but yeah tell me about this picture is it for event or was it a workshop that you did just for a workshop I did when uh we were doing uh zero trust strategy with the uh CIO for the US dood this was a little while ago but uh you know anytime you see the podium at the Pentagon if there's no one around you run up and take a picture so that's what I did cool how long ago was this m ask this one was uh 2019 so it's about five years old by now but uh I still like it so got it no it's an interesting because interesting time because the reason I see things after and before 2019 is basically of course the entire Co era I know it's it's pretty much long gone now the entire Co era but it's an interesting phase where actual cyber security measures were really being considered um yeah good point yeah the first thing that I really want to dive deeper into before we actually get into these things is basically because I started actually working I would say full-time in the year 2019 so it was just after covid so uh yeah companies were already involved in in implementing these kind of measures whereas I know you've been on the field for quite some time now so you have seen the ever evolving uh need uh and how change uh the entire principle of you know incorporating such principles like for example of zero trust and other cyber security measures have been as well so the first question I really want to talk about um uh Chase is the fact that what for you is zero trust and how is has this turn involved in the last let's say 5 to 10 years yeah so I mean zero trust as a concept is not what you would consider to be brand new I mean you probably noticed it more recently in the past few years because of the growth and the marketing and that type of thing I mean it's even happening now in Australia at the at the country level there's people working on ZT for the UK government as well so it's been growing uh but the truth of the matter is zero trust goes back to a very basic principle that the majority of us live in we just don't really recognize it if you kind of think about your your actual interactions just consider consider someone showing up to your house to say uh fix I don't know a Plumbing Leak right so imagine there's two scenarios one scenario is you have placed a call um you have gotten a hold of a plumber they've said that they're going to send someone at a certain day in time they show up you go to the door you greet them you uh allow them to verify who they are and then you let them come in to do their work and at the end of that time you politely show them the door and have them leave and then call their boss and say they did a great job and pay the bill that's actually what a zero trust sort of instantiation looks like right I I know that this was coming I set it up I allowed it to occur I verified the transaction I let them do their thing and then at the end of the session I send them on their way and then I make sure that that session is terminated that's what we want to live in whereas the other scenario is I have a plumbing problem or an issue and someone miraculously shows up at my door and they just let themselves in and walk and figure out where this leak is in my house by kind of showing themselves around and then they maybe fix the leak maybe they do something else and then I never know if they left um that's not how we want to operate in the real world because that's risky I mean that person could be hiding in your closet planning to murder you or something so you don't want to live that way you don't do that in a digital space but the the fundamental issue that we've built into digital systems and it wasn't for for malicious purposes but we built it here because it was just the nature of how we wanted things to work was for open sharing and default access and those types of interactions that's all well and good until you're operating in a potentially hazardous environment which is where cyber is so when we're thinking about ZT um and people kind of get wrapped up around this a lot they'll they'll you know go and kind of bristle at the fact we're talking about not zero trust you live in a zero trust sort of approach to the world um um just be honest with yourself about that especially if you have kids which I do um so why not do that in a digital space and it's not this is not about not trusting your people or having some sort of malevolent uh thinking towards your employees this is about understanding what causes compromise and then putting controls in place that will negate that compromise that's it no yeah exactly that's that's a very interesting way of looking at it and yeah I think it's it's all about accessibility right you have control I mean you can you can't always have control on who is accessing what so yeah why not just have that zero trust um but in regards to the traditional cyber security approaches I'm sure that zero trust is is an umbrella term of of of a majority of many other things that are existent in the world of cyber security could you tell me how this principle in itself differs from the traditional security approaches that already exist I mean your traditional security approach is the perimeter based model and the perimeter based model we've known I I always ask people like did you you know if you want to guess when the first time the primer based model of cyber security failed and they would say oh well it was I don't know operation Aurora or whatever else no the we knew that this was going to fail all the way back to the fall of the city of Troy which is an Antiquity right thousands of years ago I mean think about what happened in Troy you had stuff on the beach you had something outside the wall people went transitioned through the wall poked a hole in the firewall if you will grabbed the thing brought it in let it sit there and then bad guys deployed out from inside established a beach head and went forward and did bad things so we've known for a long time that that was going to fail we just digitized it and kind of hoped that it didn't go to the scale that it is now so we've we've categorically understood as a market we should move away from that perimeter-based model of security we need to get to this new one and the pillar-based approach when I was at Forester and kind of worked to put all this in play the whole whole goal was to say how do we map out the things that are necessary in a digital system and then apply zero trust Concepts to each of those individually because this Market is dynamic and it is uh built up around particular controls and capabilities that have to work so some stuff might be really great at identity but it doesn't do very well at I don't know visibility analytics and some stuff might be well suited for data security but it doesn't do well at the device level so by putting a framework together we were able to break down what the market is and assign those uh pillar capabilities to different capabilities in the market and that clarified the space for everybody so when you know when people look at this I think the thing is there is no uh think about it like a a dinner menu at a a restaurant you don't have to have everything you can have pieces of this pie but it's going to be pieces of the pie that you need for your business and your or organization there's no uh requirement from anyone as far as I'm aware that says You must solve for all of these things right now at this time and do it all at once the that's not smart really Pick and Pull and build it to your needs and there is a maturity curve here too so solve simple problems first solve Dynamic very uh comprehensive problems later so think about that when you're really thinking about where we are now and then the sort of architecture and the framework that's been created this is meant as a a guide guide uh even if you look at nist 80027 people will get wrapped up around like that is the Bible for zero trust there's no Bible those just guides it's literally called a reference architecture which means you refer to it and build your stuff based off of that reference so just keep that in mind don't get so um you know wrapped up in like there is a prescriptive model here there's not got it yeah that that makes a lot of sense in terms of yeah how you actually look at it so it's not like something that you can just adopt in a day or a week it's something that is is a process of its own and it's all about priority what you want to prioritize in terms of your security uh but is there a way you look at it uh Chase I mean how do you prioritize it I mean is that something that a ceso of a particular organization would tell you or is that something that you visualize on your own so what I what I really trying to focus on and tell people is think about it from the adversaries perspective not from the defender perspective because where we go wrong as we try and sort of build this perfect infrastructure where compromise is never going to happen whatever that's not correct compromise is a given like it's going to occur but if you really accept that that is what's going to happen then you apply controls where the adversary lives first and I think that that really applies in pushing things out to the edge of the infrastructure uh which is counter to the original ZT model so the original ZT model was Data data data then work your way outward whatever else else which makes a lot of sense however having been a redeemer and a Defender it's really hard to do that but you can still apply zero trust principles outward and then keep it secure from there and ultimately you'll work towards the core of the infrastructure later so I think that that's where there's a bit of a misconception um and again this is all based on your strategy like you can modify this based on your particular needs but if you also look at the identity uh curve curve here the for the maturity curve you'll see things that are simple to take care of first and most of the simple things occur out towards the edge of the infrastructure identity and access management device stuff users on the internet crappy passwords whatever all of those things are solvable problems that exist outbound of the network not inside of the network no I I agree yeah I think that makes a lot of sense I know thanks thanks for signing some light on that aspect as well but yeah I mean you've been on this field for quite some time now Chase so something that I'm really curious to know is how is it this term evolved because yeah I mean as you said it yourself Zer trust has been a term that is not a buzz word anymore it's it's been out there uh for some time now but in regards to how people look at it right now and in regards to how people looked at it maybe let's say before uh this the so-called covid era let's say uh is there a big difference Chase or is that something that that we've just learned from our mistakes and adopted I mean the the co era was good for proving that businesses could move towards this model and still be operational and grow and whatnot and do well um so you've got all these businesses that have moved towards a I don't think I don't know if now it's like kind of remote by default but most businesses have some sort of remotti uh work policy I mean even if they're making you come back to the office it's usually not five days a week it's three but if that's going to be how your business is going to operate and there's a whole lot of benefits there you had better make sure that you can operate in this sort of Cafe model style of internet access and usage and the way that you do that is by aligning towards the principles of CT because of the nature of where compromises occur uh and you want to treat your users and their home network or their mobile environment as an extension of your infrastructure so ZT just by the I guess nature of the way the businesses moved during and after covid and where we are now has become the kind of deao standard for what makes the most sense in the uh long hul view of where businesses are going to go and I mean I I like these stats because I think these speak to where ZT controls need to go you know it's not um you don't see things on here about sort of crazy rejiggering of network infrastructure and super amazing zero days and whatever I mean the majority of the stuff is relatively solvable and it also exists on the kind of edges of your infrastructure so why would you begin with applying controls anywhere else yeah I agree um And in regards to how organizations approach this um do you think that has changed because okay yeah the need is is real right now because of how easy accessibility has become um but I mean in regards to how you worked with companies is there a transition that you had to do yourself as as as a I mean as an advocate for such a technology and of course being on the field for so long was there a learning curve for you as well I think the the learning curve for me was actually that um we needed to work our way up the food chain in the corporate system towards the seite people and board members that were not cyber I mean it's interesting because for the longest time we all tried to kind of you know beat down the cesos door and get it in front of the ceso cesos get it like they understand why this is needed and they're trying to do it they're they're there but the reality of it is cesos no matter who they are where they are I have yet to find one are not the ultimate Arbiter in making that decision they influence they guide they lead but at the end of the day it's a CIO CEO or board level decision especially if you're talking Enterprise what I had to learn a lot of other ZT kind of proponents had to learn was how to speak board how to speak CEO and move it up that food chain because that's who we actually need to focus on and enable because this is a business decision this is not necessarily a cyber security decision that decision's been made like I say cesos Get it um being able to speak at that different level and talk about ease of use and budgeting and growth and business impact and those things has made a big difference yeah that's true I completely agree on that aspect as well I think yeah it's it's the technology uh I mean the people who are well vered in technology which will advocate for it but it will the the business decision at the end of the day um but yeah I can I mean just before I really move on into some real life applications Chase just out of curiosity because I know in the past uh there were instances where companies waited for something you know uh for an incident to happen before they can actually take these things seriously do you think that is also shifted with time that now it is a priority before even an organizations you know goes beyond like let's say 3040 employees they actually have these kind of things implemented do do you already see that shift yeah uh the requirement that's coming from uh a lot of different governments including you know like I said Australia the UK seeing it in APAC as well I was in Taiwan doing zero trust work so the the governments are driving a lot of that and um the fact that they are putting requirements in place along with initiatives that are going to drive adoption means that it's no longer just one of those things of kind of hope and wait and see what happens like that is not a smart strategy and you're going to pay for it one way or the other so I think that that that's been really good is that organizations and Leadership globally has finally started to say okay cyber is not just a bunch of computer geeks that are freaked out about the sky falling it's a real thing let's put some uh requirements in place and drive things and I mean the carrot or stick initiative is still there I think we're seeing a lot more carrot than stick now which is probably a good thing in the business context but it's going to keep coming um if anyone thinks that there is not more cyber security control roles and requirements along the lines of CT coming your way you're wrong it's coming it's just going to take some time yeah agree I understand that way um but yeah I mean in just to dive deeper into the aspect of real life applications right I mean I mean let's talk about the industries that are targeted so personally speaking the way I look at it okay uh there would be priorities that would be based that okay particular Industries will prioritize um these elements of cyber security in a particular way whereas others won't but is it really dependent on that changee because you I'm sure have worked with different companies in different vertical is it really dependent on a priority level or is it just that any company can be a Target no any company's a Target I mean what we what we don't see on this particular chart and I'm working on some of the research for this too is uh the major companies the major government organizations they've kind of done what they can to make themselves slightly harder targets than they were in the past and this is an area where the adversary follows the path of least resistance so if you follow the last maybe two years worth of compromise activity it's really been vendors third parties contractors relational agreements that have caused compromises it hasn't been direct targeting of the major company's infrastructure because that's been hardened so where they go is they go after the low hanging fruit which is the mom and pop shops the small businesses those people and they're working their way through that and that that is not good because collectively that's what makes you know the whole system work is everybody's connected everybody talks to each other we do work collaboratively etc um and that's going to continue to drive uh issues if people don't address it and get forward on it now but every business everywhere is a potential uh Target for an adversary even to the level of an AP um a lot of small businesses would say oh why would China care if they can hack me it's not that they care if they can hack you it's that you have connections to other stuff that they want yeah yeah agreed and yeah I think it's the way of looking at it right it's it's uh it's either you be prepared or just wait for that one bad day you know sooner or later the the you know the Bell Tolls for thee um and you just have to be ahead of it honestly and it doesn't require people or businesses to have super crazy NSA level security it just requires you to be better than the next slub down the road so if you can do those things you're making yourself a harder Target does that mean that compromise never occurs absolutely not but it means that it's not necessarily as easy for the adversary to do things they want to do and this is a space where those uh adversarial you know folks they're on a clock as well they're on a budget they're on requirements from their higher ups if you can be a harder Target they'll find someone easier that's and that's that's a good thing like even if they find someone else that's a win for you that's true um yeah I'm really curious to really understand in regards to because we've heard enough stories about you know companies being breached big companies you know good names but still you know one bad luck and you know they're just a part of you know such incidents and I'm sure that you have been part of many organizations or at least talk to people from different organizations uh are there any highlights that you'd want to kind of share uh Chase in regards to some applications that you saw were very um specific or relevant to that time that or something that you would be very proud of that you've been a part of well I mean I think one thing to take away here is that these major organizations this is proof literal proof that the budget and the amount of money you throw at something and the compliance requirements do not equal a better security posture I mean these companies totaled up have spent billions of dollars on security and every single one of them have been breached and all of them were compliant and they were breached so does that mean that they you know failed categorically no but it means that they basically relied on kind of the minimum set of standards and throwing a lot of money at the problem and things still went wrong for them I would argue that these companies uh could have done things better if they'd approached it more strategically but this is arm tier quarterbacking right we all know that this is uh that we learn as we grow and we learn as we evolve they they needed to change their approach um the one that stands out to me is kind of most uh well put together architecture from a ZT related incident was Google moving into their uh their what they call Beyond Corp since the operation Aurora failure and what's interesting there is Google's got nearly 200,000 employees globally since they move towards Beyond Corp model which is their zero trust instantiation you have not seen a Google corporate security failure um you have not seen them in the news so if Google can do it at that scope scale anybody can and that doesn't mean you have to have Google money but you just have to follow the same approach and principles and I I I think that for me that's one that's really stood out is to be able to reference like if they can do it so can everyone else uh because there's I mean there's a big moving Target there a lot of interesting stuff definitely attacked all the time every day but they continue to do well go yeah I think that's a great example um but chase out of curiosity because you also I think there's a lot of communication goes that goes particularly in your field where you have to talk to different stakeholders sometimes technical people sometimes the commercial people um which industry do you think uh is the easiest to communicate these uh elements of of of importance of cyber security particularly in the world of zero trust I mean I think the one that stands out most currently is uh Finance is doing pretty well people don't give them enough credit and that's the part of the reason they're doing as well as they are is because they've been so attacked for the course of last X number of years government is doing as well as it can the US DOD is driving uh a whole lot of ZT adoptions so I think there's um there are signs that it works well the ones where you kind of in my experience have run into issues of people being hesitant to adopt security controls is typically Healthcare and there's reasons there right I mean their job is to save lives they're not technologists by uh trade so it's kind of hard to get them you know uh sometimes to engage in this is the right strategic approach to the problem yeah interesting uh yeah and I think that's that's a very interesting sector as well the financial World especially because of how the financial services and the fintech world itself is growing together and yeah that how they grow also opens up many opportunities for these kind of incidents right um but yeah in regards to actually looking at the challenges right because of course every transformative framework comes with challenges I mean in regards to especially the fact that zero trust in itself is is not a new term it's been out there for so long um in today's day and age what are the actual obstacles that organizations are still facing that they're not able to really leverage this to it to its full extent I mean the the biggest one is that a lot of cesos did the best they could and they they got a lot of budget and they built their systems over the course of the last X number of years and honestly if they didn't aligned to zero trust principles to begin with they're having to reallocate and re kind of build things on the on the future which is problematic because they're asking for more budget to continue to do things and security by its very nature is uh you're always proving a negative which no one likes to do right if my if I do my job correctly nothing happened and everybody's like great well what the heck does that mean so being able to have a an approach where and that's why I say like for myself and for other people I know we had to ad uh and change our approach around business side if you are not enabling business conversations and you're not talking about budget and those types of things your message is going to fall on deaf ears and even if zero trust is the perfect instantiation of strategy if you're not talking the right terms it doesn't matter at the end of the day so I think that that's the one that stands out most the other side of it that still kind of confounds me is that we uh as a market rely too much on humans rather than technology like we're in a technology space but people still rely on humans I don't think that you should be relying on people not to be people so put technology in front of people that can control their interaction with malicious content and if you do that you're doing things at a you know at a better scale and the proof is in the pudding you know if if you talk to people and they say oh we have a 97% fishing click rate or whatever else grade you still have 3% of your organization that will click a link why not do something that technically controls those people um because they're going to be the people that will cause you compromise agreed I think that's a very interesting way of putting it you know why not put in the technology itself in front of the people so yeah as you said you know people are people at the end of the day we we bound to make mistakes or also you know do things which which are yeah very Humane at the end of the day um but in regards to yeah because I'm sure that there are a lot of technical people watching us from the side uh today uh especially who are experts or you know at least diving into the world of cyber security you know working in their organizations so in regards to practical steps that companies can take uh Chase from transitioning from a traditional parameter based security model to a much more of a zero trust based robust framework what would be the Practical steps you could actually you know think of I mean these are just my my these are my opinion right so take everything with a grain of salt and again everything is your strategy but for me I say take care of identity and access management first because people use crappy passwords and everything has to be accessed so why not have a a solid approach there MFA those types of things password less if you could get to it Etc I think the next step really is around taking care of the devices that people are using and making sure that you have good controls over that and the thing that ties in and bridges the Gap in my opinion between identities devices and network is really taking things like browser isolation and being able to put that in front of those uh assets and people should also understand you can use bi in front of machines as well like if if you're in a hospital a lot of those things access the internet via the browser why not put controls there as well and then working forward from that I think you start getting into things like micro segmentation of the network uh application control issues and code and then finally at the end of it you're really at that data level um so you know the other thing that people could take away is if you solve the stuff that I talked about first you're probably further along in your ZT Journey than you give yourself credit for which is great now begin continuing apply those same Concepts to the area where you're currently at this is a marathon not a Sprint agre I think that's a very good way of looking at it thanks for that um but yeah let's okay now that we actually know what the actual present context is where we actually come from in regards to this te mean this Principle as a whole um the challenges as well but what do you think the future holds uh Chase uh I'm sure you know you've done your own research you've seen how this has grown but what do you think is the future with Technologies like AI already out there you know there's so much uh influence uh in accessibility even um is it going to be much more of a challenging period or will the technology just make it easier for us to implement zero trust in our organizations I mean the problem is that we as the quote good guys don't own the the sort of capabilities specific around quote AI like the bad guys can use it as well and I think I saw a stat recently that said that uh fishing attempts have grown by 4,000% over the course of the last year so it's because Ai and those types of things have democratized the ability to create code and fishing pages and all those things so there's every technology as a dual-edged sword um you're going to see more from the adversary as you're going to see from the good guy I think where we get into the the benefit side of this is that we can apply ZT Concepts and principles to the new stuff that's coming our way and continue to be accurate like that's what a really good strategy is is it does evolve it does change over time so there's some good that comes out of that um you should be able to leverage the policy engine side of ZT with these machine learning types of applications to give you better capability control and context and that that I'm starting to see in the market like there are some some really in interesting and Innovative approaches to being able to take care of that um and and have it be accurate on its own like learning models are great policy engines are great and and Ai and whatever reality we're dealing with is is viable for those types of solutions I agree um And in regards to trends that organizations could already see because okay the technology is already evolving but I know you already mentioned this on what what could be the Practical steps but in regards to trends that organizations and companies especially mid to you know smaller companies should really look out for to ensure their strategies remain future proof would there be any trends that you could actually just pick out and talk about Chase I mean I think the the the trends that are most uh applicable are are looking at where you continue to see uh the the fail points I mean I I really rely heavily on the Mand MTR report and the Verizon dbir I use those as kind of stati itical basis for where we have issues and if you're looking at that you'll notice it's still the typical Avenue compromise is users on the internet bad passwords and people doing stuff that they shouldn't do leverage these type of capabilities to get in there and work at that scale and in a perfect world Security is unbeknown to the user they just don't know that they're actually operating in a secure model and unless something goes Ary and then it stops them from being impacted and that's where you want to get to in a in a really good security model zero trust or not people are secure by the way that they operate and it's beneficial for them it's not a hindrance and that's where we're going to get as these policy models and capabilities become really refined by those backend uh optimization Technologies got it got it and would there be any technology for example the only reason I wanted to ask you is because I think this uh example pre yeah personally when you talk about VPN for example at one point vpns were were the state-of-the-art technology just to ensure zero trust uh but now of course that I mean they're not no longer the safest in terms of you know completely ensuring um remote access security so are there technologies that might outgrow uh chase that we might have to really move forward from or transition from to really keep ourselves intact yeah I mean there's going to be stuff we're going to age into and stuff we're going to age out of so it it kind of remains to be seen where that goes but um I think where you're going to get to is that a lot of people are going to realize they don't need all the endpoint capabilities that they're typically offered like it's going to be where you can operate in kind of these vdi models and folks are going to be able to operate in a secure workspace along those lines most people in most Enterprises don't need all the crazy cool things that computers can do and those are just risks so why aren't you removing those risks and that's what you're going to kind of evolve towards I think is that that we're going to almost operate in the future space on a Thin Client model for everybody on the internet other than developers and people that really need all that capacity got it got it um so yeah there H from what I've heard and understood there's a lot of room for improvement and there is a lot of room for Technologies to really uh build this Rob robust framework but there's also a lot things that we need to really grow from rather than really sticking to those traditional approaches uh and yeah stay ahead of the curve I think that's the approach that organizations should really look at if I'm understanding correctly y I mean that's about as cut and dry as it can be and it uh you know the truth of the matter is that security strategy is about your organization but there are kind of best practices that we all know about and there are intelligent approaches to the problem that we're all aware of that is where you should apply those controls otherwise um you're not really attacking their problem you're attacking kind of the approach and the approach is is pretty clear got it yeah I mean it also makes sense right because I've I've been yeah you know in a been a part of companies where they've used multiple Technologies I know at the end of the day of course it's basically working with different vendors uh but at the same time I feel that they might even complicate that you know when you when you could use a solution that could for example have an inbuilt MFA let's just say that rather than having okay I'm going to have an MFA and then I'm going going to have a a password manager and then I'm going to have a different solution do you think sometimes we as people because you know we we we yeah sometimes we like to work with a lot of different technology so that also comes from there but it's also like we sometimes over complicate things for ourselves do you think that is something that you've seen in many companies that you've worked with oh yeah all the time and especially since we have the life cycle of leadership in cyber is pretty short I mean most cesos are only in in their job for a couple years if they're lucky so you keep getting this kind of roll on and new people and new tech and new problems and Etc so I mean and even if you think about it like I'm I I consider myself a good example of this like I love Tech so anytime I see something new and interesting I typically go get it and then I wind up with a whole bunch of stuff that I don't need or use and I need to get rid of it over the course of the next year so I mean it it's really one of those things where uh we can be Our Own Worst Enemy because we are technologist we like technology and everything is available to you now so you just keep Buy buying and trying and buying and trying and that is not a good approach overall strategically to the problem space got it got it but yeah I think it's all about the core competence of that particular technology sticking to that uh because yeah sometimes you can't get all of the things in one one cup right so you have to be smart there as well um and interesting yeah just before I really start talking about you know a parallel side of things Chas because I'm really enjoying this conversation what I really want to know is are there interesting mistakes that you you've learned from that you know really you you want to carry for for the coming years even working with different companies some mistakes that you learned from in the past yeah so the biggest one is going too big too fast I was doing a work workshop for zero trust with a large bank and they they said that their small level of uh roll out was going to be 5,000 users and I was like that is that's way too big I mean they're a huge company but we wound up starting with 50 okay so if you can get 50 right you can get 100 right you can get 100 right you can get 500 right and you grow from there so you know be very small very tactical try and uh uh make sure everything's good at small levels and roll your way up from there it's it's kind of funny because we have this uh thinking about technology and understanding and that's going to operate scale which it will but it still is not a good idea to just roll it out RIT large and you know see what happens um you got to be tactical about that and then the other thing is just continually thinking about where you might have a fail Point um I think any organization that does not engage in a red team op will never know how they're going to Affair when things actually do go arai so no matter where an organization is at for me when I do engagements the first thing I say is let's red team this and if they're not willing to Red Team it then it's basically pointless for me to be there um if your if your goal is to survive in a fight you need to be in a fight and the only way to do that is a red team not a pentest a red team op red team off no that's that's a fair fair point um interesting interesting and um I'm sure you know working on this field you might have worked with different Technologies different vendors and I know you have your own perceptions towards it because I'm sure you see it in a much more broader light than just in a commercial perspective you see it in in a life where what is important what is not what is just you know what is basically pardon my language but bullshitting stuff uh but yeah I think that's where we need to really learn from is is basically the fact that uh yeah what is is important to you what is the priority and really take it on from there oh that's interesting uh interesting uh Chase thank you for that but um just to give an Insight in regards to how we are really doing this because again we are also learning and evolving our technology to enable the right remote access security for our organizations or the organizations we are working with but at parallels just to give an insight to the audience that's with this here today we have a wide range of solutions whether it be the desktop space app web apps or the cloudspace uh you might have heard of our Legacy product Parallels Desktop uh but yeah with our Solutions like parallel secure workspace which was previously aing and parallels remote access or Remote application server we are simplifying on Prem or hybrid workspace infrastructures with a secure and streamlined access uh for company's Resources by allowing the team to work from anywhere around the world um including Technologies like which which are very recent uh like as you mentioned remote browser isolation we have something called parallels browser isolation again the idea is giving a granular access for the users for the admins to understand what is required for the end users to use particularly in the web based or the yeah web apps uh perspective especially because everything is being satisfied at this point everyone wants to go to the cloud everyone wants web apps um and I think that's where security is required the most and that is what we are trying to enable with uh our Solutions here at pars um but yeah of course later on to that uh and thanks a lot for this uh Chase but again I'd love to address some audience question answers I don't know if we have any um but yeah I think this would just give some room for the audience that is already here uh guys Chase is is our expert so please feel free to ask any questions um I'm sure they might that might come out later out later on after this webinar is already out there uh I I mean we'll try to address them uh with Chase's help of course but yeah if there are any questions guys would love to address them right now let's just give a minute uh yeah I think there are no questions uh that's what I see from our moderators as well but either ways Chas I feel really refreshed personally speaking again although I come from an engineering background uh I did mechanical engineering background but again this chat with you really helped me understand uh you know zero trust at a better element because particularly whatever cyber security related U education I've had is is on the work field particularly in the last three to four years that I've been on the field um working with different companies and in this space as well uh and again people like you are what really helped me grow as well help me understand the technology better help me do my job better so thank you thank you for this uh lovely chat um thanks for having me yeah this is uh fun I hope your uh your folks you know get some value out of this and uh the approach parallels is taking maps to zero trust strategically so it's not I'm not uh not endorsing it I'm just saying like if you're trying to solve a problem I would give parallels a fair Shake thank you thank you for that uh Chase but yeah let's stay in touch uh I'm going to check out more of your Spotify uh podcasts and of course learn a lot more in that process but thank you thank you so much Chase for being here um and yeah hope to chat again sometime soon thank you and thank the parallels team pleasure pleasure thank you just GNA sharing right here