Glitch: Welcome to NPC Grade Security and Architecture, Episode 7, One Thing Leads to Another. Zero Trust, Taking the First Steps. I'm your host, Glitch. Cypher: And I am your spandex wearing cape bearing sidekick cipher. And you know what? Actually, okay, but before you because I know you're probably gonna have a comment about my spandex right there. Wait. No? Okay. All right. Well, so you know, Glitch. I I think it's really doing our listeners a solid for us to to kind of break down this zero trust thing. Zero trust in today's world feels like a total sales gimmick or something. Glitch: ⁓ No. Cypher: I don't know, almost as mythical as unicorns or Sasquatch, but in all honesty, there is nothing mythical about it. Glitch: Yeah, I agree. And I think we brushed a little of that myth off, but but I think we need to clearly indicate that today we're talking about how to take the first steps. Even then, there's a good chance we may oversimplify some things because some of the concepts we're talking about are really pretty robust in and of themselves. Cypher: Totally, totally. And if if we break this down though to zero trust first steps, you know what? Step one, it actually goes back to that age old cliche of you can't protect what you don't know. So step one is really just some semblance of asset management. Glitch: ⁓ the old Mr. Miyagi quote. Well, I don't think he was really thinking about asset management, but you can apply the th the same thing, which is if done properly, no can defend. Okay, all right, all right. So you you say that like it's simple and to to quote a line from you, that hurts my heart. Asset management is likely a term we've all heard Cypher: I don't remember Mr. Miyagi saying that actually. Glitch: A metric ass ton of times. So let's break that one down too, because it's more complex than those two little words imply. So for asset management, you start by categorizing your assets. so let's start with what we're talking about with the hardware assets. servers, endpoints, including Bob's twenty eighteen iPad. Cypher: ⁓ here we go again with Bob's iPad I see. Glitch: Yeah, he's like the festering postule that will never go away. Or we were hoping that it would stay in Vegas, but apparently it went outside of Vegas. Yeah, yeah. Don't interrupt me. So yeah, I I'm on a roll. I can't I can't help it. So where was I? Where was I? ⁓ yeah, yeah, yeah. So endpoints, ⁓ mobile devices, IoT, network gear, th those types of things for your hardware assets. Then we've got your software assets, operating systems, applications, SaaS. licenses, containers, and we're moving on to data assets. We've got your structured and unstructured data, backups and logs. And let's not forget cloud and virtual assets. So your virtual machines, ⁓ your storage and your identities. And then that leads into our identity assets, users, service accounts, API keys, certificates, and finally we've got your third party assets, your vendor systems, your managed services, and all of your integrations. Cypher: And those actually support the the core security driven objectives, which means the organization has to establish an authoritative inventory or what most of us would just call a single source of truth and maintain real time visibility, then tie assets to owners with accountability. Ooh. ⁓ Glitch: Yeah. Cypher: Yeah. And then enable some risk based decision making, which is absolutely one of my favorite cryptic security things to say. But anyway, that that actually supports though vulnerability management, incident response, patch management, compliance, and zero trust. But we cannot just set it and forget it. We absolutely cannot forget life cycle management. So Glitch: What wait a minute, wait, so we can't just set it and forget it? You know who el you know else who else's heart you're gonna break? Ron Popeel. Ron Popeel. Cypher: No. Who? Who? Glitch: You don't remember Ron Popeel from the seventies? He had this the the little cooker and it was the set it and forget it. No? ⁓ I'm disappointed. Cypher: No. You know what? I'm don't forget, I'm the outdoorsy one of the two of us. I did not spend time inside watching TV. All right. So no worries. So but we cannot forget that life cycle management. So when you're building out those categories that you were just mentioning, you should probably try to define what that means at that time so you can put the standards around it. So at a glance though, life cycle management really Glitch: Okay, all right. You're you're right. I'm sorry for interrupting, go ahead. Cypher: It's the steps from like request to procure to deploy, operate, maintain, retire, and then the beautiful one, dispose. Glitch: ⁓ I love that one, but that s seems to get so overlooked a lot of times. So l let me put on my architect hat for a second and look at it from my point of view. You have to include things like attributes, the unique IDs, ⁓ the owner, business technical, asset types and classes. What was that? Cipher? Yeah. Owners. Nobody wants to be an owner, but everybody has input. Cypher: ⁓ Yeah, you said the owners. Owners. Hmm. Glitch: ⁓ asset types and classes, and you've got your location, physical or logical locations, your environment, your production environments, your nonprods, test dev, so on and so forth. The criticality, what's the impact rating? Data classification if it's applicable. ⁓ network identifiers, host host name, IP, the network location, ⁓ identity linkage, with users versus services, ⁓ vendors and their sources, lifecycle state. And last scene, last validated timestamp. Cypher: Yeah, so here's here's a nuance though for security. You know, you really have to establish multi-source discovery and never, ever rely on one source. You know, ⁓ you have to use correlation across different sources. So ⁓ sources can be like network scanning, active and passive. ⁓ you've got your endpoint agents, your cloud APIs like AWS, Azure, GCP, ⁓ you've got your identity systems like AD, Entra and Okta. Vuln scanners, EDR, XDR systems, procurement, financial systems, the the whole C I C D pipes for ephemeral assets, which for the record is apparently not Bob's twenty eighteen iPad. But anyhow, your goal though at the end of the day is one hundred percent coverage visibility, not just inventory accuracy. Glitch: Okay, well, Cypher, now I have to ask, what do you do with all those inputs? I mean, you reconcile to a system of record, create a logical CMDB asset inventory model, and again reconcile. Don't data dump and call it done. I know. I know. I wanna just check the box and move on. Why can we not do that? All right, so Cypher: What? Okay, so what do you mean by reconciling then? Glitch: Deduplicate the assets, normalize naming conventions, merge attributes across sources, and track confidence levels. The key concept here is observed assets does not equal trusted assets. Cypher: Okay. So then the next steps, you have to define your asset criticality mode. And you mentioned criticality a second ago. So examples though for that are like your critical crown jewels. You know, those are those are critical. Like that's that's the stuff that you definitely would have a a big impact. You've got high, like revenue impacting systems, moderate might be your business support systems. And then you've got those lows, which are kind of the nice to have, but they aren't really important to the business as a whole. I could probably come up with some great examples there, but I'd really probably make some people mad. So ⁓ but anyway, but that part is really important because that criticality is gonna also help you to define like different patch SLAs, monitoring priorities, incident response severity, and like even uptime for UIT folks. Glitch: You know Cypher. There's a lot more than this to fault asset management though, right? But I think that helps our listeners understand that the the foundational bits of that. If we keep going, I'll need to change today's topic to asset management. Cypher: That absolutely is a fair assessment because we have just kind of given the baby steps on that. So shall I move to step two? Glitch: I dare you to move. Cypher: thank you to whomever actually sang that besides you. Glitch: ⁓ that would be switch foot. Cypher: ⁓ new obviously you just sang it so that was glitch. ⁓ yeah but anyway I do I do legit thank you for that. But anyhow, let's talk about step two. So step two, ⁓ so step one is our asset management. Step two is gonna have to be data classification. So let me just go ahead and define that one off the bat. Data classification is like the systematic labeling, handling and protection of data based on its sensitivity. its value and its risk impact to the organization. It is not just labeling. It's a control system that really drives security, compliance and and access decisions. Glitch: for sure. Because asset management wasn't wasn't tough, right? So now we break down data class? ⁓ my God, what are you trying to do to me? Cypher: Mm-hmm. I glitch, I know that you just love a challenge. But the funny thing is, what most people think data classification is, is like really just the sensitivity label. I mean, I bet I bet you've actually heard of those as something like ⁓ public, internal, confidential, and then you've got your whole restricted or regulated or, you know, some other please don't let this data out like classifications, right? Glitch: Yeah, I does emotional sensitivity count, Matt? Because I've run into a lot of that, especially when people are trying to deal with data classification. But in reality, while those labels are important, we really need to first look at data types. And by types I mean structured data like databases, unstructured data like ⁓ documents or email or PowerPoints or ⁓ so many things. We can go back into the metric Aston comment of ⁓ so many things. Cypher: Yeah. Amen. Glitch: And then the semi structured data like logs. Then we have to look at context dimensions. Cypher: Okay. And by context dimensions you mean content, which is what's in the data, kind of the flat context, which is where it lives and who owns it. Have fun again with that ownership part. ⁓ and then usage. How is it accessed and shared? Glitch: Ha ha ha. So before we go to the next part of it though, it seems to me like it is the is the problem that you've seen on your side when you're trying to do data classification is it's more like a deer in the headlights. It's people don't either really understand what that means, or is it more of or maybe it's a combination of they don't know what it means and even when it's explained to them, they then you start getting the sinking feeling of going, ⁓ my God. This thing is huge. I don't know how to tackle this. Cypher: Yes. That the the the last like yeah. Well so I mean, so we've been kinda cracking jokes about the ownership. So the first problem is Glitch: All of the above. Cypher: Who owns the data, right? Because a lot of times the business owner is gonna be like, well, it's housed in this system and IT manages the system, so IT owns the data. And IT is like, I didn't create that data. Like I'm just the technical steward of the application that holds it, right? Like I'm not even the steward of the data. I'm not accessing and using your data. So therefore I am not a steward of your data. I am literally the technical counterpart. ⁓ but at the end of the day, I think the biggest problem that I have seen. over and over and over again is that people want to put a sensitivity label out there in a policy. So in administrative control. Boom. I did my data classification. And it's like, seriously? Yeah. I'm like, this is not a roll up the the the report and the the policy and drop the mic kind of moment. This is but it's it's big. It's it's a huge thing. ⁓ yeah. Glitch: Mm-hmm. Done Done, yeah. So so kinda like that so kinda like before, the the whole point of this is to map those classifications to drive what you're monitoring. The access controls you need to wrap around it, the encryption levels, the retention, and then your favorite DLP, which should not be confused with TLC. Cypher: no, no, these two things are no way, shape, or form related. Glitch: You need TLC after you deal with DLP, I think. Cypher: I mean, like, okay, so for just just to make sure we're not dropping an an unrecognized acronym, ⁓ DLP stands for you there's a couple of lines of can't of CAMP, but it's either data loss prevention or data loss protection. But I will say it is three little letters that are so easy to say and so hard to do right. Glitch: Yeah. So I'm glad you brought that up, w the d the how it can be ⁓ perceived with DLP. So data loss prevention and data loss protection in your world is that one and the same or are they s I don't wanna say significantly different or but can they mean different things depending on the context or from your standpoint, how do you how do you explain that? Cypher: I have always seen them, yeah. I've always seen them used very synonymously, just depending on how the person leans. And ⁓ really, I mean, let's be completely clear. The world sucks at implementing DLP anyway. So DLP by any name is still usually just not great. But part of that is because data classification is so hard. Glitch: Okay. I know, I know. And I ⁓ yep, go. Yeah. Yeah. Well asset management can be hard too, but we've moved beyond that. ⁓ and I know I gave the little dig on you for the DLP, ⁓ because I know that gets to you, but really you have to know what you consider sensitive data and then identify what sensitive data you have and where it is so you can support. You know, you've got your regulatory compliance like your GDPR, your HIPAA, your PCI, ⁓ etcet. Insider threat detection. Data governance, zero trust, data access. So how on this green earth do we do that cipher? Cypher: Well, we call Albus Dumbledore for some serious wizarding magic, but Glitch: I thought we all were supposed to do that no matter what we run into. Cypher: That it that like if I have to phone a friend, it's gonna be Alba Stumbledore, you know? Like anyway. I tell you what though, since you're like the enterprise architecto extraordinaire, ⁓ I'll say we start with the administrative control, i.e., the policy. So anytime we say an administrative control, that just means words on a piece of paper. ⁓ so in this case it's a policy. And that that sets up those categories that we were talking about, those labels of public you know, internal, confidential, restricted, as those are the ones that I I tend to to lean on. ⁓ and in that policy, we define, like you can't just say we've got these, and then you give some paragraph of very deeply ambiguous things. You actually have to provide some meaningful examples to give people guidance. So for example, you might say, you know, restricted is likely credentials, encryption keys, PHI, which is deeply regulated and big fines with it. ⁓ and and so on, right? Like you you continue out what actually qualifies as restricted and then PII, financials and ⁓ IP, ⁓ which is intellectual property, those might fall into confidential. But then, you know, you do that for all of the categories. But the admin policy is only providing guidance and it is absolutely, absolutely. Even the administrative control is not to be done in a silo by security or even like a security plus IT. That does not count as collaboration. Glitch: You know, this seems to be do do I need to do the token mention ⁓ of the episode that we have to communicate with the business? This seems like this is the right time and I I see a theme in every episode. Cypher: Yeah. Yeah, yeah, felt timely. Glitch: Okay, well for sure, for sure. So the architect and me, ⁓ it says that we start Cypher: You have a you have an architect in you? Like was it painful? Glitch: He's a little small guy. we won't talk about how he got in there. ⁓ yeah, yeah. But he's in there and he he's got things to say. So yeah, so what he wants to say is that w we start defining the mandatory metadata for our data assets that supports classification. Things like ⁓ data owner, which is a business owner, the data steward, which is operational use, the classification level driven by your categories. Cypher: Okay. Okay. Glitch: Than the actual data type that was used to label it with with that category. Regulatory tags if we have the means, retention requirements, encryption requirements, access control model, which may be like level one or some other indicator that works across lots of business roles, which also sounds like another episode later, totally, but essentially we build the schema for the data. Cypher: Totally. better you than me dude. That is so not my jam. Glitch: somehow I feel like I keep getting all of these things put on me and ⁓ I don't like it. I don't like it. And before we start making the jam, I will say that this is like what you said in asset management. You start doing discovery, but it has to be multi channel and look across things like email systems, file shares, endpoints, cloud storage, databases, SaaS platforms, backups and archives, even source code repositories. Cypher: Yeah, absolutely everywhere where data could live. ⁓ and we have to remember data, not information, right? So data has to have contacts before it's information. So everywhere data's gonna live. So while you are doing that, since you said I was putting too much pressure on you there for that one, I'm just gonna make sure we know is why you're doing that. I will be over here, as should any other organization, ⁓ building an actual data governance structure. Glitch: Right. And and I appreciate that you said once again, you, while you're doing that, thank you so much. See, all of that sounds so painful. Cypher: The what, like me and the data governance structure or you doing all that other stuff? Glitch: Yes. Yes, yeah. Cypher: Yes, okay. Well, I mean, the governance structure, getting the foundations in place is not terrible. ⁓ even operationalizing it. But again, that is my jam. but but seriously, give you know, give our listeners examples of how you actually find the data. Glitch: Well, so there's pattern based detections, ⁓ like regex for socials or credit card numbers, dictionary matching for keywords, metadata analysis, which you'd likely tell me sounds like a medical procedure, and most likely you're probably right, and I had it five years ago, but they called it something else. there was a rubber glove involved, ⁓ I don't know. Yeah. Maybe that's how the little mini architect got inside me at that point. Who knows? Cypher: Ha ha ha. Hey, there you go. Glitch: In all seriousness, so the ⁓ you also have the user driven tagging, which is ⁓ so manual, and nowadays a lot of AI ⁓ L. Cypher: Yeah. And and this is honestly, this is where some of that magic from Dumbledore really does happen because right about now, funk soul brother. That's right. Yeah. So but we can start to build our data inventory, like what you were just saying, and then we can actually start to map that data inventory to the asset inventory. Glitch: Ha ha ⁓ It really is sorta cool when that all starts to come together though. ⁓ the journey there is painful, but when you start seeing it starting to to to to gain yeah, when you start g that's a good way to put it, when you start getting the meaningful output and it it it's starting to come to fruition, then you start to see the light at the end of the tunnel. The tunnel's still really long, but there's start to see a little glimmer glimmer of hope, let's say let's put it that way. Cypher: Mm. Have meaningful outputs. It's a train. Glitch: It it's a tra ⁓ yeah, you're definitely gonna fail run over by a train as you're going through this process. But ⁓ okay, so enough about data classification because your data class should give you that path on access requirements and the applications or platforms that hold the data. Anyhow, you've given me step one and two of demystifying zero trust. Do you got a step three for me? 'Cause I have a feeling you do. Cypher: For sure. I well, I mean, actually you just gave me the perfect segue ⁓ when when you mentioned access. So the the next thing that you need is authentication. Before you give that access over, you need to verify that it's going to the right entity. So you have to have strong authentication in place with phishing resistant MFA as a gatekeeper. Glitch: Okay, that makes sense. So what's what's next for the baby steps? Cypher: So for the first steps, I mean I mean the stuff that we covered, it it's easy to talk about. Very, very, you know, brief for us to mention, but that's a lot. Like small steps for the podcast, but giant leaps for the technologists doing the thing, you know? But d tell me something though. Like even just what we've talked about so far with this whole, you know, taking the first steps and zero trust, what does all of that actually sound like? Glitch: Ha ha ha. Well, my inner voice, inner child, inner architect really it you know, it it kinda sounds like normal security when when you're yeah, yeah. Go figure. Cypher: Right? Right? Yeah. And that's why the name Zero Trust makes me absolutely crazy because it's a very quick and meh name for just having a robust security plan, which is more than all that we just mentioned. But those are solid starters and underpinnings for security. Glitch: I this is where I have to step in and add that network segmentation is a solid place where your IT teams can support your security teams while we ramp up the the catchphrase you love to hate. and before somebody says we forgot, we need to make sure things are appropriately encrypted, whether it's in transit or at rest. Cypher: Yep, yep. And and to de demystify the whole thing, everything after those bits, if you're looking at a zero trust model, is still just normal security because it's gonna, you know, regardless, your framework is gonna start talking about third party security risk management, vendor management. It's gonna talk about monitoring and logging, awareness, threat feeds, audits and assessments, like all of the things that are normal to a security program just robustly. Glitch: Well, so Cypher so why all of the hubba bubba hullabaloo? ⁓ n ⁓ other than th the tiny voices in my head, which is probably still that little architect in me. Yeah. Cypher: It is that little architect. So I mean, so the hullabaloo is because we have to adapt and evolve. You know, I'd love to say that that zero trust was all created as a great marketing gimmick because I mean, honestly, that name is just it's it's junk. but in reality, too many people and too many organizations have put in like a a shell of security and they called it done. Glitch: Well come on now. So in their defense and th this may be a little sarcasm. In their defense, that's because it's hard and it can't be done by one guy, which you know, quit doing you to me. ⁓ it can't be done by one guy or one team, and that makes me wanna bring up our favorite thing again. Cypher: Ha ha ha. Right? Like we have all got to ditch that delusion that we don't have to collaborate with our business. Glitch: So the last lessons are that we have to adapt and evolve as fast as the threat actors and then stop pretending we are the business. For some reason I just saw sliced alone in my head as Judge Dredd. That was the absolute perfect, perfect ⁓ wow, I just forgot the word. What I I can't Cypher: ⁓ geez. I am the law. Impersonation. Glitch: Thank you. Perfect impersonation of sliced alone I've ever heard. Cypher: I mean, yeah, my sound effects and my verse and my voice impersonations, they are are so good that so often people actually mistake it for reality. Glitch: Yeah. Well, I wanted to say the worst, but as I thought about hang on, but as I thought about it for a ⁓ a microsecond, I was like, you know what? No, she had me fooled so bad that I thought it was bad, but that's the thing. It's so perfect and he is so bad. No offense to sliced alone fans, that you hit it dead on. Cypher: Mm. Not even sure how to justify that with the comment that I was absolutely perfectly spot on. Glitch: Yeah. Well, on that egregiously erroneous note how about we wrap this up? Cypher: Truth. I mean, okay, but you know I'm right. I have amazing sound effects. But anyhow, anyhow, you know I'm Cypher. Glitch: And I'm glitch. Remember folks, trust is earned, access is temporary, and if Bob's iPad suddenly asks for admin rights, maybe don't click approve. We'll see you next time.