Are you attending this week's RSA Conference?  This is the world's leading information security conference and exposition taking place in San Francisco.  To get ahead of many of the security topics that will be discussed at the show, VMblog spoke with Shehzad Merchant, Chief Technology Officer of Gigamon, the company providing network visibility and analytics on all information-in-motion across physical, virtual and cloud environments.

VMblog:  What are you most looking forward to at RSA?

Shehzad Merchant:  I look forward to RSA every year. It's a great opportunity to reconnect with other security professionals. This year, I am particularly excited to see and discuss some of the technologies that are at the intersection of virtualization, cloud and cybersecurity. Security for many years had taken a back seat when it came to digital transformation - driven by virtualization and the cloud. In fact, security was almost an afterthought in the journey of digital transformation and the move to the cloud. But we are finally seeing that change with cybersecurity becoming front and center of the cloud migration conversation. I am also very excited for our presence at RSA, as we have had an amazing year with record revenue growth and the strongest fourth quarter in the company's history. We will be located at booth S-1243 showcasing network visibility, analytics and security product innovations that work across the hybrid cloud. I encourage readers to swing by the booth or coordinate a meeting to learn more about the role of network visibility in any organization's digital transformation strategy.

VMblog:  What are the largest security market trends that Gigamon is solving?

Merchant:  We live in a digital age where connectivity is almost ubiquitous. And mission critical systems are now coming online. With this, we are seeing a shift in the nature of cyber-attacks. Whereas attacks on confidentiality of information used to dominate the headlines, we are now seeing attacks on the integrity and availability of systems.

One of the important approaches to detect breaches in this connected world of users, devices, and systems, is to monitor the network traffic for footprints that can lead to the attacker as well as identify and enumerate all the applications, devices, and users on your infrastructure. This is an area where Gigamon along with its partner ecosystem is making a big difference. Indeed, this approach is at the heart of the Zero Trust architecture.

Zero Trust is a significant architectural shift in how organizations model their security strategy. It is rooted in the fact that we can no longer imply trust, based on whether an asset is on the "Intranet" or the "Internet". In other words, all assets be it a user, device or an application, need to be identified, authenticated and access controlled. And from there on continuously monitored. 

At Gigamon, we have a firm belief in all organizations taking a Zero Trust strategy where they understand, manage, and most importantly, decrease implicit trust across their infrastructure. Think of Zero Trust as a journey that is always changing and requires consistent monitoring. It is an ongoing process that provides additional security with each step.

VMblog:  What are some network security best practices you would deem critical?

Merchant:   I would break this down into three pillars or three areas of best practices. The first is practice good hygiene - things like multi-factor authentication, network segmentation and endpoint protection. The second pillar is continuous monitoring and detection. And here it is important to leverage the network wherever you can for visibility. The network is perhaps one of the most content rich sources of telemetry. And the third pillar is automation and rapid response.

And let me offer one practice to perhaps start deprecating - and that is trusting a user or device or application just because it is on the "Intranet". That implicit trust is the root of many breaches. From a Zero trust perspective, whether an asset is on the "Intranet" or "Internet", it should be treated no differently. Getting to this point is a journey. But start with setting that as an explicit goal and then take steps towards that goal.

VMblog:  What are some top priorities for security leaders at RSA to achieve Zero Trust?

Merchant:  The starting point for any security leader is to recognize that Zero trust is a journey that starts with mapping out and understanding all the assets (users, devices, applications) on the network. This is the starting point. From here the next set of priorities quickly evolve to putting in place an authentication and access control strategy, using multi-factor authentication for all applications, segmenting legacy assets, and putting in place a continuous monitoring strategy. These can happen sequentially or in parallel based on the capabilities and skills in the organization. It is important to not try to do too much all at once, but pick a few of these areas to focus on and incrementally move the ball forward.

VMblog:  What are some common misconceptions about Zero Trust?

Merchant:  It is important to recognize that Zero Trust is not a product. Zero Trust is a framework, and a journey. And while many organizations have a hard time believing that Zero Trust is achievable, it is a journey that all organizations can embark on with some basic steps. In most cases, organizations shy away from the concept simply because they don't know where to start. And many organizations focus on the end state and attempt to boil the ocean all at once to get there. My suggestion is don't try to boil the ocean. Start with the basics and build upon it incrementally. Map out your assets, multifactor everything, put in place a continuous monitoring strategy and build upon that.

VMblog:  How does Zero Trust provide a framework to address the complexity introduced by digital transformation?

Merchant:  Digital transformation involves the introduction of new applications that power the transformation. These applications typically run over a hybrid cloud infrastructure, with users accessing these applications over any available network - be it the corporate network, a guest network in a hotel or a hotspot in a cafe, or over a cellular network. Increasingly many of these applications are accessed via local breakouts from remote locations - aka SD-WAN, rather than hair-pinning the user's traffic back to a corporate network. This new world breaks many of the existing security assumptions that traditional security models or frameworks adhered to. Zero Trust provides a framework to address this complexity by systematically eliminating implicit assumptions of trust - for example implicitly treating the Intranet as being more secure than Internet, even when the user on the Intranet is using his own personal device that may have surfed suspicious sites over an insecure hotspot. Approaching security through a "Zero Trust lens" reduces complexity by providing a consistent approach to security and a consistent user experience irrespective of where a user is coming from - be it a hotspot, the corporate Intranet or another location. It helps organizations build in best practices for visibility into their infrastructure, across private, public and hybrid clouds.  

VMblog:  Any 2020 predictions related to Zero Trust VMblog readers should be aware of?

Merchant:  I expect Zero Trust to be scrutinized heavily in 2020 and in fact I expect that Zero Trust will go through its own hype cycle in 2020. This may lead to potential confusion as well. However, out of the ensuing confusion, I expect there will arise a better understanding of what Zero Trust is, what it is not, and how best to embark on the journey. I look forward to helping organizations embark on that journey.

##