Zscaler’s SVP and GM Product Management, Dhawal Sharma, sat down with me in an interview at Zenith Live in Las Vegas to discuss his opinion on ‘Zero Trust’.

Sharma shared insights about the evolution of zero trust architecture and the future of VPNs. There are many challenges, misconceptions, and practical applications of zero trust, along with the potential obsolescence of traditional VPN solutions.

Sharma spoke about two main areas of focus in his keynote presentation at Zenith Live. The first addressed platform innovations and the evolution of Zscaler’s platform, while the second delved into the innovations in the zero trust networking stack. He revealed significant developments in private access services, cloud and branch connectivity, identity and access management, among others in the context of zero trust networking.

Sharma commented,

“Zero Trust networking, we’ve been able to talk about innovations on, introducing more capabilities on a private access service and new innovations in cloud and branch connectivity.”

The ‘concept’ of zero trust and its market perception is commonly discussed on social platforms and amongst many guests that I’ve interviewed. Sharma explained that zero trust involves tying trust to identity and context, rather than the network. He detailed how Zscaler’s approach to zero trust involves dynamic, conditional access-based policies that are user-centric rather than network-centric.

The executive added,

“…we we need in an ecosystem of partners. For example, identity plays an important role in, zero trust. We work with every identity provider to get the, identity of the user. But what we also notice is that identities are static. Identities can be stolen.”

The practical implications of zero trust in real-world scenarios, especially for companies with legacy systems and third-party contractors. The cyber security executive elaborated on application-agnostic nature of Zscaler’s solution, explaining its ability to provide a gateway to applications without creating inbound requests, thereby minimising the attack surface.

It was addressed the limitations of VPN as an access mechanism and the shift towards universal zero trust architectures, even within corporate offices. The vulnerability of traditional VPNs and the collaborative effort between security and networking teams in driving the retirement of VPNs in favour of zero trust solutions.

Sharma continued,

“Another good thing that I I personally observed, which is making customers retire their VPNs faster, is traditionally, VPN was owned by networking team because it was seen as an access mechanism, not as a security mechanism.”

Ownership and implementation of zero trust within organisations, means that security teams typically own the policy, while the infrastructure is managed by the networking teams. This collaboration aligns with the broader initiatives led by CIOs, CSOs, and CTOs to drive the transition to zero trust architectures.

TLDR;

The transition to a zero trust approach within the cybersecurity community is gaining immense popularity.

Here are the key takeaways:

1. An Evolution of Innovations:

Evolution of Zscaler’s platform, highlighting new capabilities that have been introduced as part of platform innovations. Additionally, advancements in the zero trust networking stack were also discussed, showcasing the company’s commitment to staying ahead in the market.

2. Understanding Zero Trust:

Sharma explained the essence of zero trust, the shift from trusting the network to focusing on identity and access context. This approach involves dynamic conditional access based policies that are grounded in real-time contextual signals, driving the concept away from traditional network security models.

3. Zero Trust’s Ecosystem:

The concept of zero trust is not just about one product or company’s version of it. It is built using an ecosystem of capabilities and products, and requires seamless integration with various identity providers and partners to harness the power of rich context and attributes tied to users.

4. Adaptive Access and Conditional Policies:

Adaptive access, involves regulating access based on multiple signals and attributes such as user behaviour, risk scores, and device context. The implementation of step-up authentication and automated policy automation is pivotal in optimising security measures.

5. Relevance in Legacy Systems:

Contrary to popular belief, zero trust is not just for modern, cloud-based companies. Zscaler’s solution is application-agnostic and can accommodate legacy systems prevalent in sectors like banking, manufacturing, and healthcare, thereby catering to a diverse range of organisational infrastructures.

6. The Decline of VPNs:

A bold perspective on the future of VPNs, stating that the traditional access mechanism is ultimately becoming obsolete. With the advent of universal zero trust architectures and the rise of vulnerabilities in VPNs, there is a clear shift towards retiring VPNs across various industries.

7. Collaboration and Ownership:

The successful deployment of zero trust requires collaboration between security and networking teams. While security teams own the policy, networking teams take charge of the infrastructure, with the CIO, CISO, and CTO acting as the driving forces behind the transformation.

Practical implementation of zero trust and echoed the potential obsolescence of legacy VPN solutions, signalling a significant leap in the approach to secure network access in the coming years.