Users have left the premise and working outside the four walls of your organization. With the cloud as the new home, applications are leaving the data center. 5G is redefining network and connectivity. Delivering seamless and secure user experience, maintaining business agility, and boosting workforce productivity in this dynamically shifting business and IT landscape would require fundamentally rethinking and resetting the application access paradigm. But how should one go about it, and what are the pitfalls? For those who are farther along the journey, what is the learning? How should IT or Security leaders rewrite their organization’s application access playbook?

Contributor

• • Lisa Lorenzin, Director of Transformation Strategy, Zscaler

Download Podcast
Apple Podcast, Google Podcast, Spotify, Pandora, iHeartRadio, SoundCloud, TuneIn, and Stitcher. Find other syndication channels here or search CIO Talk Network podcast on any other app.
Explore More

• • How to Build a Voice of the Customer Playbook?
  • The Chief Data Officer Playbook
  • A New Playback for Digital Transformation
  • Becoming a Business-first CDO
  • Is an “In-House” Application Development Org Necessary?
  • Improving Application Performance Management
  • Is Hexaware AMAZETM for Applications a Panacea for Legacy Application Modernization?

Transcript

Sanjog Aul [00:00:00]:
Welcome listeners. This is Sanjog Aul, your host, and the topic for conversation today is Rewriting The Application Access Playbook. So here’s the scenario. Most users have already left the four walls of your organization and are working outside. Applications are also moving from the data centers to the cloud, and 5G is redefining network and connectivity. So in this dynamically shifting business and IT landscape, we must still deliver seamless and secure user experience. We should maintain business agility and also help boost workforce productivity. Now this would require fundamentally rethinking and how we are approaching application access and reset it

Sanjog Aul [00:00:51]:
but how should one go about it and what are the pitfalls for those who are doing it already or are farther along the journey? What’s been their learning and what should IT or security leaders do, and how do they go about rewriting their organization’s application access playbook? To answer these questions and discuss these critical elements, I have with me Lisa Lorenzin. Liza is the Director of Transformation Strategy at Zscaler, a company focused on cloud enabled application access and security. Hello Lisa, thank you for joining us.

Lisa Lorenzin [00:01:29]:
Thank you for having me.

Sanjog Aul [00:01:30]:
Great and so Liza, let’s start with this first question about application access. Truly not new, and it has been around for a while and it is essentially a foundational element for IT delivery and to say the least, it has been evolving and working fine for the most part. So why do you think anyone should consider replacing it with a brand new application access model?

Lisa Lorenzin [00:01:56]:
Well, the trends that you’ve just described are the major drivers for change here. Applications moving to the cloud and users going mobile. Traditional access mechanisms for applications really originated in a world where users were primarily on campus and applications were primarily in the data center. So 20 some years ago I was working for Blue Cross Blue Shield of North Carolina. We had applications hosted in our data center. Most of our users were on our network, and we had a VPN to enable, let’s say, traveling nurses visiting our patients and our customers or IT support that needed to adjust on weekends. Nowadays the majority of users may be mobile and the majority of applications may be in the cloud. So treating the network as if it still looks the way it did two decades ago leads to some challenges.

Lisa Lorenzin [00:02:45]:
The traditional network security tools are flexible, scalable, or granular enough. A VPN gives you a single point onto the network, so your device connects to the network in one location like a data center. Then you have to backhaul traffic to apps in other sites, such as other data centers or cloud instances and these VPN gateways are complicated to scale and secure, because you have to cluster and load balance these appliances and you have an inbound listener that creates an attack surface into your network. Additionally, when you connect the endpoint to the network like that, you require complicated network fragmentation to control what they can access. In a way, rather than being least privileged, it’s most privileged. You put the endpoint on the network and then you have to lock down what it can get to. So enterprises really need an application access model that has evolved as our application environments have evolved.

Lisa Lorenzin [00:03:38]:
The migration of apps for the cloud is driving network transformation, and security has to transform as well. We need to connect a user to an application rather than connecting an endpoint to the network and scalability comes from a cloud service that can connect users to applications in a number of environments, rather than having stacks of appliances at every ingress to a network. This gives you simplicity because you can have centralized visibility and control while still having distributed access and that leads to a better user experience and lower costs as you reduce your infrastructure dependencies and your operational overhead. That makes sense.

Sanjog Aul [00:04:15]:
Absolutely. It’s a very thorough response that you gave, and it definitely looks like it justifies that we should start thinking differently and perhaps look for that new application access model. So the next logical question for you will be, how would you define it? What are the tenets of this proposed application access model and how is it better?

Lisa Lorenzin [00:04:37]:
How it’s better is it enables you to start down the road towards a true zero trust environment where no user is implicitly trusted, regardless of whether they fit on the network or off the network and instead trust is extended based on the context. What do we know about the user, what do we know about the device, and maybe even other attributes like location. This allows you to build a least privilege model. So if you’re not authorized to access a resource, you shouldn’t even be able to tell that it exists, let alone send traffic to it. There are four tenets that Zscaler believes helped us deliver a cloud based zero trust service and the first one is we want to eliminate the idea of a virtual private network, or VPN. We want to provide application access without providing network access, so there’s no need for complex segmentation.

Lisa Lorenzin [00:05:26]:
Next one is we should really leverage outbound only connections. If you eliminate the inbound listener of a VPN, you can eliminate that attack surface, and you also eliminate that single ingress point. So instead we enable the application environment to make an outbound connection to the cloud, we enable the user to make an outbound connection to the cloud, and then users get an end to end path to the resources. We can deliver micro segmentation that way and traditionally micro segmentation has been looked at it from east west control between servers, but we’re really delivering north south micro segmentation between the users and the applications and we’re doing that with secure access over dynamic PLS microtunnels. So you can use the Internet as the new corporate network. You don’t need a protected network to deliver protected access.

Sanjog Aul [00:06:15]:
Now if we are going to expect every organization to consider shifting to this model, would that be too tall an ask should everyone or should every organization consider shifting to this new model?

Lisa Lorenzin [00:06:31]:
Yes, but not all at once. That old saying about how do you eat an elephant? Really applies here. Some organizations that are cloud native or that have a really good visibility into their user communications and their application environments may be able to easily make the transition to a fully granular environment but other organizations may have a little more difficulty. If you’ve got a flat network internally, if you’re connecting end users to that network over a layer 3 VPN, then you might not have the visibility into what applications are in your network that users are accessing, let alone who’s going to what. Though when we talk to customers that are looking at making this transition, the majority of them are not ready to go to a full user to application granularity yet. Instead, what we see is we start off together with an application discovery phase where we configure the solution for a more broad visibility. We want to enable connectivity that is similar to full network access, but it’s still at the application layer.

Lisa Lorenzin [00:07:37]:
So we can see every application that the end users are connecting to and who’s connecting to those applications, what groups they’re in. This allows an organization to do a gradual migration from the current network centric model to an application centric zero trust model. Really two phases. You identify the things that you know and you start to build granular policy for those things upfront and at the same time you leverage the visibility provided by the solution to discover your unknowns. You can start to categorize them into things you want to lock down, things you don’t need to lock down immediately, and things you don’t even know what they are and you need to go investigate why they exist. So I would say that there was really going to be a transition period for most organizations where the new and old models will coexist for a while. The concept of a rip and ripple is just too big a list, though

Lisa Lorenzin [00:08:31]:
we saw an organization that was looking to migrate their third Party users from VPN to the Zscaler solution and that was relatively simple for them to do because they knew exactly who those users were and exactly what application those users needed to access. They put this solution in place to provide a more segmented solution so we avoid things like lateral movement and the prospect of an organization being compromised due to a breach at one of its third party vendors. Once they got that off the ground, they realized that they had internal applications, that they already understood the user community and they could start to extend the Zscaler Private Access solution to employees accessing specific internal applications and that really took off on its own once the employees started talking to each other, and more particularly the application owners started talking to each other. What we found was we had application owners coming to the IT and security teams and saying we want to enable our applications the same way that you’ve already enabled that chat over there because we’re hearing that their users have a more seamless and more consistent user experience. So it really turned into something that the growth was organically driven internally rather than something that the IT team was trying to push down the application owner’s growth.

Sanjog Aul [00:09:52]:
Let’s take a quick break listeners. We’ll be right back and let’s look at how well have the technology solutions that are out there keeping up to support this new application access models and where are the gaps and essentially where are the opportunities for innovation. So please stay tuned. We’ll be right back.

Sponsor [00:10:18]:
Users are leaving the building and apps are moving to the cloud. Are you still thinking VPN? It’s time to let users connect to your apps, not endpoints to your network. Leverage the power of ZTNA Zero Trust Network Access with Zscaler Private Access, a cloud enabled zero trust solution, boost your workforce productivity and improve business agility while delivering a seamless and secure user experience. Zscaler delivers a better application access solution without the bigger infrastructure. To learn more, visit zscaler.com ZTNA visit today. This is CTN Brandcast on CIO Talk Networks.

Sanjog Aul [00:11:09]:
Welcome back listeners. So Liza, how well do you see the technology solutions keeping up to support this new application access models and where are the gaps?

Lisa Lorenzin [00:11:19]:
I would say that the legacy network security vendors are trying to provide solutions to these challenges, but unfortunately most of them are taking an approach that’s commonly termed as cloud washing, where you move the on premise appliance model into a VM in the cloud and that approach carries all the same deficits. You have the inbound listener, you have the single ingress point, you have the complexity of segmentation for an open connection. Plus you also get some new challenges. There can be a requirement for a flat IP network through both the data center and cloud, which is really hard to accomplish or you can take a solution that really isn’t born in the cloud and that means if you need to change the scaling, rather than being seamless, it’s an outage. Though taking a network centric model and trying to extend it to the cloud, you have to be careful that you don’t bring the challenges of the network with you.

Sanjog Aul [00:12:11]:
So Liza, where are the opportunities for innovation?

Lisa Lorenzin [00:12:15]:
Let’s say that operates on two levels in the solutions themselves, there’s the ability to integrate more and more contacts that with a centralized identity provider, you can make decisions based on not only what we know about the user in terms of their role, their group, their location, but also in terms of the device itself, whether it’s managed or unmanaged, whether it’s a personal device or a corporate asset. Also either compliance information and we can also integrate other technologies to make the solution more flexible and more secure. So machine learning, browser isolation, there are a number of ways that these solutions are getting stronger at the internal network and the service edge converged. I would also say that there are opportunities for innovation within the organization where the IT and security groups can really drive business by offering a better user experience, more seamless access to resources, and a simpler environment at a much lower cost. We see organizations looking at areas such as crowd migration or mergers and acquisitions or third party access as use cases where they can provide a better value to the business along with the traditional remote access.

Sanjog Aul [00:13:29]:
So what people and processes and compliance challenges do you think, Lisa, we may face during this journey and since some people may have tried it a little bit, this whole transformation, what’s worked for those who actually went through the journey and what’s been the learning and finally, where are they still struggling?

Lisa Lorenzin [00:13:50]:
That’s a lot to unpack. So let’s take it in order from a challenges standpoint. If you think about the people, there’s a shift in mindset that have to take place from a network centric to a user and application centric approach and organizations with mature, well established network and security teams may face reluctance to move away from model that worked perfectly well when it was introduced. It wasn’t wrong but the environment has changed around us and it doesn’t really keep up though, we’ve seen customers come in and really work on reskilling and retraining their IT and security personnel on these new technologies from a Process standpoint, you really need a good level of identity and access management maturity so that as you identify your use cases and your user communities, you have the background context to deliver access appropriately and there may be the need to develop new processes for requesting access to specific applications.

Lisa Lorenzin [00:14:46]:
On the compliance end, you need visibility into the end user device, but that’s not always available. Though you want to be considering what compensating controls you want, such as for example, browser isolation if you’re delivering access to a personal device. What we’ve seen working is really look at a phased deployment and look for the low hanging fruit. Where’s a pain point that you can quickly and easily address and then build on that scenario to increase your knowledge and expand the solution to tackle other areas. For example, we worked with one customer that was a manufacturing company and they purchased another manufacturing company. They were looking to integrate the two networks after the acquisition. What they found is that they had 100% IP overlap between the two data centers because everybody’s on 10/8 these days internally that was going to be a real challenge for them.

Lisa Lorenzin [00:15:40]:
It was going to take them 9 to 12 months to go through the full integration processes, interconnecting, assessing security hygiene, identifying what segments needed to communicate, resolving IP overlaps and putting in a layer of ACLs and proxies and natch to get immediate access. Though they came to Zscaler to look at Zscaler private access as a temporary solution to very quickly connect critical people in each organization with key applications on each side of the acquisition. They stood that up for application access and it worked so well for them that they found that they were able to reassess the scope of the network integration and really use private access as their permanent solution for application access and reduce the network integration requires. That enabled them to simplify the user experience, reduce their cost, streamline the process post acquisition and provide better service to both ends of the business and if organizations are really struggling with this, the best thing you can do is be realistic about how much you can bite off at one time. What does the technology support that benefits your environment? More importantly, what can your organization absorb?

Sanjog Aul [00:16:54]:
How do you see application access discipline overall developing further and what do you suggest how IT and security leaders should keep their application access playbooks up to date, given all the changes that we expect coming down the pike?

Lisa Lorenzin [00:17:12]:
That’s a great question. I would say that the concept of zero trust was introduced 10 years ago and it’s really been difficult to instantiate that concept but we’re reaching a point where the technology makes implementation realistic. You can handle both inbound and outbound traffic. You can handle applications that are in the data center, in the cloud, users that are on and off premise, and desktop and mobile devices. I think that as we evolve this solution, we’ll be looking as closely at data protection as we are at application and network protection. So browser isolation again becomes an important technology and I think that application access is going to really require again, a strong focus on user experience, the ability to reduce complexity, reduce operating cost, and full visibility and granularity into where users are going so that the application access adds value to the organization and IT and security aren’t looked down as a cost center, but are looked on as an enabler.

Lisa Lorenzin [00:18:19]:
Looking farther out, I think that the prevalence of 5D as it starts to grow and become a realistic access method is going to only make this more important because when you think about the connectivity that users are going to have on mobile devices, connectivity speeds and the quality of connectivity they can get, that’s really going to make it more feasible for users to work on 5G rather than enterprise wifi. I think that’s going to drive a shift first away from providing WI fi for guests, but long term, possibly against it, away from providing wifi even for employees. If you’ve got full high speed, high quality connection on your phone, why do you need to connect to local wireless? At that point we almost see the inverse of the traditional. You want either to be able to work as well from Starbucks or at home as they do from in the office. Now you want to be able to work in the office the same way you do from Starbucks and that again makes it more important that application access is as seamless for the end user regardless of where they are, and then you still have full visibility and control for the administrator. So if you’re using the Internet as your new corporate network, that’s going to apply on premise as well as off premise.

Lisa Lorenzin [00:19:38]:
We haven’t seen that in the past and the way to keep up to date is yes, one good source is Gartner. They’ve really been out leading the field on this one with their white papers on Carta, ZTNA and Saasi. Those are three acronyms that really need to be unpacked and you can do that by reading their white papers in those areas. There’s also a really good vendor agnostic Zero Trust Architecture draft that just came out from NIST. The NIST special publication 800-207 on zero trust architecture talks through a lot of the use cases and deployments but finally, I would say talk to your peers, find out what’s working for them. There’s a number of really solid C level events where CIOs, CISOs, CTOS can exchange information about what zero trust initiatives you have going on, what’s working in your environment, what you want to tackle next. Crowdsource this.

Sanjog Aul [00:20:34]:
Once again, thank you Lisa for sharing your thoughts and insights about how IT leaders must rethink application access to allow users to connect to the apps, not just endpoint to the networks and make it seamless and secure for the dynamic and faster future ahead.

Lisa Lorenzin [00:20:54]:
Thank you. It’s been a pleasure to talk with you too.

Sanjog Aul [00:20:57]:
And listeners. I invite you to find related conversations on our website@ciotalknetwork.com.