Everyone seems like they are on board with the principles of zero trust. So why do we see implementation lagging?

Check out this post for the discussion that is the basis of our conversation on this week’s episode co-hosted by me, David Spark, the producer of CISO Series, and Steve Zalewski. Joining us is our sponsored guest, Rob Allen, chief product officer, ThreatLocker.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, ThreatLocker

Full Transcript

Intro

0:00.000

[David Spark] Everyone seems like they are on board with the principles of zero trust. I mean, even the US government is on board. So, why do we see implementation of zero trust lagging?

[Voiceover] You’re listening to Defense in Depth.

[David Spark] Welcome to Defense in Depth. My name is David Spark, I’m the producer of the CISO Series. And joining me for this very episode is my co-host, none other than Steve Zalewski. Steve, say hello to the audience.

[Steve Zalewski] Hello, audience.

[David Spark] That I heard. For those listening, we had audio troubles for me hearing.

[Rob Allen] No, no, you had audio problems. You had audio problems.

[David Spark] I had audio problems. That was our guest who I will introduce in just a moment, who likes to taunt me. You’ve heard him on the show before too. But hold on, let me mention our sponsor. And that would be ThreatLocker Zero Trust Endpoint Protection Platform. ThreatLocker has been an absolute spectacular sponsor of the CISO Series. We love having them on board. But let’s get to our topic at hand, which is near and dear to pretty much everyone’s heart.

I don’t know anyone who is not embracing zero trust at some level here. So, Steve, who’s nodding his head back and forth, let’s sort of set this up. If we could all practice the zero trust that we preach, we’d all be in a much more secure position today. But that just doesn’t happen. Does some of this have to do with the underlying principles of zero trust? Are some just much more difficult to achieve? I think so. Or are some of them letting us down when rubber meets the road?

Like when the actual implementation happens. So, Steve, it’s rare we have such agreements in cybersecurity. I mean, this is a big one we’re all kind of on board with. We mostly agree on zero trust. But geez, why are so few getting there? What do you think?

[Steve Zalewski] So, when we were at RSA, I heard this over and over, which is why we posted it. But you know what I was thinking over the course of RSA? I go, you know, this sounds an awful lot like going to the dentist and talking about the value of flossing. Everybody agrees flossing is a good idea, yet we have a thousand and one reasons why we don’t floss. And I just was then starting to characterize. You look at the reasons that people are putting up, just like when we talk about why flossing is too hard, even though we all agree it is well worth the time and effort.

[David Spark] I would also say we’d all be on board if [Laughter] zero trust was as easy to implement as flossing is, which I can’t say it is exactly.

[Steve Zalewski] You know, like I said, it was a good analogy because flossing should be easy. And yet even that, as “easy” as it is, we find reasons. And that’s why I was like it’s like death by a thousand cuts. Zero trust is great. But maybe part of the reasons that we’re having this conversation is here’s the death by a thousand cuts by why we somehow cannot get over the finish line. It’s just a fascinating conversation.

[David Spark] All right. To help us with this discussion, someone we’ve had on a bunch of times before with ThreatLocker, actually the chief product officer. And by the way, they are very much into implementing zero trust, and I think they actually have some pretty easy ways to get it implemented. Please, everyone, our sponsored guest. Let’s hear it for none other than Rob Allen. Rob, thank you for joining us.

[Rob Allen] Thank you, David. Am I expecting applause to come through now or something?

[David Spark] Yes, it will come through.

[Rob Allen] Okay, excellent. Yeah.

[Steve Zalewski] Assuming the audio works.

[Rob Allen] Assuming David’s audio works.

Is this problem solvable?

3:30.917

[David Spark] Andrew Wilder, CSO over at Vetcor, said, “Where do I start? First, legacy infrastructure and technical debt that were not designed for continuous authorization or just-in-time access. Second, ‘what keeps me up at night’ real-time complete asset inventory and user inventory. Consider shadow IT and non-human identity explosion. And third, if you were somehow able to solve both of these problems, is how to do both consistent and automated policy enforcement across our hybrid landscapes.” So, I think what Andrew’s saying, Steve, is it’s not as easy as flossing. And Ferenc Spala of Cognizant said, “Many companies still struggle with decade-old problems.” This one I’ve heard a lot.

I’m being selective here, but Ferenc responds with, “Still running business critical systems on Windows 2003. Still have hundreds of ‘graveyard accounts.’ Still trying to patch vulnerabilities based on CVSS severity and can’t keep up, and the list goes on. You can’t really do effective zero trust without having your identity access management and identity governance and administration in good shape. Unfortunately, this is an area that is very similar to configuration management database. Everyone has it and everybody knows it’s not really good.” So, Steve, I go back to what I said at the beginning. I think everyone’s on board, but wow, there’s just a history of problems, aren’t there?

[Steve Zalewski] There is a history of problems, absolutely. And the ability to solve that history of problems is a lot of what’s being brought up here is I want to move forward, but a lot of what my problems are are things I can’t move forward, like legacy debt. In addition to the explosion of new areas where zero trust as we’ve tried to solve it, it’s now getting around us. And so, it’s squirting out on the side and we’re having to chase the rabbit.

[David Spark] Rob, what do you think? When people just say, “I’d like to do zero trust, but man, it’s so complicated, and I got all these other old problems that I’m still managing with.” What’s your response?

[Rob Allen] I’m trying to figure out a nice way to put this, but just because something is hard doesn’t mean it should not be done.

[David Spark] Well, that is the polite way of saying it.

[Rob Allen] I can give you a great number of examples that are of difficult things that were done largely because they were difficult. Not done because they were difficult. I mean, think of men on moon, etc. But to be perfectly honest, if zero trust being difficult was the major stumbling block, then Threatlocker wouldn’t exist because what we do is not easy. And we try and make it easy for our customers, but the actual implementation of these things is not simple. It’s not straightforward. It’s not like flossing. But just because something isn’t easy doesn’t mean it’s not worth doing.

[David Spark] Let’s talk about legacy systems that don’t really have this sort of identity management as well-defined as the newer systems, and those become the most difficult to implement zero trust. What’s your response to people dealing with like systems running on Windows 2003?

[Rob Allen] Well, there’s two sides to our response to it. We recently, and I mean very recently released a XP and 2003 version, our compatible version of Threatlocker…

[David Spark] Wow!

[Rob Allen] …which feels really strange to say in the year 2025, but for precisely this reason, which is some customers do have legacy systems.

[David Spark] Actually, could you ballpark, like what percentage of your customers have 20-plus-year-old operating systems running environments?

[Rob Allen] A very small percentage overall, maybe 5%.

[David Spark] Well, that’s still significant.

[Rob Allen] Well, the interesting part is some of those organizations might have 20,000, 30,000, 40,000 endpoints, and they’ve got a handful of XP machines or a handful of 2003 servers. So, out of millions and millions and millions of machines that are out there, you might be talking about a couple of hundred.

[David Spark] Okay.

[Rob Allen] Realistically. Now, again, people still worry about them. They are concerned with them for good reason, which is they are potential massive security holes. So, they do want coverage. They do want a way to protect those assets. Which, as I said, given that we’ve just released an agent for XP and 2003 shows we understand that. The other part of it, though, the other way to look at it is why don’t you protect the rest of your network from those 2003 and XP assets that are clogging up your network? So, there’s two ways to look at it. One is that we hear you. It’s something that people want to cover. So, we do. But also lock down the rest of your network from those potentially vulnerable assets.

[David Spark] By the way, just closing, was it hard to even just find a copy of Windows XP or Windows 2003? [Laughter]

[Rob Allen] You have no idea. You have no idea. Slight aside, we set up a test environment for a prospect recently and one of the things that they wanted, so set it up all in AWS. And one of the things they wanted was to test the XP agent’s functionality. You have no idea how difficult it is to set up a XP VM running in something like AWS. In the end, our incredible infrastructure team basically had to do VM inception. So, they had a VM running on a VM inside a VM to even get XP to operate. But again, it exists. We know, and we try to accommodate as much as we can. To be honest, my reaction would be to update your things. But unfortunately, it’s not always possible.

[David Spark] I remember years and years ago, and give you an idea, I actually had to write a review about something on Windows 3.1, if your brain can go back that far. And I had to go buy an old machine to run it because you can’t run it on anything new. It has to be an old machine. [Laughter] That’s the only way I could do it.

[Rob Allen] I suppose on a wider way of looking at this, I mean, where to start is not to find all the reasons not to do it. It’s to find the reasons to do it and to deal with those obstacles rather than just throw your hands up in the air and say, “Oh, it’s too complicated. We’re not going to do this.”

Where does this effort fall flat?

9:48.629

[David Spark] Steve Tout of Identient said, “I’ve noticed some leaders wear zero trust like a personality, not a framework. The real question is, do we trust our people, and do they trust us? Or has zero trust become so overhyped that we’ve architected trust out of the system entirely? Because if we truly have zero trust, then who enforces what? Who watches the watchers?” This is sort of a theory, like true zero trust. I mean, we’re taking this philosophy, truly. There’s a point where you have to trust somebody. So, for example, trusting ThreatLocker to help you. I mean, somebody has to be trusted at some point. But a couple more quotes here.

Stephen Cicirelli of NVR said, “At this point, it becomes hard. Planning, changes, dealing with legacy, and there are numerous options for that. Friction, multiple new processes, trainings, etc. Wait, is that a new CVE? Let’s go deal with that.” So, one thing we heard is people get distracted by other things, not dealing with zero trust.

And Indus Khaitan of RedBlock said, “Even the complex, vendor-driven standards of the past, like POSIX, at least had an architectural model and a certification checklist. Where is the industry body that certifies a product as zero trust? That’s a problem.

To each zero trust to their own. I missed the whole zero trust wave during my 10-year break from cybersecurity, and when I came back, something didn’t add up. I looked into what exactly constitutes a zero-trust architecture and couldn’t find a clear, comprehensive answer. Zero trust, nothing that definitive, just vibes.” So, I’ll start with you, Rob, here on this. We believe there’s an architecture, but everyone sort of has an opinion and seems a little loosey-goosey. What do you say to that?

[Rob Allen] Okay, my favorite, and I suppose you shouldn’t really have a favorite definition for something that you’re going to base your security strategy on, but leaving that aside, my favorite definition of zero trust was the one that I think you mentioned the US government described as part of one of the executive orders mandating zero trust. And there’s a few nuggets within it that I think sum up the entire philosophy perfectly. One is to remove implicit trust in any element, node, or service. Now that actually speaks to the first comment there, which is zero trust doesn’t mean zero trust. It means zero implicit trust. Add explicit trust rather than implicit trust. It also says that you should assume that a breach is inevitable or has already occurred. So, constantly limit access to only what’s needed. That’s the second really interesting part in this definition. But it basically says the zero-trust architecture allows users full access, but only to the bare minimum they need to fulfill their function. There are three parts of that definition, but they describe it as well as anything I’ve ever seen.

So, as I said, the first one pretty much answered that first question, which is it’s not about removing all trust. It’s about removing implicit trust. So, just because I need to run SolarWinds agent on my machines doesn’t mean that I need to trust the SolarWinds agent implicitly because that’s fundamentally where the Orion breach came from and happened because people deployed this thing and they went, “Well, it’s running, so it needs to do its thing, and it can go off and talk to a C2 server out in AWS,” or similar cloud hosting service, which is pretty much what happened with Orion. I suppose defining is somewhat of a challenge. Fundamentally, my favorite of the three is assume breach. So, work in the principle they’re already in. They’re on your network right now. They’re on your service. What can they do? And work backwards from there.

[David Spark] Steve, let me throw this to you. What I’m hearing from Rob, and I realize is that, and we talked a lot about sort of old technologies, we are trying to shift the entire paradigm of computing. This is a massive lift because the whole paradigm of computing, when it started, and the internet was access to all, free for all. And we are trying to do a massive shift in the other direction. And if you have a history of that, wow, well, that’s why this is so difficult. Yes?

[Steve Zalewski] I think you’re on to something there, which was zero trust is a state of mind. And if you’re fundamentally changing the state of mind, you’re going to have a lot of consequence. One way to look at it is, hey, look, if I’m a parent and I’m a helicopter parent, okay, and I’m going to make sure that that kid becomes an adult in the way that I think he should be a functioning adult. And then you become a Socratic parent where you’re going to let the kid do whatever it wants, and you’re just going to talk to them about the implications of the decisions you’re making for the type of adult you’re going to be. Dramatically different.

And I think that’s what we’re doing here, which is we went from one of we want functionality at all cost – functionality, functionality, functionality – and now we’re coming back to the nonfunctional, “Yeah, but we only want to trust you a certain amount. And so, therefore, let’s talk about a trust framework.” And we’ve been arguing about that ever since, which was it’s a frame of mind. It’s a state of mind that we’re trying to implement. Now, in doing that and pulling back from what we fundamentally want, nonfunctional requirements, security, nobody does it out of the goodness of their heart. So, we’re fighting an uphill battle of functionality first. And I think that’s where we’re coming from because then zero trust becomes, is it good zero trust or is it good enough zero trust? How are you trying to establish that bar and then meet it? And now I go, “Hey, look, you’re supposed to floss.” If I floss once a month, like David does, or I floss every day like Rob does, do you have the same results?

Sponsor – ThreatLocker

16:01.592

[David Spark] Well, our sponsor is ThreatLocker. And if you don’t know what they do, you’ve got to pay attention because it’s pretty awesome, especially around zero trust. So, in cybersecurity, we all know that seconds matter and precision matters. And that’s why ThreatLocker is upping the game again. The company just launched a new set of solutions built for teams who need to move fast without compromising security.

It’s zero trust, but without complexity. Ah, this is what we want to hear on this episode. So, with ThreatLocker Insights, you get real-time intelligence from millions of endpoints worldwide to empower you to make the best swift cybersecurity decisions on what applications to allow and what controls to put in place for your environment. Patch management? 

Well, instead of chasing updates and manually approving patches at 2:00 a.m., ThreatLocker takes care of it for you with the rigorous research and testing, you need to stay compliant and secure. Cloud control adds an essential layer of defense, further closing the gaps that phishing and token theft campaigns love to exploit.

They’re also making life easier for IT and security teams with the new user store, a smart way to give users instant access to pre-approved software while maintaining the strong security of your environment. And for web threats? Well, web control lets you block sites you don’t trust, or users should not access from the workplace. It blocks unapproved content by category, not URL by URL. So, of course, you still get ThreatLocker’s 24/7 US-based Cyber Hero support. 

No scripts, no waiting hours for answers. They deliver world-class swift support, responding in about 60 seconds. It’s no accident that over, listen to this, 50,000 companies now trust ThreatLocker to help them harden their environments against modern threats. If you’re serious about tightening your defenses and getting a platform that doesn’t slow you down, check out their website, ThreatLocker.com to learn more. Go check it out.

Does anyone understand what’s going on?

18:09.244

[David Spark] Greg Notch, the CSO over at Expel, said, “My interpretation of its original intent is that it is a set of concepts and strategies marrying network boundaries, strong identity, device trust, and authorization. Turns out those are all very [Laughter] complicated things to implement individually, especially as scale and complexity goes up. Marrying them all together? Sisyphean task. There’s never going to be a silver bullet for implementing zero trust. It’s a strategic pillar for a security program, not a destination.

And Eduardo Ortiz, Techtronic Industries, said, “One, the scope, it’s massive. It touches every user, device, application, data point. Two, legacy systems and technical debt. We need additional challenges from the business and investment to integrate diverse technology. And three, organizational culture and resistance.” All right, Steve, let me talk about that very last item, organizational culture and resistance, and that goes back to your earliest comment about flossing. I mean, the technical challenge alone is tough, but now you have people pushing back on what is such a tough technical challenge. I mean, again, go back to the Sisyphean test with Greg Notch, man. It’s tough, but you got to do it. Yes, Steve?

[Steve Zalewski] That’s just it. Do you have to do it? If it’s a state of mind, what’s good enough? What is good enough security? And so, if I go back to flossing, if the goal is to have no cavities, I don’t want my kid to have any cavities, then I’m going to have him floss every day. But I have to get him to school on time because ultimately, is school more important than no cavities? 

Is selling jeans more important than reducing the likelihood that I’m going to have a major breach? Say the reality of what we’re trying to do when we look at the larger problem, that’s what we’re talking about here, is security for security’s sake is awesome. Unfortunately, security is not the end goal. It is a cost of doing business. 

How much do we want to invest relative to having no cavities and beautiful teeth versus getting to school on time and being able to get a college diploma? It is that kind of apples-and-oranges conversation that we’re calling out here, which was so how comfortable are we as security practitioners looking at zero trust and establishing what we think that is for our company relative to what the company needs it to be? There lies the rub.

[David Spark] So, Rob, you’ve had a lot of success at ThreatLocker with getting customers on board. I’m assuming they’re coming to you already eager to get zero-trust implementations. You don’t have to actually sell the concept of zero trust. I would assume that culturally the company is there, or is it not there?

[Rob Allen] No, not always. Companies have all sorts of reasons to talk to cybersecurity providers or different cybersecurity providers. Unfortunately, a sad reality in a lot of cases. It’s, “We’ve just been hit,” and realization has unfortunately too late come, which is that we should be doing something slightly differently. One thing, and coming back to changing ways of thinking in terms of simplifying this, in terms of getting the message across. One way that I would encourage people to think is that there is a change, and the change is a very simple one. It’s a change from default permit to default deny. That explains everything.

So, just because I can run everything on my computer doesn’t mean I need to run everything on my computer. Just because PowerShell can reach out to the entire internet doesn’t mean that it has to reach out to the entire internet. And by that one small change, it’s a mind shift change, but it is also a practical enforceable change. But by changing from default permit everything to default deny everything, I’m not going to say it gets you to where you want to be because again, it’s not a destination. It’s a journey. It’s a way of looking at things. It’s a mind shift change. It’s all of those things. But that one change, which is not default permit – default deny – really gets you moving in the right direction.

[Steve Zalewski] Which, and I agree, and it gets to organizational culture and resistance, which was how much friction is the business willing to accept? Which was how much constraint over what they perceive is their ability to sell more jeans? Can you sell them at the associated cost, right, relative to the risk that an incident brings to the business function? Now that, as clearly as I can state it, is that’s the challenge. And so, I love what Rob said, but in doing that transition, here’s where the business doesn’t want to play, right?

[David Spark] And I’ll kind of speak for you here, Rob, because we’ve been working with ThreatLocker a lot. You know that that concern exists. And so, very much so building out ThreatLocker is taking that concern into account and trying to make that as painless as possible. Do I have that right?

[Rob Allen] Absolutely. It’s about setting guardrails. So, you fundamentally set guardrails around a user’s behavior, where they can go, what they can access, what they can run. If they can run something today, they’re going to be able to run it tomorrow. But if they try and download Couper [Phonetic 00:24:03], the Chinese coupon clipper, they’re not going to be able to run it. If they try and run 7-Zip, which is made in Russia, they’re not going to be able to run that. So, it’s about setting guardrails again, allowing the user to do what they need to do, but no more.

[David Spark] Don’t let them fall into the lion’s pit.

[Rob Allen] Well, yeah, absolutely. But to Steve’s point from objection from business, I mean, the objections are typically the CEO. I want to do everything I want to be able to do.

[David Spark] [Laughter]

[Rob Allen] But I mean, realistically, most users, and look, I consider myself to be a pretty, I’m not going to say a hardcore user, but a pretty advanced user. I genuinely cannot remember the last time I had to install a piece of software on my computer. Months ago, perhaps. So, it’s not something that comes along that often. Like change isn’t constant like some people imagine it to be. Now, there may be a very small subset of users who do constantly install things, constantly do new things. And again, it’s not about tiring [Phonetic 00:25:00] everybody with the same brush. You don’t need to apply the same restrictions to your developers, for example, than you do to your finance department because they work in completely different ways. So, apply appropriate controls to each group, and you shouldn’t, in an ideal world, get in anybody’s way.

[Steve Zalewski] Steve, but here’s the challenge. I use the analogy about wanting to floss. Floss is proactive, right? Floss is, hey, look, I don’t want cavities. The business wants to play in traffic. Okay, well, the conversation of, I want you to floss so you have no cavities, versus the business wants to play in traffic. That is a completely different conversation. And that’s what you’re calling out, is that the business wants to feel like they can play in traffic. That is freeing, it’s exhilarating, it’s selling more jeans. But how do we do it in a way that we know who is playing in traffic when, so that we can limit the consequences of doing that relative to selling more jeans, right? And I go, that is what we’ve been talking about here throughout the course of this episode is zero trust is a concept. What’s the right analogy to implement it so that we’re appreciating the business as we’re bringing the value proposition forward?

Why are we blaming users?

26:17.891

[David Spark] Ezra Ortiz of Peraton said, “The policy’s easy. The design, integration, cost, user experience, and maintenance are the issues. Overworked IT staff, level of effort, multiple layers of defense in depth, for what purpose, and priorities between security and IT functionality. Then there is user experience, token hard/soft, complex password, frequent rotations, or use a password manager or phone authenticator. 

All this just to be bypassed by a simple human error caused by design. The outcome is blaming the user and never the design or architecture. And I think, Rob, this is where you guys fall in. You are trying to get away from that. You are trying to create, like you just said, the guardrails so the user can’t hurt themselves or the organization. Yes?

[Rob Allen] No, you’re absolutely right. Just because something is a little bit difficult doesn’t mean you just give up. Saying multiple layers of defense in depth for what purpose? I would hope we all know the purpose at this point, which is you don’t want to be the next front-page news for a massive data breach or ransomware incident that shuts down your business. 

So, you would hope that we know that. But also, as I said, yes, users are a weak link. Maybe arguably the weakest link. As part of our certifications, we have to do cybersecurity training. Everybody in the organization has to do cybersecurity training once a month.

[David Spark] Our listeners are aware of this, yes.

[Rob Allen] Yeah, and I literally just finished mine today. And it was all about phishing and vishing and all these kind of things. But again, it’s educating people. But I mean, the fact of the matter is, look, people are going to make mistakes. 

What you don’t want to happen is a mistake made to turn into a major breach or cybersecurity incident, and that’s what we’re trying to protect against. It’s yes, you can click on that link. And instead of PowerShell opening, you’re just going to get an error message and you’re going to go, “Oh, okay, well, that didn’t work,” and you’re just going to go about your day. That’s what these controls are designed to solve.

[David Spark] Steve, your thoughts about getting away from blaming the user? I mean, we all know plenty of security professionals that love to get together and talk about stupid users all day long. But every time I hear this, I just think it’s not their full-time job. I always think about my dad who was a doctor and thinking he really doesn’t need to know all this stuff. 

He needs to know how to be a good doctor, which he was. And so, getting away from that blaming, first of all, my dad had problems galore with patients not taking their medicine. Drove him crazy. It’s the same thing. He wouldn’t call them stupid patients.

[Steve Zalewski] Not to their face.

[Laughter]

[Steve Zalewski] So, I come back to the zero trust is a state of mind. Zero trust as an architecture, there’s maturity models. Fundamentally, we’re trying to protect people to a certain extent from themselves, and we’re trying to change behavior. And it’s very difficult to change human behavior. Just is. So, how do we live with that?

[David Spark] By the way, doctors know this as well.

[Steve Zalewski] Since you went there, we’re going, let’s use that analogy, right? Which was, so you hate to see a patient not take the medicine, understanding the consequences. But ultimately, is it the doctor’s job to make the patient take the medicine? Or is it the doctor’s job to make sure the patient understands the consequences that can be pretty severe of them not taking the medicine, and how much effort do we put into that? 

And there’s times when we can be incredibly aggressive to make sure they take the medicine because the consequences are so severe in certain cases. And I feel like security is that kind of a problem. So, why are we blaming the users? Because if we think we’re here to secure the company and make them do it our way, so we will not let them get sick, we will not let them get cavities, that’s great. But most of the time, the individuals are there to sell more jeans. 

So, we got to be more savvy about understanding what the role of cybersecurity is and finding that middle ground.

Closing

30:45.772

[David Spark] A very good place to close this discussion. This was a great, great discussion, and I’m just going to sum it up. It’s difficult as hell, and there’s so much involved. But thanks to our huge sponsor, ThreatLocker, which we love having here, they have an awesome solution to this. So, go check them out at threatlocker.com. All right. Now, I have a final question for you, Rob. And that is, your favorite quote from today’s conversation because pretty much they were all on the money here. Which one was your favorite and why?

[Rob Allen] I especially liked Steve’s flossing analogy. I’m sorry. No, I’m only joking. I’m only joking. No, I think it was Greg’s quote, which was it’s a strategic pillar for a security program, not a destination.

[David Spark] Steve, your favorite quote.

[Steve Zalewski] You know, I come back to state of mind. I have to, like Rob, go with Greg Notch, the CISO of Expel. It’s a strategic pillar for a security program, not a destination.

[Rob Allen] Great minds think alike, Steve.

[Steve Zalewski] That’s the first time I’ve ever been argued to have a great mind, okay?

[Rob Allen] [Laughter]

[Steve Zalewski] So, I just want you to know, I’ve never been claimed that before.

[David Spark] Thank you both, gentlemen. And again, thanks to ThreatLocker. Remember, they have a great solution for this. Check them out at threatlocker.com – Zero Trust Endpoint Protection Platform. Rob, I know you guys are always hiring. Go to threatlocker.com. By the way, in Orlando, Florida, because you have a staff there. So, if you’re in Orlando or want to go to Orlando and would like to work with ThreatLocker, go check out their Jobs page there as well. And I believe, though, you have events all over the country and all over the world, for that matter, correct?

[Rob Allen] Yes, about 900 a year, probably 1,000 this year, best guess. So, we’re everywhere.

[David Spark] In fact, you guys sponsored one of our San Diego cyber meetup groups.

[Rob Allen] Did we?

[David Spark] Here in San Diego. Yeah, it was fantastic.

[Rob Allen] Oh, fantastic. Well done us.

[David Spark] We loved having you…

[Crosstalk 00:32:45]

[David Spark] …sponsoring that. So, go to the Events page on ThreatLocker. You’re hearing this right after Black Hat. They were at Black Hat, but there are going to be tons, tons more. Go find out when they’re going to be in your community because they will be there eventually. Thank you very much to Rob. Thank you very much to Steve. And thank you to our audience. We greatly appreciate your contributions and for listening to Defense in Depth.

[Voiceover] We’ve reached the end of Defense in Depth. Make sure to subscribe so you don’t miss yet another hot topic in cybersecurity. This show thrives on your contributions. Please write a review, leave a comment on LinkedIn or on our site, CISOseries.com, where you’ll also see plenty of ways to participate, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David at CISOseries.com. Thank you for listening to Defense in Depth.