DH2i’s Don Boxley on Replacing VPNs with Software-Defined Perimeters

This is Techron tv. Hey guys, thanks for the throw. We're here with Don Boxley, who is CEO for DH two I, and we're talking about software defined perimeters and what's going on in the education sector, because, well, they're being targeted by attacks, and maybe we just got too much antiquated technology.

Hey, Don, how you doing? Welcome to show. Good.

Thanks, Mike. Um, glad to be on with you guys again. You know, it's not just education, but it seems to be a place where we see a lot of this kinda, uh, I don't know, I don't want to call it a crisis, but it's an issue.

Um, there's VPNs everywhere. We keep using these things, and, but we have shown that time and time again that they're easy to hack. They all have known vulnerabilities, and the bad guys seem to be just going to town on these things, these things.

So what is the issue about replacing VPNs with something that maybe is just fundamentally more secure? Yeah, I, I, you know, it's a, I mean, you raised a really good point. I, I, I think it, it gets down to, uh, uh, with a lot of new, new, new technologies, right?

It's just we really, we really understand VPNs yet for sure, they got vulnerabilities, but we've been dealing with A VPN for, you know, it seemed like forever, right? So the idea of actually taking that out and putting something else in, uh, it just creates a, I think a lot of anxieties for a lot of organizations. I think particularly for, uh, educational organizations, right?

It's, it's a, it's a step of faith that this new technology, in fact, we'll be able to deliver a better solution than what they currently have got. So it's easy for an organization. Again, I don't wanna pick on, uh, educational, uh, organizations because, you know, there are plenty of Fortune 100 corporations that have, have been, have suffered massive, you know, uh, security issues around their VPNs.

But it's just easy to kind of say, okay, just let's tighten up our processes. Let's make sure our passwords are better. Let's make sure this is better, and this will, you know, plug the hole, if you will.

And, and inevitably, right, there's another hole that, you know, in, in the dam that sprouts and, and so, uh, it's an, an, an ever ending problem, right? That, that customers, uh, that they put themselves in because they're unwilling to make that transition. Um, but I think with SDP, right, we know that it can solve the problem, right?

We know that it's, they're relatively easy to implement, um, and they absolutely eliminate this, this, uh, the ease with which bad guys or bad actors can attack, uh, companies, uh, network, uh, system, the, uh, you know, a remote user. I think you're spot on in the sense that there's this mental default to the VPN, and it's not clear to me that people really understand what an an SDP is. So, do you wanna take a crack at that?

Yeah, yeah. So, yeah, so SDP, if, if you liken it, so A-A-V-P-N, and we use this a lot. So imagine you've got a, a castle and, and, you know, with A VPN, it's just basically the drawbridge.

Once the drawbridge has been, you know, you, you say the, the magic words, the drawbridge, it goes down, you go into the castle, you can go anywhere in the castle, right? So A VPN basically gives you access to, uh, potentially anywhere within a company's, uh, computer environment. Obviously, sophisticated hackers, they know how to move from, you know, just the drawbridge, you know, the front entrance way into the armory or into the kitchen, or wherever else they wanna go into the treasury right place.

You absolutely don't want 'em to go, uh, with, with A SDP, it's a similar concept. Um, but what we do is we provide you just with, if you will, um, a guarded escort into a specific area inside, uh, the castle. And that with that guarded escort, you can't go anywhere else, right?

So you're limited to, you know, the armory, or you're limited to the kitchen, or you're limited to, you know, the, you know, stores area, but you, you can't go anywhere else. And so, at, at, that's at a high level, what, uh, the difference between A VPN and S-D-P-V-P-N, you, you know, once you're in, you can go anywhere. SDP, we actually limit you to a specific area.

So the only damage that you can do is to that specific area, right? So if you want to tear up the, the kitchen, yeah, you'll, you'll be able to do that, right? If you've got the right permissions, but that's the extent of the damage.

Well, the people who work in the kitchen might be upset, but the rest of the organization who will be somewhat isolated from this man. That's right. That's right.

That's right. Yeah. The mayhem is, is is isolated.

So, Mm-Hmm. Yeah. And, and so that makes, it makes it really convenient for organizations to kind of say, if you're an educational organization, for example, you've got lots of students needing to access lots of, of specific, uh, services, you can limit them to that specific service, right?

So there's no way that even if their password's compromised, that somebody else with a little more sophistication can go someplace else. They're, they're gonna only be able to use this particular program or this particular service. So, and, and assuming you've got reasonable, uh, security measures in place around that service, they're not gonna be able to do much, right?

It's gonna be kind of a boring thing, right? So, yeah, that, How much of this is a cost issue where, I mean, the educational environment are typically cost sensitive, but, um, is it expensive to rip and replace VPNs with SDPs and, you know, and how expensive relative to the amount of risk that you're creating? Yeah, I mean, I, I don't think it's, uh, I mean, mean, you know, we're looking at similar costs in terms of, you know, per user, you know, you're, you're looking at, you know, depending on the volume, right?

I could imagine like a, a large school district, maybe $5, $10 a month, uh, per student to have, you know, this kind of secure access. Um, so I, I, I don't, I, I think from a cost standpoint, I, I don't think that that's really the issue. I, I think it's just, again, you'd have to stage a transition, right?

So that, those non dollar costs, right? In terms of processes and people, new training, I think those things, right? That those are the, the bigger impediments for, for these organizations.

You know, I, I, I've been, right? You, you, we've all been there, right? Where, uh, an organization decided, okay, we're changing our remote access system, right?

And it's a lot of planning, a lot of careful planning goes into it, but it always, right. There's, there's a little bit of chaos associated with it, right? And, and so you gotta get through that.

And I, I think that the idea of doing that is, yeah, I, I think it scares a lot of organizations away, particularly when they all may have, you know, a very small staff, right? Who's, they've got a lot, a lot of other fires that they've gotta manage. So this is like, do we really wanna do this?

Right? Well, we've got these other things that we need to do, so Right. When you're balancing out the priorities.

So, yeah, I think it, it's gonna fall down. Yeah. I feel like the math on our assessment is kinda weak here though, because if I look at it, you know, we're counting on, in a lot of cases, students are at home, they've got consumer grade PCs, they've got consumer grade wireless networks, and then they've got VPNs what could possibly go wrong from a cybersecurity Perspective, a, a a lot.

Yeah, that's right. Yeah. Yeah.

And that, and that is, and that, and isn that it, right? I mean, that's the kind of thing, you know, you know, it's, it's kind of odd that way. Um, but we, you know, not every, no, not every school system is blessed with, you know, state of the art, uh, infrastructure, that's for sure.

Um, here in Fort Collins, um, you know, with PSD, it, yeah, we, we happen to, you know, be blessed with that, right? We've got really, really good infrastructure. Mm-Hmm.

Um, high speed internet. So a lot of things that, you know, that, that they can do that maybe other school districts can't do. But, but that being said, I, I still think that, um, a, a school district would do, its, do does itself a disservice by at least not bringing it in, right?

And just testing it. If it's just between the, the IT staff, you know, what is this thing? How could we use it?

Right? It, it, yeah. Nobody's saying, okay, let's just ripping it out, uh, tomorrow, right?

These things have to be carefully planned out, but the process needs to start sometime. So, you know, w with our solution that we sell, and others, you know, like Zscaler and others, Illumina, um, there are solutions out there that you can bring in, uh, you can test for, you know, basically no cost. The only, the only cost is the time that you spend into it, you know, testing it and, and try to figure out and map out a process for, okay, how would we make a transition?

You know, our organization, these other organizations, they have resources available to support those efforts, right? So it, it's, it's really, I think at this place, it's, it's the technology is mature, right? Governments are using it.

In fact, I was on a call with, you know, a, a a a potential user government user, and right, these things are being used. Um, so they're, they're mature technologies. It's just, just starting the process.

Do states, or maybe even the federal government have an incentive to kinda encourage school districts to implement an STP, because a lot of the time they're, well, their schools are considered critical infrastructure on certain level, but a lot of the time the cleanup activity is beyond the ability of the local IT department. So they're just gonna lean on somebody else for help anyway. So an answer prevention Y Yeah, absolutely.

Right? I mean, you, you know, and, and you know, the article that we, we recently published, you know, just kind of goes into that. I mean, it's just right there just so many regulations that, that schools are under in terms of, you know, the, the information that they've got, right?

Both on the, you know, student records, health healthcare records, right? These things, right? There's just a whole plethora, right?

Alphabet of, of regulations that they, they're under. Um, and the government's got money. I think that's, that's the other thing.

They've got their plenty of grants out there, uh, that, that school systems can take advantage of, right? To get, you know, 10, 15, $20,000 to start a pilot, right? We wanna improve, you know, our cybersecurity, you know, that that's gonna get a lot of, there's a lot of money out there.

There's, so there's ways to get started, right? Uh, at least a pilot get that covered by, you know, the government from a grant standpoint. And then, you know, once you proved it out, it's just like any other normal grant process.

Okay, we, we've worked it out, now we wanna roll it out, and that's gonna take us a, a couple million dollars. And so may have to craft, craft something that, that covers, uh, several different grants combined, right? To cover the cost.

But I think it's definitely in, in the incentive the government has got money out there because they understand that this is a real issue. They also understand that school systems don't have a lot of resources available themselves. So I think they're available to, right.

Providing resources to help. Yeah. One of the things I have seen over the years with children in multiple school systems is there's a feeling of reluctance to call for help.

Um, theoretically, at least every school district has people who have children in that school who are cybersecurity and networking experts, and yet, um, the school systems and the people who work there seem a little reluctant to, uh, reach out for help. Is that just a, a cultural issue, or is there something else that work there where the school system just feels weird asking for help? Yeah, you know, I, I, I mean, I, I, I think that, um, and I, I don't wanna right generalize, right?

I, I, I think I, I think it's just an education, right? That, you know, I think those staffs are overwhelmed with just keeping everything going that they've got. And so just, they don't have a lot of cycles to just do research, right?

You, you know, take a, a half hour once a week to just, to go do, I don't think they've got that time, right? So I, I think it's just an education. I, I think it, they had that time available that they could do these, you know, research, these new projects, new areas.

I, I think we'd see faster adoption, but I, I just don't think, you know, I just don't think the school systems have that, that luxury right? Looking forward. You cannot walk down the street without somebody leaping out to tell you about their great new AI thing.

Are we gonna apply AI to STP and what might that look like? Yeah. You know, I mean we've, we've, we've been kind of looking at that, right?

Um, I, I, I think that, uh, I don't, I don't think there's any question that AI is gonna have an impact on how we interact with systems remotely. Um, and, and so, but it's not clear to me yet, um, if organizations, I, I, you know, I mean, it's, again, it's, if you go back to the analogy that we, we talked about earlier in terms of the, the, the castle, you know, now, you know, I've got this AI thing that's with me and, and I'm giving it license, giving it agency to move me into the castle. Um, which from a end user going forward, that seems okay, but the owner of the castle now has to have a lot, a lot of confidence in what this AI is doing, right?

So, um, I, I think we can get there, right? You know, but I, I think it's, again, it's, it's gonna be the, the bleeding edge, who it's gonna be willing to, to let that happen. Because, you know, I just, again, it's, it's, it's like almost like, you know, we, we, we, we, we make a lot of bad actors and very sophisticated, you know, criminals who a lot of capability for penetrating systems, the idea of an ai, um, that's been compromised, that's even faster and more robust.

Yeah. I, you know, I, I just think that it's, it's gonna take a little while I I to mean, it's like, it's like, you know, cars that are self-driving, right? That, that, that, that's a, that's a huge problem, right?

I, I, all it takes is one mistake, right? In, in somebody's family is forever. Forever, right?

Changed in a way that can't be, it can't be fixed. So I think that, that, I just think that it's gonna take a little while longer. Yeah.

Alright folks, I heard it here. Well, look, when it comes to VPNs, if someone's telling you that you should remotely access something through A VPN, you might wanna remind them that, you know, the nineties are calling and they're looking for their software. But we'll see what goes on.

Hey, uh, thanks for being on the show. It's always good to be with you, Mike. It's always good to be with you.

All right. And back to you guys in the studio.