Implementing Zero-Trust Cybersecurity – Ryo Koyama, Remote.It

This is Textron TV. Hey guys. Thanks for the throne.

We're here with Rio. Koyama who CEO for remote it and we're talking about how to get to zero trust it in a way. That's simple.

In fact, it may only involve one line of code real welcome the show. Hey, thanks a lot like glad to be here. So let's jump into how exactly can we get to zero trust because everybody hasn't in their head.

This is a complex multi-layered Endeavor and you're talking about a single line of code. So as the man said explain yourself Yeah. Well, I mean one of the things that's interesting is that you know tcp/ip is obviously the the inner, you know protocols that power the internet and back in the day my co-founders and I did the first silicon tcpip stack so we might not be the smartest guys in the world, but we're pretty smart about about the protocols themselves and one of the challenges that I think zero trust faces is that everything around the internet has been built around the public internet and it really just assumes the level of trust and so, you know, all IP addresses are exposed if you communicate to an endpoint on TCB IP throughout publicly visible endpoint if you ask it to say hello, it'll say hello back, but the protocols themselves don't have to work that way.

And so if you look at the whole zero trust or even the security industry It security is really sort of prevention and detection and so much of the industry has shifted towards detection because so much of it about about security is about public endpoints or scannable endpoints. What we do is with the line of code. We allow you to do the tcp/ip stack in a way.

That's much more secure. Maybe a simple way to say it is Mike kononna tcp/ip Stack anywhere and as long as it's on the internet you can connect to it but only you or whoever you've given permission to can to connect to it and you don't ever have to manually manage IP addresses or subnet addresses. It'll just be yours and you're able to connect to it and maybe a simple way to think about it is because the tcp/ip day allows you to do inside out connections as well as outside in connections.

And so that's what we sort of enable and we think that's really the best way of doing zero trust because you're never exposed anywhere. Who writes that single line a code and where and how does it get installed? So what we've done is we've invented a little piece of code that we call networking as a service and so it's a little Dame in the attaches to the ccp/ip stack.

And so what our single line of code does is it says oh register this to this person and as long as they're authenticated and that authentication could be like OCTA or you know, g-stack or whatever you're using for your authentication as long as this person comes they're able to connect to that. Now, what's interesting about how that configuration works is that in the world today, we think about applications and so, you know with with things like containers the world is really gotten virtualized and so it's not even about you know servers or metal devices anymore. It's about SSH running or a sequel running or a web server running.

And so what we allow you to do is essentially have that level of granularity. So if you've got a web server running or if you've got an admin screen running somewhere you can register that. You as a user can just simply You Know download a register the devices and then it gets registered in and then you can connect to that.

So if you're you know, just a the devops or a developer admin think of it this way today with things like kubernetes or Docker containers, you can deploy thousands of service endpoints, you know in minutes, but then the interesting thing is you have to manually decide who has access to that what kind of security you want to have underneath that and you might have to do something really as pedantic as managing all this addresses. And so we really think that because the protocols themselves are software. Why not make it programmatically solvable.

And so that's what our solution let you do. The network is a service. Is this something that I install as a service?

If I'm an organization or Are you delivering that to me as a cloud service to connect all these things together? So think about us as a registry. So we register people and endpoints and then you decide how those things all tie together.

So like I talked about before if you think about a network today or at least in the Legacy terms. Usually it's some sort of Ip range. So for example, if you're on a local area network or a home network or an office Network, usually that's like a 10 dot address or a 192 type of dress and then you have to decide who can see what and then how do you make configure all of that?

The way that we do it because it's all software. You can say. Oh, I have a number of SQL instances out there like a staging sequence sense or a production sequence and then you can say oh all the developers I have can have access to that.

But I don't want them to have SSH access to those instances themselves. And so all the devops advents could have separate control of all those things and so we do again as we allow you to register people and endpoints and then what we do is we allow you to essentially create a network of people and endpoints and then you can decide how those get connected to how those get managed. So things like managing IP restriction or worrying about somebody scanning ports is no longer concerned just because it's literally not available.

Right, and so the people side of that equation, what is what gives me the identity and that's the zero trust because I'm tying the access to the services to their identity. Yeah, that's right. So that piece of it is, you know, the identity it's zero trust because you know who it is.

So it's a permissive sort of connection. The interesting thing though is on the flip side. So let's say you have a local area network today typically most ports are available.

Right? So let's say you had something as simple as like a little Raspberry Pi type of device. Let me get this usually, you know, you might have something like SSH running on that and the configuration underneath it.

0 and what that means is run SSH on any IP address that I get assigned. What our technology allows you to do is so there's really three type of IP addresses. There's a public IP address, right?

So it's the thing that's any anything available on the global public internet. Then there are the subnet addresses which again things that are local maybe a local area network, but every tcp/ip stack supports something called The Local Host address and so special in the sense that it starts with a 127 and what it does is it's not routable. And so what that means is you can't get to it.

So like if you type in 127 it's gonna go to your machine. But what we do is we allow Mike to use that 127 address range. So on your local machine, maybe you have 127001 colon 33,000 and that goes to your WordPress instance hosted at AWS and maybe 33,000 and one goes to a sequence at AWS 33,000 and three goes to you know machine learning and gcp or something like that on the other end.

On the computer end which are able to do is say only make this service available to 127 and that means so one of the big hacking vulnerabilities right now is somebody breaches your local area network, then you can immediately do what's called a port scan and see what's available in that Network and then you look for vulnerabilities the interesting thing about taking it this approach with the tcp/ip stack. And tying things to localhost is that it's invisible to a port scan. And so if you think about most of the zero trust type of recommendations that are out there, they don't really talk about the endpoint vulnerability.

But this is a way that you can solve that where you no longer have sorts of visible even to a network scan and that's something that we don't think it's addressed enough and that's something that we think we have a unique solution that lets you not worry about that either. Do you think as we go along the zero trust that the whole motion around networking and security is just going to converge more aggressively because it seems like we always go down this path where security is an overlay and in your instance, it feels more and more like maybe we can just address this at the network layer. I think you have to I mean, you know, what's interesting is that you know, we have what do they say the danger of histories?

If you don't learn from it, right? I mean, you know, I remember the days when I used to be excited when my phone rang, right, but that's no longer the case because it's so easy to spoof almost every phone number out there and I just picked up mail for my mailbox and most of it was just bulk messaging right and because those are a publicly accessible endpoints the internet has been built around that way and it's interesting because cloud computing has been built around The fast explosive growth of public internet, but now what we're talking about is private stuff on the internet. And so I really think you have to solve it at the networking layer what's even crazier right now is if you look at the internet today The internet runs on bgp, right which is underlying protocol that decides where all the packets go, right?

And so I think he was last summer somebody misconfigured a bgp server and Africa and for some reason all of Google's traffic routed through trying to for eight hours, right? And so the interesting thing is we start talking to more Enterprise customers is you know, you hear things like data sovereignty or I want my data to remain in country. The problem is if you actually go on the public internet, you have no control for all of that.

But if all of a sudden exactly to your point want to solve all this is the network there. It's very very solvable because you can say hey, I don't ever want my day to lead in AWS, right? And so what's interesting today is like I can connect to Japan but connecting directly to an endpoint Japan across the internet.

Even though it's peer-to-peer might not be the fastest because if I onboard most of the traffic to the closest endpoint AWS that backhaul is probably faster. And so I really believe that you're going to see more and more a transition towards solving it at the network layer because I think the best security starts with networking right and until you Are prepared to address that that layer you're gonna run into all kinds of stuff. It's just more and more difficult because like said, I've got a public phone number and it's not very useful today and it's shocking how quickly that happened.

And you know, I I think using public IP addresses or even you know, subnet addresses that are scannable and not deterministic. I think it's a bit of fool's gold. And so I think you're gonna have to solve it.

Now. The good news is you know back in 1969 or whenever the tcpip was invented. There's plenty of Plumbing that's already designed there to make it extraordinary secure.

Right? I mean the way we like to joke about it is a public internet connection is a hallway a door and a door lock and the great news about a lock is that there's a lot but the man is about it is there's a key, right? And so with things like, you know, gpus and everything that's eminently solvable.

If you want to use tcp/ip in the most secure way well now you have a room with no windows or doors. And so now you don't have to worry about that vulnerability and most crimes are really crimes have opportunity. Right?

And so somebody can scan your IP address. They're going there first. They can't scan your IP address.

They're they're not going to go to you first because it's gonna be a more difficult thing to be able to breach. All right. So we're looking into the new year here.

What's your predictions? What's your crystal ball telling you about all this? When's it all Gonna Come Together?

later Actually, we're into an interesting economic period of time where you know, everybody's gonna be a little bit more mindful about where they spend money and solving things that the networking layer does give you a much more, you know Fortress type of opportunity, whereas, you know, it's great. If you can tell me every like if you use a public IP, we run honey, Bots all the time as experiments. If you have a public IP address at AWS, it gets Sports scan about 50,000 times a day, right?

That's pretty hard. And and I know I could go out and buy lots of tools that tell me who's trying to detect it do all those things. but going back to things that maybe many of your readers won't even understand I'd like an unlisted phone number and so, you know, I think that might be the the way to approach sort of these things and I think people are going to realize that that's that's just the most effective way to go because You know, I think there's a what a million companies that use AWS I would imagine that all but very few of them have huge devops teams that can deal with all the stuff and and I think what people are gonna need is they're gonna need to know that those endpoints are just protected right and you know again, it's just like a telephone number today.

It's it's almost impossible for us to protect it because you know, As great as things like AI are today they help the bad guys. Just as good as a good guys. All right folks here in here.

Just a little ounce of prevention at the protocol level main deed prevent a pound of cure Rio. Thanks being on the show. Thank you Mike.

Thanks for having me. All right back to you guys in the studio.