Cyber Resilience at Machine Speed: Author John Kindervag and contributor Dr. Chase Cunningham.

Maria Varmazis: Hello, and welcome to this CyberWire special edition. In today's episode, host Dave Bittner is speaking with author John Kindervag and contributor Dr. Chase Cunningham about their new book, "Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era." Here's their conversation.

Dave Bittner: So today, we're talking about the new book. This is "Cyber Resilience at Machine Speed." John, I'd love to start with you. My understanding is this book was your brainchild. What prompted you to take on this topic? 

John Kindervag: Well, I mean, there was a lot of people asking me to take on the topic, zero trust in the AI world, because there's always a lot of people who are kind of naysayers and say zero trust won't work for this, zero trust won't work for this and that. And so I already knew that it was working for AI, but what I didn't want to do is be the sole author of it. So someone who was very wise told me years ago, "There are no great books, only great chapters." And so, I reached out to 13 people that I really admire in this industry, including Dr. Chase Cunningham, and asked them to contribute a chapter. And I think we got a great book out of that, because I would've maybe written a great chapter, but we got a great book. 

Dave Bittner: Chase, what made you decide that this is a project that you wanted to sign onto?

Chase Cunningham: Well, I mean, to be perfectly frank, if John says, "Hey, Chase, there's a building on fire, you should run in there," like, I'll do it, because that's just how it works. I mean, I've been working with John for so long, and he's been such a great mentor. But as far as the book goes, like, I genuinely enjoy writing. The topic area was really interesting to me. And, you know, I agree with John. I personally think that this is actually the greatest time in history for CT because machines and all these AI agents, they don't have an HR department, and they're not going to complain about us telling them we don't trust them. So it really just lined up well. And John was kind enough to just kind of say, "Look, here's the, you know, broad scope, what I'd like you to write about and go." And, you know, I love writing, so when you turn me loose, I get after it. 

Dave Bittner: Well, John, what was your organizing principle here? How did you divvy out the assignments to your co-collaborators? 

John Kindervag: Well, there's a five-step model for deploying zero trust. First, you define the protect surface, then you map the transaction flows. After that, you architect the network, the environment, decide what products need to go in, essentially. Step four is policy. So you instantiate the policy in the products. And step five is monitor and maintain. So I just laid out the book in those five steps, and then I looked at who amongst the people that I think are really good at ZT could really contribute to that. And Chase had already written a book on policy and graph databases and how, you know, attackers think in graphs, but defenders think in lists. And I wanted him to, you know, just hone in on that for that one chapter. So he's part of that part of the book. And so I just went to different people who had expertise in different areas to write the chapters based upon the five-step model. 

Dave Bittner: Well, Chase, let's dig into your specific chapter. Can you walk us through the topic that you covered? 

Chase Cunningham: Yeah, I mean, John's point on graph database and sort of the adversarial mindset, I think, is what's missing in a lot of people's approach, so the problem is, interestingly enough, when we think about security, we're all usually thinking from a posture of defense and nothing bad ever happening and not allowing X to occur. And in truth, that's not going to -- that's not the way things work. You're always going to be in a position where you have to be able to respond, and you have to understand how the adversaries are approaching things from their end because that's where you -- you know, in the military, we have a phrase, "We meet the enemy at the door," and that's what you're trying to do. And so, my contribution here was really to look at how would that be applicable in this particular context, especially in kind of the new era that we're falling into. And then do those legacy approaches around visualization and understanding and context apply? And absolutely they do. So that was kind of the overall impetus for that. And then, you know, getting the reader to understand the fundamentals of all the things we've talked about, strategy still matters. It's just now you have a scope and speed that is beyond human speed. 

Dave Bittner: You mentioned lists and graphs. Can you unpack that a bit for us? 

Chase Cunningham: Sure. So if you look at, you know, SIEM and some of the legacy technologies and those types of things, what they usually show you is a big, like, glorified spreadsheet of a bunch of things doing a bunch of stuff, and it's a bunch of blinky lights, and you kind of hope that you can understand what's going on there. Whereas, from the perspective of what is actually valuable -- and I've been a red teamer. I've been, I guess you could say, a pseudo bad guy -- your goal as that person, that entity, is to be more contextual, to understand the intricacies of what is being missed, and then to know where the pivot points are. And you don't get that from looking at a spreadsheet. You don't get that from looking at a bunch of alerts on a screen. You have to understand, with total context, where you go, what you do, what areas to avoid. And this, in the militaristic approach, also leans more towards understanding the battlespace. And John had a bunch of other contributors in there as well. So it all really lines up on getting people to keep their head in the game around what works and what is just kind of security theater. 

Dave Bittner: You know, John, one of the key elements of the book is this notion of cyber resilience. I've noticed personally in the past three months or so that cyber resilience has become a hot topic. People are reaching out to us, and it's something that they really want to talk about. How do you define it, and why do you think it's become such a -- it's come to the fore in the way that it has? 

John Kindervag: Well, because, you know, as Chase says, we assume that an organization probably has been breached. They've got, you know, malicious actors inside the organization. That's dwell time. They're sitting there learning everything that they can do, and they're deciding what they're going to attack, right? And so, what resilience is is the ability to withstand an attack and revert back to a good state, you know, and not completely go down. And so, I even talk a little bit about going beyond resilience into antifragility, because one of the things that zero trust can do is make the environment stronger and stronger over time when there's a lot of load. And so, resilience, you know, and robustness is another thing people talk about. But what it means is that our environments won't just fall over when there's an attack. And too many environments completely fall over when there's an attack. And we've seen that over and over again. I mean, you think about Target, you think about TJ Maxx or TJX. You think about so many things. You think about Jaguar Land Rover. I mean, they couldn't make a car for -- I don't remember how long, but it was weeks. And so they completely fell over because they weren't resilient environments. And they allowed the attackers to go on a wild shooting spree, right? And I have a saying that all bad things happen inside of an allow rule. And this gets back to what Chase was talking about in the list, because in traditional security technology, there's a list of policies. And generally, the first policy that meets the criteria of the traffic gets instantiated. That may not be the best policy, right? But it's the first one in that list. And so if somebody puts a policy in a firewall, for example, an any-any allow rule, and this is -- I've seen this more than once in my career. They put it as the first rule because that's -- they put it in to just get it up and running, and then they never took it out. And so they have a very expensive box called a firewall that's doing absolutely nothing. You might as well just have the two jacks connected with a coupler for all the security you're getting. And that's because people don't understand policy. So we're so focused on products that we don't focus on policy. And policy that comes from a graph perspective is better policy than policy that comes from a list perspective. 

Dave Bittner: Well, John, help me understand the relationship between cyber resilience and zero trust. Is it a parallel relationship? Is there intersection there? How do you combine or have the two work to their best effect? 

John Kindervag: So cyber resilience is an outcome, and zero trust is a way of achieving that outcome. You know, I had dinner last night with one of the other contributors of the book, actually a friend of Chase's as well, Lieuwe Jan Koning. And he has this concept that zero trust is a verb. You do it, right? And so as you're doing it, the process of doing it makes the environment more resilient, more antifragile, more stable because there's less opportunity for attackers to ride, you know, open, flat, unrestricted networks and get access to sensitive data and assets. 

Dave Bittner: Chase, did you mention that you had some experience as a penetration tester? 

Chase Cunningham: Yeah, I was a red teamer for the government, and then I was on the National Cyber Collegiate Defense Competition a few times. And on my, you know, individual career, I did a bunch of red teaming and, you know, so acted as a bad guy, which is probably more of a comment on my own personality than anything else. 

Dave Bittner: I'm curious. From that experience, were there times where you were called to question the traditional perimeter model, the days before the popularity of zero trust? 

Chase Cunningham: Yeah, I mean, when I came over to Forrester and John, you know, kind of told me I was going to follow up in his footsteps, it was interesting because immediately I was like, "I don't want to carry someone else's laundry." But when I started looking at what the concept was and the approach as a red teamer, I looked at it, and I was like, yeah, he was dead on point. Like, this is the stuff that would make me miserable. Like, I would quit what I was doing if the red teaming was still a thing and I was working on infrastructure built that way. So that was kind of the light bulb moment for me that, you know, strategy matters every day and twice on Sunday. And then the reality of the space is it's meeting the adversary where the adversary is going to try and, you know, maneuver. And as long as you can do that, you stay with them. Now, today it's moving at light speed, but, you know, the bad guys don't own the patent on light speed. We can operate at that speed, too. 

John Kindervag: And I think that's a real important point because we're at an inflection point in history because of AI, the post-mythos world, whatever you want to call it, where we're not going to be able to take our time and manually make changes, do long change control meetings, and all that kind of stuff. We're going to have to enable technology to take action at the same speed as the attack. And that's what happens in kinetic warfare. Chase is a veteran. He's done some stuff, as they say, been involved in some shenanigans. 

Chase Cunningham: Some things, yeah, shenanigans. Yeah. 

John Kindervag: Shenanigans. And when you're -- when the enemy is firing on you, you don't, you know, call back to base and say, "Hey, let's have a three-hour meeting to see whether we should shoot back or not," right? And so, what we do in cybersecurity, and I've often used the example of an airbag. What if you tried to deploy an airbag the same way we do change control, right? You couldn't do it, right? You'd be dead. The whole purpose is automation. And so the airbag goes off as soon as the sensor sees the problem, and it protects you. And yeah, every once in a while, maybe in history, we've had a few airbags that just went off on their own, but it's much better to have an airbag than not to have an airbag. I think we all can agree on that. Well, we can work at that same speed in cybersecurity now because AI is a tool that defenders can use as well as attackers. And I think a lot of people aren't recognizing this. And I think this is the key, that you can use AI to say that's a real attack against real systems that are critical. So we're going to stop it right now by changing the policy and putting a deny rule in place and not allowing that traffic to get access to that dataset or those assets. 

Dave Bittner: John, do you suppose that AI actually changes the fundamental security problem, or is this more a matter of the timeline being compressed? 

John Kindervag: Yeah, it doesn't change the security problem. You know, as I did a -- we did a podcast with Rich Mogull of the Cloud Security Alliance who wrote a great -- well, several great white papers on AI. But one of his takeaways was, "Zero trust or zero days, your choice." And his point was, it's not magical. It's fast, right? And it's at massive scale. So, you know, you could spin up a bunch of bots and just hammer at things. I'm actually surprised, and I haven't heard of any, but maybe you have, Chase, that we haven't seen attackers just do DDoS swarms with agents or something. But I haven't heard of any. But that came to my mind as if I wanted to bring somebody down, I'd do a DDoS swarm, kind of like the Mirai botnet attack, but I would just use individual agents to overwhelm someone's capacity to keep their network up and live. 

Chase Cunningham: Yeah, I mean, it is kind of interesting to say that there hasn't been, you know, a whole giant renewal of DDoS as the new sort of method of attack, but that also makes my spidey sense tingle a little bit because then I'm thinking of, "Well, if they're not DDoSing us with all these agents, what the heck are they doing with it? And when is that going to go down?" 

John Kindervag: Right. And it makes ransomware faster. I mean -- 

Chase Cunningham: Yeah, I mean, everybody's a developer now. 

John Kindervag: Right. These things are so fast that there's no way a human being can get involved in the pathway and stop it before damage is done. I mean, you know, think about how fast a bullet flies, right? Nobody but Neo dodges bullets. 

Dave Bittner: Well, so, John, how do we deal with this fundamental asymmetry here? I mean, the AI attackers can function at machine speed, but the defenders, they've got more steps along the way. I know you refer to -- I think you call it organizational latency. 

John Kindervag: Yeah. So the one advantage that we have in cyber warfare versus kinetic warfare, in the kinetic warfare, you have to worry about the air, you know, attacks coming from the air, from under the sea, you know, from over mountains and cliffs. In cyber warfare, the attackers are still limited by the guardrails placed on them by the protocols that transmit packets around the internet and around networks. And that's typically TCP/IP, right? Not exclusively, but typically. And so because of that, you know, they can't create something that hides under the water. There's no -- under the -- under the water, you can -- everything can be visible because the protocol is designed to be visible. And so we can leverage the protocols themselves to control what the attacker can do, because as soon as they get on our network and they get on on a wire or on a fiber optic cable, they're starting to get on it in a choke point, and we can start to choke that down. And so if we have the right policy, then we can control their access to resources. So in this world, where everybody's worried about, oh, there's all these new zero-day attacks, and there's all these new zero-day vulnerabilities, what they forget is there's no reason that those two things have to talk to each other. There's still controls that we can place in the middle of that pathway that stops the ability of the attacker with the new zero-day attack to get access to the vulnerable system with the new zero-day vulnerability. There's no reason for that to happen. And so this means you have to be much more thoughtful in your policy creation because there should be no policy in any organization that allows an unknown resource on the public internet to get access all the way through to, say, your credit card database or your financials or power plant, your PLC that drives the power plant. Those rules should not be in place. But unfortunately, through the history of cybersecurity and before that, information security, we just opened everything up and said, "Let everybody come in. Yeah. Because everybody is a good guy." And we found out that people aren't so good. 

Dave Bittner: Chase, is this a fundamental shift in mindset here? You know, designing security around the assumption that compromise is going to happen rather than treating every compromise as a failure of the security program? 

Chase Cunningham: I mean, none of this stuff happens in a silo, and that's what's weird, is, you know, we've built organizational silos that cause a lot of the problems that we face, but it's not happening inside of those silos. It's happening across platform, across infrastructure, across business, across geographies even. And people have to think about these problems from a different perspective. And it's no longer just a, "Hey, the nerds will figure this out, and eventually, they'll nerd their way to stopping bad things from happening," because that's not the case. The reality of it is, especially in today's world, everything everywhere is potentially an avenue of compromise. And if you're not thinking about, "How would I deal with it when things do go wrong?" you're not going to be ready when things do go wrong. You know, to throw one more military adage in there is no plan survives first contact with the enemy. And I mean, that's really what we're dealing with. 

Dave Bittner: I'm curious, John, what are some of the common misconceptions that you run into when organizations say they're implementing zero trust? 

John Kindervag: Well, a lot of them haven't understood some of the fundamentals of zero trust, and so they don't know what they're trying to protect. That's the first thing, right? So that's why we stay in the five-step model to find your protect surface. What are you going to protect? This is the inversion of the attack surface, right? The late, great Charlie Munger, Warren Buffett's partner, said, you know, when you're looking at a problem, invert, invert, invert. And so this is the inversion of the attack surface because you can't control the whole attack surface, but you can control certain things. You can control your credit card database. You can control your SWIFT system or your ATM network if you're in a bank. You can control your DNS server, which, if that goes down, you're toast. And so you can control certain things. So figure out what you need to control. And so too often, people just acquire a product and then they don't know what they're going to do with it. Secondly, people try to do zero trust all at once for the whole company, and it never works. You have to do it in small bite-sized chunks, right? However you eat the elephant or the whale is the same way you do zero trust. And that's why we start with one protect surface, and then do another, and then do another. And in this way, zero trust becomes three things that are really important. It becomes incremental. We're doing it one at a time. It becomes iterative. We're doing it one after another. And it becomes non-disruptive. The most you can screw up is one protect surface at any given time, and then you can revert that back. So you don't have to be afraid of it. A lot of people are afraid of it. And as one customer of mine said, we argued about zero trust longer than it took to build the first zero trust environment in our organization. 

Dave Bittner: Well, suppose an organization accepts your argument, but they're sitting on top of that large legacy environment. They can't rebuild everything around zero trust tomorrow. What are your words of wisdom for how they should begin? 

John Kindervag: Well, I mean, there's a whole thing I call the learning curve, where you start with something that's very small and it doesn't have very much value. And you learn to build zero trust. You learn to just live the five-step model. And then you eventually go up to those things, those keys to the kingdom, the crown jewels, high-value assets, whatever you call them. I used to believe we started there. And then the more I worked with customers, I found out that there was nobody in that company who was around when that system was built, and nobody knew how it worked. And that's why I put in as step two later on mapping the transaction flows, because until I could see how the system worked together, there was no way. I mean, I needed a map, right? And as Chase knows, in the military, you know, you're always looking at a map. And a map tells you where you are. It tells you where the bad guys are. If you don't have a map, you're going to be wrong and lost, and they both suck. But if you have a map, you might be wrong, but you won't be lost because you'll know where you need to go. 

Dave Bittner: Chase, suppose I'm a CISO, and I'm trying to translate this into a board-level conversation. How do I explain to them what success should look like? 

Chase Cunningham: Well, I would say flat out that -- you know, remind them that, like, look, this is the most, let's call it, unfair position to ever declare success in because success means nothing happened. And of course, no one likes that because it's like, "Well, that doesn't really show me a return." But the return is we're still up and running, and nothing's gone wrong. And then the follow-on to that is to really make people understand, like, look, you guys go to organizations and you -- if I'm in your org and you tell me that -- I've heard that phrase a million times -- "Everyone's in sales." Well, guess what? Everyone's also in security. Does that mean that you have to enable security controls and that you're doing configuration on endpoints, whatever? No. But it means that you understand that the things we're doing are valuable in the context of keeping the business secure. And that's something that we need to get across to more people and make sure that they understand it. Because the moment that this goes away from being a business enabler and an outcome that benefits everybody and becomes more security tech and more, "Oh, gosh, I got to figure out how this stuff actually works," it gets -- it just gets bogged down, and no one cares. You know, security is for security people, and no one wants to do it but us. But we've got to work harder to make sure that we translate this stuff in business context and along the lines that they actually care about. 

Dave Bittner: John, can you give us some highlights of some of the other chapters and some of the contributors that you brought in here? 

John Kindervag: Oh, yeah. So, well, as I already said, Rich Mogull is doing a chapter, "Zero Trust or Zero Days, Your Choice." So he's given a high-level view of the whole project. And so -- and, of course, our CEO, Andrew Rubin of Illumio, is talking about how we have to get past the prevention-only mindset. And then we've got Don Yeske, who's the former zero-trust lead at both the Navy and Department of Homeland Security, explaining what a protect surface is. He actually wrote his master's thesis on protect surfaces. And then Clint Bruce, a very well-known Navy SEAL. He's a good friend of Chase. That's how I met him. Writes about my favorite weapon is a map, and why you need to have visibility. And then we've got a lot of other people. I've written a couple chapters. Josh Woodruff and his wife, Michelle Savage, have written a chapter on controls that every AI agent need. They actually wrote a book called "Genetic AI + Zero Trust," and I wrote the foreword to it. So lots of great people. George Finney writes about policy. He wrote "Project Zero Trust," and he also wrote "Rise of the Machines: A Project Zero Trust Story." Chase, of course, is talking about creating policy. And then our chief product officer, Mario Espinoza, is writing about AI and why it's essential for zero trust. And then, you know, we've got Tony Scott, the former CIO of the US federal government, talking about, you know, kind of the business perspective of it. So 14 different authors in this book, great team to work with at Illumio, and a great team with all these contributors really came through, and very, very excited to see this come out. 

Maria Varmazis: Thanks for joining us. We'll see you next time.