A Journey To Zero Trust

The speakers from Copart, a company with about 8,000 employees across 12 countries, start by noting that zero trust means different things to different organizations, so they first defined it for their own environment. Their baseline required corporate workstations to present a certificate with multi-factor authentication and pass a device health check covering antivirus, network security and encryption before reaching email and internal apps. They sorted their use cases into user-to-cloud, user-to-on-premises and machine-to-machine access.

They compared three product categories: network-based gateways that deploy quickly but handle device health poorly, endpoint gateways resembling a VPN that raise privacy and battery concerns, and agent-based designs that verify certificates and health at the application layer. They chose the agent approach because it fit their existing management tooling and allowed flexible health policies across Windows, macOS, Android and personal devices.

Their main lessons were to secure leadership buy-in, be transparent with legal and HR about the data being tracked, and enroll willing employees before skeptics. Enrollment initially took 12 to 15 steps and drove many support calls, so the team worked with product engineers to make workstation enrollment zero-touch, tied to the identity provider login, and cut mobile enrollment to two or three steps. The talk closed with plans to extend coverage to remote engineer access and machine-to-machine traffic.