Invited

The talk, given by a security consultant from an Austin firm, argues that zero trust principles can shrink the exposure of internal web applications and lower ransomware risk. The speaker traces zero trust from its 2010 origins through NIST SP 800-207 and the CISA maturity model, outlining its five pillars (identity, devices, network, applications and workloads, and data) and the staged progression from traditional to optimal. He stresses that adoption is incremental, that organizations should start with an assessment and quick wins, and that vendor choice depends on the organization.

The middle of the talk is a walkthrough of a cloud-delivered zero trust service. Browser-based access to internal tools is placed behind single sign-on with MFA, and a small outbound tunnel on an internal machine exposes resources without opening inbound firewall ports. Temporary access for third parties can be approved through a one-time request, and the demo included browser-based SSH and an attempt at reaching a scanner, although one live session did not respond.

The closing section covers developer access, where DNS filtering, HTTP inspection, malware scanning and device posture checks are used to control risky browsing on corporate laptops. The main takeaway is to remove unnecessary public exposure of RDP, management interfaces and legacy VPN entry points, and to map the effort to existing compliance requirements.