RSA Conference 2024 | Anubhav Arora | Cradlepoint

Clips
News
More from RSA Conference 2024

Anubhav Arora

VP of Security Engineering

Cradlepoint

Cradlepoint’s insights: Safeguarding 5G networks with zero trust measures

With the introduction of 5G transforming telecommunications, the wireless WAN network needs to be properly maintained to evolve in both efficiency and security. As 5G brings in more bandwidth and unlimited data plans, it’s adding more devices and use cases, enabling easier remote work, while also ushering in new security challenges simultaneously. Safeguarding 5G networks calls for a a marriage of different measures and methods and Cradlepoint Inc. is helping achieve this.Cradlepoint’s Anubhav Arora talks with theCUBE about safeguarding 5g networks

play_circle_outline Evolution of technology to support 5G and increased adoption.

play_circle_outline Addressing the Increasing Challenges of Securing 5G Environments with Zero Trust: Eliminating Attack Surfaces

play_circle_outline Importance of SASE vendors building networks with Zero Trust principles.

play_circle_outline The need for quality of experience and application-centric SD-WAN in 5G.

play_circle_outline Enhancing Business-Critical Applications: The Role of Secure Optimized 5G Networks and Zero Trust Architecture

Info

Anubhav Arora | Cradlepoint

Anubhav Arora

VP of Security Engineering Cradlepoint

search

>> Hello, and welcome back to theCUBE's live coverage here at RSA. We are in beautiful, sunny, downtown San Francisco, and I am here today with Anubhav Arora, the Vice President of Security Engineering at Cradlepoint. Welcome, I'm so glad to have you.

Anubhav Arora

>> Thank you. Very glad to be here.

>> Absolutely. Well, we were just sitting here talking about how the job that we have when we show up at industry trade shows, especially one as big as this one, is actually a really big job.

Anubhav Arora

>> Yes.

>> But the cool thing I think is that we get facetime with our customers, with our partners, with our analyst friends. It really is, I think, an important-

Anubhav Arora

>> It's an important step in our journeys towards making the world secure.

>> Absolutely. Absolutely. So we are going to talk today about 5G, and we're going to talk about the increased adoption of 5G as a wireless WAN technology. It changes what we know about traditional networking, but it brings in increased risks, all different kinds of things. And so what has to happen, of course, is that technology has to evolve to support these changes, right?

Anubhav Arora

>> Yes.

>> And so is Zero Trust the answer? Yes. Is SASE the answer? Yes. But today, I want to talk a little bit about secure 5G environments, and kind of your thinking in terms... You're the VP of Security and Engineering, right? So I think you have some thoughts on this topic. So I'd love to talk some more about just what organizations need to be thinking about when they're approaching this.

Anubhav Arora

>> Yep. It's a very fine point. And 5G cellular in particular, and 5G bringing us more bandwidth, unlimited data plans, what is it really doing to our networks? It's allowing us to add more use cases. It's allowing us to add remote sites, remote workers, remote IoT devices. It's allowing us to expand the networks at a rapid pace, at a pace that the Agile enterprises actually want to do that. It brings the challenges of security, because devices themselves that we place on the network can be a security risk. And the more devices we put on our networks, the more manufacturers, the more vendors, the more patching systems we are putting on our networks. So how do you actually create a network that automatically takes care of most of those risks, in a manner that access to these devices, access from these devices, communication patterns that are restricted, or understood to be threatening, are not allowed? Those are the challenges that we face when we actually go into the 5G world and cellular world, enabling these use cases and the security that comes with it. So this enterprise's security is the backbone of their network. Security is the first conversation. Security is the most paramount part of a network design. Is Zero trust the answer? Absolutely. Zero Trust is the answer, why? Implemented correctly, Zero Trust actually starts to take away all of these threat attack surfaces. How do you actually get these attacks in? How does an attacker get in? It's because we have an attack surface. Attack surface means places where an attacker might get a foothold, and then hop to another part of the network, hop to another part of the network. So there is an attack surface on the external side on how to get in. There is an attack surface on the internal side, how to hop to another part of the network, another resource, another database, or another part of the network where you can get access to more data. All of that is eliminated almost completely by a zero trust network. And that depends on the design with Zero Trust principles. So as we put more devices with 5G on the networks, it's paramount that the security is considered first, and Zero Trust is the architecture of choice to design the network with. SASE, while we use SASE and Zero Trust in the same breath, in the same sentence most of the time, they're slightly different. One is in architecture, the other is a product category. But a lot of SASE vendors do take pride in constructing their solutions with Zero Trust. And so do we. At CradlePoint, we construct our NetCloud SASE solution completely from Zero Trust principles ground up. But that's not necessarily the case for every network or every vendor. So as people are thinking about constructing their networks, constructing their SASE, choosing their SASE vendors, putting their basic tenets into place, who can access what? What kind of policies? What kind of openings we have allowing in our network? It's important to understand both, Zero Trust and how SASE vendors are building their networks with Zero Trust.

>> Yeah, that makes a lot of sense. So I think that a lot of times when we talk about 5G, and we talk about devices, the reality of it is, this ecosystem is so big, and it's expanding at such a rapid pace. And I think that the ordinary average people don't really realize the number of endpoint vulnerabilities out there. Walk into a hospital, walk into your doctor's office, your critical infrastructure. Our homes are filled with sensors, and things like routers, and printers and things.

Anubhav Arora

>> Absolutely.

>> So we don't think about the risk that's associated with that. And then when you extrapolate that out to at the enterprise level, and the risk that's associated with that. So it's really interesting to me, and one of the things that I say when we have these conversations, is that if you think there's a lot of things connected to the internet today, blink, because tomorrow it's going to double, and the next day it'll double again.

Anubhav Arora

>> Exactly.

>> So it really is an interesting times. I want to talk a little bit now about 5G as a WAN technology. And really I know that this is a place that CradlePoint really plays in. So talk with me a little bit about that if you would.

Anubhav Arora

>> So 5G is a very high bandwidth, WAN technology, very secure in its own construction. So if you look at 5G as a source of identity, 5G as a RAN radio network where what happens on the radio is secured and how. And 5G also as a cloud-based management system, where all of the protocols that run in the 5G system are actually running in the cloud in a cloud-native manner. If you look at 5G itself, it's a very secure, cellular technology. So 5G as a WAN is a very secure cellular technology, and the challenge really is to make sure that two parts, that you can provide the right quality of experience to the applications that are behind 5G. So if you're streaming video over your phone, one phone, that's okay. But what if you're using more distributed nature of 5G, where you have lots of cameras across the world, and all those cameras are using 5G to upload their video streams, you now need a predictable behavior of the bandwidth. You now need an application-centric SD-WAN, which is taking care of the nature of 5G at heart, which is cellular at heart, can be unpredictable because of mobility, because of other signal strength issues. And you need to be able to make sure that the priority for your business-critical applications is there. So the quality of experience for business-critical applications over cellular, is what we take pride in providing with our solutions at Cradlepoint, whether it's our wireless WAN as well as our NetCloud SASE. The second part becomes security in that construct. So the security is dual-edged. First, how do you join a network like a 5G network? You join it because you have the authoritative credentials to be able to join it with a SIM card, and it's impossible to spoof, or to actually hack a SIM card and in that sense for 5G. So 5G allows us to use identity itself as an element of policy, and allows us to use the network identity of 5G as an element of policy that we use, to allow access for who can do what on the network. And the last part about it is, behind 5G can be multiple devices. We ourselves have routers. And in each router is behind a 5G router, you can have IoT devices. IOT is a very big use case for us. IoT devices are challenging, as you know. IOT devices, we have a lot of them in our homes. Each one of them is different. They don't come with central patch management, they come with their own challenges of security risks.

>> And they come with passwords that are preset. Preset passwords don't ever change.

Anubhav Arora

>> Preset passwords, and you have access to your computer, you can go into your firewall, turn it on. You have access to management from your administrative side on your computer. You can restrict certain things. With IoT, you can't really do that. You can't put a host agent, you cannot look inside. It's very hard to understand the concept from a layman's perspective, because IoT devices behave in a really quite different manner. So once you put an IoT device on the network, it's important to understand how will you provide access to the device, and what will you let the device access outside. And if you do that with the right manner, with the right Zero Trust principles, that only authoritative access when authenticated can come in, and even that through an isolation plane so that you cannot upload things. And you can also do restriction of where the IoT device can go and access in the internet, as well as not expose any ports, so that you are never actually doing any kind of exposure of the IoT device to the internet, and micro segmentation. So that even if there is some kind of a compromise, there is no movement to another part of the network. And those are all Zero Trust principles, each one of them. Each one of them. And if you do it right, you can actually create the right network. You can actually put the right devices with 5G on the network, on corporate network, and use your capability, use your use cases, and enable those use cases in the right manner. So what we do at NetCloud SASE is to do all of these things, the right quality of experience for the applications, the right administrative or privileged access to the IoT devices, the right segmentation and micro segmentation going in and out from the devices, to make sure that we have the right constructs for security.

>> Yeah, yeah, it makes perfect sense. I actually spent some time with Camille Campbell from your team, talking about when the news of the NetCloud SASE came out. So she's amazing, and really exciting technology solution and all that. So when organizations are considering securing their 5G environments, I know the answer to this part of the question is, should their starting point be Zero Trust environments? Yes. Yes. Should it be SASE? Yes. But I'm thinking it probably needs to be both. So talk with me about how we make that happen.

Anubhav Arora

>> Yeah. Zero Trust in general is an architecture and more of a journey. CISA actually has a document which is about the maturity model towards Zero Trust, and it defines the organization's journey in adoption of Zero Trust. So Zero Trust is not something you can get to in a day one.

Anubhav Arora

>> It's a principal. It is, yes.

Anubhav Arora

>> Especially in a transformation. It's a principle. Especially when you're changing your network. The most important part is to start, and iteratively move towards next steps. And the next steps are sometimes not obvious, sometimes that you need to learn through what's happening on your network. You need to use the visibility given by your vendors in your network to create the right policy. Sometimes it's important that you find your policy through action, like you actually disable something, and then you find what might actually happen through there. So you test certain things out. So the vendors that provide Zero Trust-based SASE, not only fit the right foundational principles, but also in a way that they allow you to get to a Zero Trust architecture in a mature manner. Not just that you lock down everything day one, but you actually start, and you repeatedly understand what's happening on your network, and you create the right policy to lock it down further, and further and further, so that one day you get to deny all except what is authorized kind of posture. That is the right answer. Some parts of Zero Trust you can actually put in through the architecture. The rest are through policy, and the maturity in the policy is where the platform should be able to give you all the visibility, give you all the data that you need to see what's happening on your network, so you can iterate towards the right denial policy. So SASE and Zero Trust, both are the answer in every which way. But a vendor that produces a SASE stack with Zero Trust principles, and allows an organization to move to Zero Trust architecture with ongoing maturity is the right choice. And we strive to do that at NetCloud SASE. We strive to give both of these options, we have built with Zero Trust, and we allow you to actually mature your own posture towards Zero Trust as you understand your network better.

>> Zero Trust is not a new concept. We've been talking about this for a long time, but I do think there is a hype factor. And there's also, in every situation, you always have people who kind of glom on to a phrase, or an industry buzzword or whatever. You know where I'm going with this. But how do you differentiate between the hype? And if you are a customer, and you know enough about Zero Trust to be dangerous, you know whether it's important, and you know that you want to embrace it, how do you avoid picking a vendor who's really just hype? What do you look for?

Anubhav Arora

>> Yeah. So Zero Trust, like you said, is not new. It's a set of principles. And I liken a lot of this to what you might do in your own home. If you have a situation in your home where you have to keep yourself safe, what will you first do? You will first lock your doors, lock your windows, right?

>> Permissioning.

Anubhav Arora

>> Yeah. And you would make sure that the basics are that no one can get in. And then if you might have a situation where you can imagine somebody could get in, you would start putting some kind of detection algorithms to make sure that if they do get in, you would detect that. It's the same principles with credit card fraud or any other fraud. You first don't want it to happen. Second, if it does happen, which it can, you want to detect it. So the strictness of implementation of Zero Trust in it is about how strict do you never let it happen? How dark your situation is, so that people do not know about the existence of a certain resource until they have a reason to know. So when we explore a vendor, and you want to understand how Zero Trust is implemented, you need to ask the right questions around, what is visible to those who do not have access? What is visible from an outside attack surface? What is visible if a certain device is compromised? What if my credentials are compromised? Or my iPad is compromised, and I go to the Wi-Fi, what can I see? What can I do? And how much of it is invisible to start with, or deny all? So the invisible part or the deny part is really critical, and the granularity with which it is implemented, and the invisible part makes it invisible to an attacker to even try and find an exploit. Even if they're not authenticated, they can't even see the resource. So all of those pieces are important to understand, and a little bit of technical detail to understand what Zero Trust implementation is behind the scenes, and how it makes the system hack proof or attack proof. And it starts with that principle. A lot of attacks start with phishing. How do you deal with phishing? A lot of attacks starts with an exploit coming in from a website. How do you deal with that? A lot of attacks start with an upload of attachment or something. How do you deal with that? A lot of attacks might be because you have ports open on the internet, or the device is exposed on the internet. How do you deal with that? So a lot of these questions and set of these, is what you need to start with. And the answer should be, this situation is impossible, because of a prevention-based situation built into it. And once you build a prevention-based situation, you prevent as much as possible. You have the attack surface as minimal as possible from an external and internal places. The next is, I need to see whatever else is happening on my network, who's accessing what? And using that, with the human element and the technology element to detect anomalies, to detect credentials that might be compromised, to detect assets that might be compromised, because attacks can still proceed even after all the lockdown. So Zero Trust is important, but the implementation of Zero Trust is even more important. And the right questions lead you to those answers in detail.

>> I knew I could count on you to give me those answers, so thank you for that. So let's talk about applying a Zero Trust approach to web security. So this is for users who are connecting to the internet through 5G, Of course that number will continue to grow. What kind of things do people need to keep in mind?

Anubhav Arora

>> So web security is special because the internet is broad, very big, and a lot of delivery of malware, delivery of phishing is through web security. As we browse a website, we are trusting our browser to be doing everything safely. However, a browser and the number of lines in a browser today is almost as much as any kind of operating system. So a browser is a very complex application, and pages today are not simple HTML with images and small JavaScript. They're complex applications. So when we are looking at a website, we are actually looking at an application, and we are using almost an entire operating system worth of code to do that. When we do that, we are exposed to risks out there in the internet. And the safest way to make sure that the risks are not there is to use what we call the remote browser isolation technology. And that allows you to run all of this code in a remote browser, a disposable remote browser in the cloud, and see a stream of it. Just like if you're connecting an HDMI cable to your computer, to a TV, and on the TV, there's nothing being run. It's just a pixel stream, while your computer is running all the code. That's what our remote browser isolation technology does. So what that does is that it allows the remote browser to inherit the risks, if any, find them, and then put a simple, safe stream over to the local browser. And that safeguards your users from web-borne threats. You should be doing that for any kind of un-trustable, badly reputable websites. Anything that is for sure known to be badly reputable, or new or un-categorized, we need to run that kind of isolation technology. And doing it in a way that the user experience is seamless. You can still click on things, you can still scroll fast, and your experience as a user to browse the webpage is not interrupted.

>> Okay. Well, I think that's incredibly important, right? Yeah. If you're going to get people to use these things, that's the thing.

Anubhav Arora

>> You have to be very sensitive to that part.

>> You have to, and I was having a conversation with somebody the other day, a supply chain expert from Schneider Electric, and she was talking a little bit about, I have this closed down, and this closed down, and this closed down, and that's great, but the challenge then becomes ordinary average users within the organization. You don't want to frustrate them.

Anubhav Arora

>> Can they do their work? Can they do their work?

>> They need to be able to do their work. So speaking of being able to do your work, I know there's an increasing demand for secure optimized 5G networks. So talk with me a little bit about how CradlePoint's delivering that for customers.

Anubhav Arora

>> Absolutely. So as 5G and cellular use cases expand the devices, it's important to consider the enterprise framework in which all of these devices, all of these cellular connectivity, is put within a network that allows the right policies for the users, for the devices, for the data, and all of this to cross-connect only when needed, only when authorized, and only when authenticated and deny everything else. And in certain cases, you evaluate the risk, like when you are going out to a certain website, you put isolation technology on there. While we do this as the part of security, it's important to do quality of experience, like we were just discussing. So when you're behind a cellular use case and you cannot connect your application correctly, when you cannot do video streaming correctly, that becomes a business problem. That's a business issue. So CradlePoint is a wireless WAN company. SD-WAN solutions have always been around cellular optimization. So 5G SASE that we introduced lately with our NetCloud SASE solution, it has multiple optimizations for making sure that the quality of experience for business-critical applications over cellular is maintained. We have multiple innovative technologies in place to be able to do so, and we also make sure that the security on that network is Zero Trust, as we were just talking about. Zero Trust architecture, use of SIM identity as something that we can evaluate as a policy element. So SIM identity becomes an authoritative policy element in the NetCloud SASE, as well as maintaining quality of experience for business-critical applications. That's what we are set out to do.

>> Well, and I think that the thing that a lot of times people don't think about when it comes to cellular access, and mission-critical situations, we have first responders out there. We have people who are working in the field on oil rigs, on all different kinds of dangerous situations and that sort of thing. So this is really this kind of connectivity, we can't not be connected when you're doing these certain kind of things.

Anubhav Arora

>> And security, because attackers don't care, like you have seen here. They don't care. They don't care where their money comes from. Their ransom comes from, whether it comes from a hospital or a mission-critical system, they don't care. But we have to.

>> We have to. Yeah. The conversations that we've been having around this event, is that it's an exciting time for those of us who are practitioners in this space in one way or another. You might also call it a frightening time. There is no option to do nothing as it relates to all of the things that we're talking about. So Anubhav Arora, Vice President of Security and Engineering at Cradlepoint, thank you so much for spending time with me today.

Anubhav Arora

>> Thank you.

>> I knew this was going to be a great conversation. And for our listening and viewing audience, we are coming to you live from RSA in San Francisco, the security event of the year. I'm Shelly Kramer with theCUBE. I'm here with Dave Vallente and David Linthicum. Keep it right here on theCUBE, and we'll see you for some more here in a little bit.

Anubhav Arora | Cradlepoint

search

>> Hello, and welcome back to theCUBE's live coverage here at RSA. We are in beautiful, sunny, downtown San Francisco, and I am here today with Anubhav Arora, the Vice President of Security Engineering at Cradlepoint. Welcome, I'm so glad to have you.

Anubhav Arora

>> Thank you. Very glad to be here.

>> Absolutely. Well, we were just sitting here talking about how the job that we have when we show up at industry trade shows, especially one as big as this one, is actually a really big job.

Anubhav Arora

>> Yes.

>> But the cool thing I think is that we get facetime with our customers, with our partners, with our analyst friends. It really is, I think, an important-

Anubhav Arora

>> It's an important step in our journeys towards making the world secure.

>> Absolutely. Absolutely. So we are going to talk today about 5G, and we're going to talk about the increased adoption of 5G as a wireless WAN technology. It changes what we know about traditional networking, but it brings in increased risks, all different kinds of things. And so what has to happen, of course, is that technology has to evolve to support these changes, right?

Anubhav Arora

>> Yes.

>> And so is Zero Trust the answer? Yes. Is SASE the answer? Yes. But today, I want to talk a little bit about secure 5G environments, and kind of your thinking in terms... You're the VP of Security and Engineering, right? So I think you have some thoughts on this topic. So I'd love to talk some more about just what organizations need to be thinking about when they're approaching this.

Anubhav Arora

>> Yep. It's a very fine point. And 5G cellular in particular, and 5G bringing us more bandwidth, unlimited data plans, what is it really doing to our networks? It's allowing us to add more use cases. It's allowing us to add remote sites, remote workers, remote IoT devices. It's allowing us to expand the networks at a rapid pace, at a pace that the Agile enterprises actually want to do that. It brings the challenges of security, because devices themselves that we place on the network can be a security risk. And the more devices we put on our networks, the more manufacturers, the more vendors, the more patching systems we are putting on our networks. So how do you actually create a network that automatically takes care of most of those risks, in a manner that access to these devices, access from these devices, communication patterns that are restricted, or understood to be threatening, are not allowed? Those are the challenges that we face when we actually go into the 5G world and cellular world, enabling these use cases and the security that comes with it. So this enterprise's security is the backbone of their network. Security is the first conversation. Security is the most paramount part of a network design. Is Zero trust the answer? Absolutely. Zero Trust is the answer, why? Implemented correctly, Zero Trust actually starts to take away all of these threat attack surfaces. How do you actually get these attacks in? How does an attacker get in? It's because we have an attack surface. Attack surface means places where an attacker might get a foothold, and then hop to another part of the network, hop to another part of the network. So there is an attack surface on the external side on how to get in. There is an attack surface on the internal side, how to hop to another part of the network, another resource, another database, or another part of the network where you can get access to more data. All of that is eliminated almost completely by a zero trust network. And that depends on the design with Zero Trust principles. So as we put more devices with 5G on the networks, it's paramount that the security is considered first, and Zero Trust is the architecture of choice to design the network with. SASE, while we use SASE and Zero Trust in the same breath, in the same sentence most of the time, they're slightly different. One is in architecture, the other is a product category. But a lot of SASE vendors do take pride in constructing their solutions with Zero Trust. And so do we. At CradlePoint, we construct our NetCloud SASE solution completely from Zero Trust principles ground up. But that's not necessarily the case for every network or every vendor. So as people are thinking about constructing their networks, constructing their SASE, choosing their SASE vendors, putting their basic tenets into place, who can access what? What kind of policies? What kind of openings we have allowing in our network? It's important to understand both, Zero Trust and how SASE vendors are building their networks with Zero Trust.

>> Yeah, that makes a lot of sense. So I think that a lot of times when we talk about 5G, and we talk about devices, the reality of it is, this ecosystem is so big, and it's expanding at such a rapid pace. And I think that the ordinary average people don't really realize the number of endpoint vulnerabilities out there. Walk into a hospital, walk into your doctor's office, your critical infrastructure. Our homes are filled with sensors, and things like routers, and printers and things.

Anubhav Arora

>> Absolutely.

>> So we don't think about the risk that's associated with that. And then when you extrapolate that out to at the enterprise level, and the risk that's associated with that. So it's really interesting to me, and one of the things that I say when we have these conversations, is that if you think there's a lot of things connected to the internet today, blink, because tomorrow it's going to double, and the next day it'll double again.

Anubhav Arora

>> Exactly.

>> So it really is an interesting times. I want to talk a little bit now about 5G as a WAN technology. And really I know that this is a place that CradlePoint really plays in. So talk with me a little bit about that if you would.

Anubhav Arora

>> So 5G is a very high bandwidth, WAN technology, very secure in its own construction. So if you look at 5G as a source of identity, 5G as a RAN radio network where what happens on the radio is secured and how. And 5G also as a cloud-based management system, where all of the protocols that run in the 5G system are actually running in the cloud in a cloud-native manner. If you look at 5G itself, it's a very secure, cellular technology. So 5G as a WAN is a very secure cellular technology, and the challenge really is to make sure that two parts, that you can provide the right quality of experience to the applications that are behind 5G. So if you're streaming video over your phone, one phone, that's okay. But what if you're using more distributed nature of 5G, where you have lots of cameras across the world, and all those cameras are using 5G to upload their video streams, you now need a predictable behavior of the bandwidth. You now need an application-centric SD-WAN, which is taking care of the nature of 5G at heart, which is cellular at heart, can be unpredictable because of mobility, because of other signal strength issues. And you need to be able to make sure that the priority for your business-critical applications is there. So the quality of experience for business-critical applications over cellular, is what we take pride in providing with our solutions at Cradlepoint, whether it's our wireless WAN as well as our NetCloud SASE. The second part becomes security in that construct. So the security is dual-edged. First, how do you join a network like a 5G network? You join it because you have the authoritative credentials to be able to join it with a SIM card, and it's impossible to spoof, or to actually hack a SIM card and in that sense for 5G. So 5G allows us to use identity itself as an element of policy, and allows us to use the network identity of 5G as an element of policy that we use, to allow access for who can do what on the network. And the last part about it is, behind 5G can be multiple devices. We ourselves have routers. And in each router is behind a 5G router, you can have IoT devices. IOT is a very big use case for us. IoT devices are challenging, as you know. IOT devices, we have a lot of them in our homes. Each one of them is different. They don't come with central patch management, they come with their own challenges of security risks.

>> And they come with passwords that are preset. Preset passwords don't ever change.

Anubhav Arora

>> Preset passwords, and you have access to your computer, you can go into your firewall, turn it on. You have access to management from your administrative side on your computer. You can restrict certain things. With IoT, you can't really do that. You can't put a host agent, you cannot look inside. It's very hard to understand the concept from a layman's perspective, because IoT devices behave in a really quite different manner. So once you put an IoT device on the network, it's important to understand how will you provide access to the device, and what will you let the device access outside. And if you do that with the right manner, with the right Zero Trust principles, that only authoritative access when authenticated can come in, and even that through an isolation plane so that you cannot upload things. And you can also do restriction of where the IoT device can go and access in the internet, as well as not expose any ports, so that you are never actually doing any kind of exposure of the IoT device to the internet, and micro segmentation. So that even if there is some kind of a compromise, there is no movement to another part of the network. And those are all Zero Trust principles, each one of them. Each one of them. And if you do it right, you can actually create the right network. You can actually put the right devices with 5G on the network, on corporate network, and use your capability, use your use cases, and enable those use cases in the right manner. So what we do at NetCloud SASE is to do all of these things, the right quality of experience for the applications, the right administrative or privileged access to the IoT devices, the right segmentation and micro segmentation going in and out from the devices, to make sure that we have the right constructs for security.

>> Yeah, yeah, it makes perfect sense. I actually spent some time with Camille Campbell from your team, talking about when the news of the NetCloud SASE came out. So she's amazing, and really exciting technology solution and all that. So when organizations are considering securing their 5G environments, I know the answer to this part of the question is, should their starting point be Zero Trust environments? Yes. Yes. Should it be SASE? Yes. But I'm thinking it probably needs to be both. So talk with me about how we make that happen.

Anubhav Arora

>> Yeah. Zero Trust in general is an architecture and more of a journey. CISA actually has a document which is about the maturity model towards Zero Trust, and it defines the organization's journey in adoption of Zero Trust. So Zero Trust is not something you can get to in a day one.

Anubhav Arora

>> It's a principal. It is, yes.

Anubhav Arora

>> Especially in a transformation. It's a principle. Especially when you're changing your network. The most important part is to start, and iteratively move towards next steps. And the next steps are sometimes not obvious, sometimes that you need to learn through what's happening on your network. You need to use the visibility given by your vendors in your network to create the right policy. Sometimes it's important that you find your policy through action, like you actually disable something, and then you find what might actually happen through there. So you test certain things out. So the vendors that provide Zero Trust-based SASE, not only fit the right foundational principles, but also in a way that they allow you to get to a Zero Trust architecture in a mature manner. Not just that you lock down everything day one, but you actually start, and you repeatedly understand what's happening on your network, and you create the right policy to lock it down further, and further and further, so that one day you get to deny all except what is authorized kind of posture. That is the right answer. Some parts of Zero Trust you can actually put in through the architecture. The rest are through policy, and the maturity in the policy is where the platform should be able to give you all the visibility, give you all the data that you need to see what's happening on your network, so you can iterate towards the right denial policy. So SASE and Zero Trust, both are the answer in every which way. But a vendor that produces a SASE stack with Zero Trust principles, and allows an organization to move to Zero Trust architecture with ongoing maturity is the right choice. And we strive to do that at NetCloud SASE. We strive to give both of these options, we have built with Zero Trust, and we allow you to actually mature your own posture towards Zero Trust as you understand your network better.

>> Zero Trust is not a new concept. We've been talking about this for a long time, but I do think there is a hype factor. And there's also, in every situation, you always have people who kind of glom on to a phrase, or an industry buzzword or whatever. You know where I'm going with this. But how do you differentiate between the hype? And if you are a customer, and you know enough about Zero Trust to be dangerous, you know whether it's important, and you know that you want to embrace it, how do you avoid picking a vendor who's really just hype? What do you look for?

Anubhav Arora

>> Yeah. So Zero Trust, like you said, is not new. It's a set of principles. And I liken a lot of this to what you might do in your own home. If you have a situation in your home where you have to keep yourself safe, what will you first do? You will first lock your doors, lock your windows, right?

>> Permissioning.

Anubhav Arora

>> Yeah. And you would make sure that the basics are that no one can get in. And then if you might have a situation where you can imagine somebody could get in, you would start putting some kind of detection algorithms to make sure that if they do get in, you would detect that. It's the same principles with credit card fraud or any other fraud. You first don't want it to happen. Second, if it does happen, which it can, you want to detect it. So the strictness of implementation of Zero Trust in it is about how strict do you never let it happen? How dark your situation is, so that people do not know about the existence of a certain resource until they have a reason to know. So when we explore a vendor, and you want to understand how Zero Trust is implemented, you need to ask the right questions around, what is visible to those who do not have access? What is visible from an outside attack surface? What is visible if a certain device is compromised? What if my credentials are compromised? Or my iPad is compromised, and I go to the Wi-Fi, what can I see? What can I do? And how much of it is invisible to start with, or deny all? So the invisible part or the deny part is really critical, and the granularity with which it is implemented, and the invisible part makes it invisible to an attacker to even try and find an exploit. Even if they're not authenticated, they can't even see the resource. So all of those pieces are important to understand, and a little bit of technical detail to understand what Zero Trust implementation is behind the scenes, and how it makes the system hack proof or attack proof. And it starts with that principle. A lot of attacks start with phishing. How do you deal with phishing? A lot of attacks starts with an exploit coming in from a website. How do you deal with that? A lot of attacks start with an upload of attachment or something. How do you deal with that? A lot of attacks might be because you have ports open on the internet, or the device is exposed on the internet. How do you deal with that? So a lot of these questions and set of these, is what you need to start with. And the answer should be, this situation is impossible, because of a prevention-based situation built into it. And once you build a prevention-based situation, you prevent as much as possible. You have the attack surface as minimal as possible from an external and internal places. The next is, I need to see whatever else is happening on my network, who's accessing what? And using that, with the human element and the technology element to detect anomalies, to detect credentials that might be compromised, to detect assets that might be compromised, because attacks can still proceed even after all the lockdown. So Zero Trust is important, but the implementation of Zero Trust is even more important. And the right questions lead you to those answers in detail.

>> I knew I could count on you to give me those answers, so thank you for that. So let's talk about applying a Zero Trust approach to web security. So this is for users who are connecting to the internet through 5G, Of course that number will continue to grow. What kind of things do people need to keep in mind?

Anubhav Arora

>> So web security is special because the internet is broad, very big, and a lot of delivery of malware, delivery of phishing is through web security. As we browse a website, we are trusting our browser to be doing everything safely. However, a browser and the number of lines in a browser today is almost as much as any kind of operating system. So a browser is a very complex application, and pages today are not simple HTML with images and small JavaScript. They're complex applications. So when we are looking at a website, we are actually looking at an application, and we are using almost an entire operating system worth of code to do that. When we do that, we are exposed to risks out there in the internet. And the safest way to make sure that the risks are not there is to use what we call the remote browser isolation technology. And that allows you to run all of this code in a remote browser, a disposable remote browser in the cloud, and see a stream of it. Just like if you're connecting an HDMI cable to your computer, to a TV, and on the TV, there's nothing being run. It's just a pixel stream, while your computer is running all the code. That's what our remote browser isolation technology does. So what that does is that it allows the remote browser to inherit the risks, if any, find them, and then put a simple, safe stream over to the local browser. And that safeguards your users from web-borne threats. You should be doing that for any kind of un-trustable, badly reputable websites. Anything that is for sure known to be badly reputable, or new or un-categorized, we need to run that kind of isolation technology. And doing it in a way that the user experience is seamless. You can still click on things, you can still scroll fast, and your experience as a user to browse the webpage is not interrupted.

>> Okay. Well, I think that's incredibly important, right? Yeah. If you're going to get people to use these things, that's the thing.

Anubhav Arora

>> You have to be very sensitive to that part.

>> You have to, and I was having a conversation with somebody the other day, a supply chain expert from Schneider Electric, and she was talking a little bit about, I have this closed down, and this closed down, and this closed down, and that's great, but the challenge then becomes ordinary average users within the organization. You don't want to frustrate them.

Anubhav Arora

>> Can they do their work? Can they do their work?

>> They need to be able to do their work. So speaking of being able to do your work, I know there's an increasing demand for secure optimized 5G networks. So talk with me a little bit about how CradlePoint's delivering that for customers.

Anubhav Arora

>> Absolutely. So as 5G and cellular use cases expand the devices, it's important to consider the enterprise framework in which all of these devices, all of these cellular connectivity, is put within a network that allows the right policies for the users, for the devices, for the data, and all of this to cross-connect only when needed, only when authorized, and only when authenticated and deny everything else. And in certain cases, you evaluate the risk, like when you are going out to a certain website, you put isolation technology on there. While we do this as the part of security, it's important to do quality of experience, like we were just discussing. So when you're behind a cellular use case and you cannot connect your application correctly, when you cannot do video streaming correctly, that becomes a business problem. That's a business issue. So CradlePoint is a wireless WAN company. SD-WAN solutions have always been around cellular optimization. So 5G SASE that we introduced lately with our NetCloud SASE solution, it has multiple optimizations for making sure that the quality of experience for business-critical applications over cellular is maintained. We have multiple innovative technologies in place to be able to do so, and we also make sure that the security on that network is Zero Trust, as we were just talking about. Zero Trust architecture, use of SIM identity as something that we can evaluate as a policy element. So SIM identity becomes an authoritative policy element in the NetCloud SASE, as well as maintaining quality of experience for business-critical applications. That's what we are set out to do.

>> Well, and I think that the thing that a lot of times people don't think about when it comes to cellular access, and mission-critical situations, we have first responders out there. We have people who are working in the field on oil rigs, on all different kinds of dangerous situations and that sort of thing. So this is really this kind of connectivity, we can't not be connected when you're doing these certain kind of things.

Anubhav Arora

>> And security, because attackers don't care, like you have seen here. They don't care. They don't care where their money comes from. Their ransom comes from, whether it comes from a hospital or a mission-critical system, they don't care. But we have to.

>> We have to. Yeah. The conversations that we've been having around this event, is that it's an exciting time for those of us who are practitioners in this space in one way or another. You might also call it a frightening time. There is no option to do nothing as it relates to all of the things that we're talking about. So Anubhav Arora, Vice President of Security and Engineering at Cradlepoint, thank you so much for spending time with me today.

Anubhav Arora

>> Thank you.

>> I knew this was going to be a great conversation. And for our listening and viewing audience, we are coming to you live from RSA in San Francisco, the security event of the year. I'm Shelly Kramer with theCUBE. I'm here with Dave Vallente and David Linthicum. Keep it right here on theCUBE, and we'll see you for some more here in a little bit.