--- title: "Zero Trust Connectivity (ZTc): A Full Introduction Video" description: "David Redekop and Francois Driessen explain the philosophy, execution and consequences of Zero Trust Connectivity with adam:ONE, DTTS and DNSharmony." url: https://adamnet.works/videos/zero-trust-connectivity-full-introduction/ index: https://adamnet.works/llms.txt --- [All videos](https://adamnet.works/videos.md) ZTc Philosophy · Dynamic AI Allowlisting · Default-Deny-All # Zero Trust Connectivity (ZTc): A Full Introduction David Redekop and Francois Driessen introduce Zero Trust Connectivity: its philosophy, its execution with dynamic AI allow-listing, DTTS and DNSharmony in adam:ONE, and its consequences for attack surface, C2 and data egress. September 15, 2022 • 36 min ![Zero Trust Connectivity (ZTc): A Full Introduction](https://adamnet.works/assets/thumbs/yt-i5DjoBfocwM.webp) _Philosophy, Execution and Consequence._ David and Francois share their thoughts on the origin of adam:ONE® in ZTc configuration and the effects of the technology. The [Zero Trust Connectivity white paper](https://adamnet.works/papers/zero-trust-connectivity-white-paper.md) covers the same ground in writing. ## Chapters ### ZTc philosophy (00:00:19) - Notes and origins of Zero Trust (00:00:30) - Failures of conventional security (00:03:20) - The security flaw of DNS (00:05:47) - Reactive security (00:09:16) - Tenets for Zero Trust Connectivity (00:11:58) ### ZTc execution (00:19:18) - Dynamic AI allow-listing (00:20:01) - Don’t Talk To Strangers (00:20:57) - DNSharmony® (00:21:32) - Implementation with adam:ONE® (00:22:05) ### ZTc consequence (00:25:11) - Zero Trust connections to the whole internet - A unique sculpted BrightWeb™ per node - Attack surface reduction to near zero - C2 attack vectors eliminated - Protection against unknown threats - True proactive protection without detection required - Data egress vectors eliminated, protecting intellectual property and sensitive data - Phishing vectors eliminated - Shadow IT exposed - Circumvention protection - Privacy hardening - Productivity enhancement - Distributed custodial protection ### Conclusion (00:34:08) Faster, harder, stronger is not good enough. It’s time for a new philosophy: establish a true proactive posture. ## Full Transcript **Francois Driessen:** Hi guys, let’s talk a little bit about Zero Trust Connectivity. I think that there is a lot to discuss and a lot to discover. So, I’m here with David. And let’s just jump right in. What’s this all about? Okay? **David Redekop:** Yep. ### ZTc philosophy **Francois Driessen:** One thing that I think we all need to just, you know, hit right off the bat is just because zero trust is a hot topic in security and just because someone put that T in marketing doesn’t mean that it’s actually solving the problems or making proper steps forward to solve what zero trust is set out to solve. **David Redekop:** That’s right. **Francois Driessen:** Okay? I think that’s a very, very important thing. And then the other thing that I think’s important that I’ve come across, I don’t know what you see, David, but you read the white papers of zero trust. **David Redekop:** Mhm. **Francois Driessen:** Okay? It’s all very good, very good philosophies. We actually completely agree with all of that, but then you get to the end and then you realize that, you know, this is not really necessarily implementable for a lot of guys. **David Redekop:** That’s right. It’s not practical. **Francois Driessen:** So, it’s kind of like you read this philosophical thing. You’re about to chase the unicorn milk, but you will never find it, right? Cuz it says that most people will end up somehow in some sort of hybrid. So, some holes will be patched. Some things will be… But, that’s still not good enough, right? **David Redekop:** Right. **Francois Driessen:** So, where did this whole zero trust notion come from? And I think the first thing to understand is that it really is a reaction to failure. **David Redekop:** Mhm. **Francois Driessen:** Okay? Traditional security systems and traditional security philosophy was failed. And really what it came down to is to say the old castle wall approach is to say we have this wall and everything outside the wall is bad, or maybe not trusted. Anything inside the wall, once you’re there, you’re part of the club, it’s all good now, right? Really what it comes down to is to say, because the philosophy was wrong on this castle wall… **David Redekop:** Mhm. **Francois Driessen:** …in how we implemented the castle wall, now we just say, let’s not even think about the castle wall at all, let’s now just talk about identity. Verify, verify, verify devices amongst each other, right? What I find interesting is that the moment that you actually verify between these devices, all you’re essentially creating is a new complex shape of a castle wall, right? So, instead of it being one big thing, now you have lots of bubbles everywhere. Maybe it’s remote work, maybe it’s different sites that need to be connected together, maybe it’s different services and cloud services. So, but really what we are dealing with is a different shape perimeter, flexible perimeter. **David Redekop:** Yeah. **Francois Driessen:** And so, if the whole idea… And then, you know what? I understand it, because sometimes if you have an unbalanced scale, things were wrong with this whole castle wall approach. You have to overweight it to start getting the scale into movement, but really we need to get to a place of being practical and say that the perimeter is even more important than it was in the past, because now you’re dealing with a flexible, complex shape perimeter. **David Redekop:** Right. It’s not about the walls. **Francois Driessen:** Yeah. It’s about the doors and the locks. That’s really what I think we need to dive into quickly. So, David, what are the main things that come to mind for you as to why the traditional firewall has died? Why the conventional security has failed? What would you say are key things that come up for you? **David Redekop:** The first key element on why the traditional role of a firewall couldn’t function anymore is because we needed to implement a practical way of doing egress control, but that wasn’t practical in a traditional firewall, because when you would firewall for egress control, it was very static. It was very set in a point in time, and it was really not maintainable very well. **Francois Driessen:** But the same would be true also for ingress, right? Well, the same thing would apply to both directions. **David Redekop:** That’s right. It was very static, and so you didn’t have a dynamic nature in a traditional firewall. And then what we tried to do, and that also didn’t work very well, is implement a proxy technology… **Francois Driessen:** Right. **David Redekop:** …where the proxy would then be of a more dynamic nature. But then it’s so full of problems and compatibility issues. And then we did transparent proxies, which had a problem where it could not protect secure channels anyway. So little by little, we just started letting more and more and more stuff through that was not inspectable. **Francois Driessen:** Right. **David Redekop:** Another core part of the issue was that as Edward Snowden revealed to the world how much information was inspectable, and that was used with malicious intent or breaching our privacy and our security, then we said, “Okay, then let’s start securing the transit more.” So when stuff goes from me to you on the path, it’s encrypted to where it’s not inspectable. Well, that means that the firewall now cannot inspect it either. **Francois Driessen:** Right. **David Redekop:** And so all of these things together added up to where the traditional firewall was no longer relevant. **Francois Driessen:** And then of course, you know, so you can’t do packet inspection, SNI is a problem, DoH is a problem, you suddenly can’t see what’s going on anymore. DNS still has value, right? But there’s this inherent problem with leakiness of DNS, right? **David Redekop:** Absolutely, because with the internet being both DNS and IP based, and then applying a DNS-based firewall, it simply does not apply to stuff that doesn’t use DNS. And so inherently, that’s where all peer-to-peer traffic, for example, would just walk right around that DNS firewall and not use it at all. And so it always had limited application. **Francois Driessen:** So, we almost needed to just think about, you know, those three circles… **David Redekop:** Mhm. **Francois Driessen:** …of the changes that had happened on the internet. Where first it was, let’s just get stuff to work, right? And that actually happens not just on the internet, in pretty much any technology. This is like, get stuff to work. That’s our first circle. **David Redekop:** Mhm. **Francois Driessen:** And then from there on we say, well, let’s get it optimized to work better and be more resilient and so forth. **David Redekop:** Right. **Francois Driessen:** But, now you get to this third aspect of saying, well, I never thought about security. **David Redekop:** Right. **Francois Driessen:** And that’s the third circle. And these are kind of in tension with each other. **David Redekop:** That’s right. **Francois Driessen:** And right now, we’re in this third phase of saying, you know, we got stuff to work, we got it optimized, but how do we actually secure it? And that’s really where I think everyone’s finding themselves. So, applying that to DNS, what we used to say is inherent design flaw in it. **David Redekop:** Well, the inherent design flaw comes by form of history, which is very well documented. But, where we are today is that we have, if you can visualize, two doors for our devices to reach out to the internet. One door is the DNS door, where we go out and say, “Hey, where’s google.com?” **Francois Driessen:** Sure. **David Redekop:** And then we come back and get the answer. And then we go out the other door, that’s the IP door. **Francois Driessen:** Okay. **David Redekop:** Right? **Francois Driessen:** Right. **David Redekop:** So, the IP door, generally speaking in most environments today, is wide open. But, in many places where they put in a DNS firewall, they have put in a security officer at the DNS door. **Francois Driessen:** Right. **David Redekop:** So, when you say, “Where is google.com?” you’ll get the answer. But, if you say, “Where is this badwebsite.com?” the security operator says, “No, that’s not some place that you’re going to go, so I’m not going to tell you what the answer is.” **Francois Driessen:** Right. **David Redekop:** And so therefore, you don’t know where to go and you can’t go there. **Francois Driessen:** But, this is the nice guy. We’re not talking about malware. We’re talking about a user that needs to be protected that’s willing to actually ask the security guard. Ask mom or dad, “Hey, where do I go for this?” And they’re at the door. **David Redekop:** And DNS firewalls have been around for some time now. So, this is not a new concept to the guys that write malware. **David Redekop:** Right. Guys who write malware, they’re like, “Ah, we know that in places where there’s high-value assets, we’re not going to use DNS because then we’re going to leave a digital trail, and they’re probably not going to let us out. We’re going to go without. We’re going to use some other kind of a channel to figure out the IP addresses that we need to connect to where our command and control server lives, for example, and we’ll do that instead.” **Francois Driessen:** Sure. **David Redekop:** And that is what we refer to as the inherent leakiness of a DNS firewall. It only goes so far to protect the good guy who’s a user. It cannot protect against malicious software that just bypasses DNS altogether. **Francois Driessen:** Right. And so, then it’s sort of like this whole notion came where, “Okay, we can’t really protect. The perimeter is already breached.” So, and then next-generation firewall came in to say, “Well, let’s detect. Let’s detect. Let’s see what’s going on.” So, now we have the security guard standing inside the castle and just looking for anything that’s bad and then raising an alarm when that is. Well, problem is that a lot of them require endpoint agents, right? **David Redekop:** That’s right. **Francois Driessen:** And so, what about IoT devices where you don’t get to put your endpoint agent? Well, what about these guys? **David Redekop:** Well, that is a problem, for sure. **Francois Driessen:** Right. And then really that brings us to the core issue. Is that now you’ve moved from a proactive to a reactive approach. In actual fact, this whole movement is still reactive to a very, very large extent. This isn’t working, let’s change that. This isn’t working, let’s change that, right? It’s reacting versus taking a true step back and saying, “Well, let’s design from first principles. What do we actually need to see happen here?” And that is true proactive, because even with next-generation firewalls, you’re still in a reactive approach, cuz real-time detection is not fast enough. Solorigate taught us that. And I mean the guys that were hit by this, they’re black belts, right? So, US Treasury, CISA, DHS, US Department of State. The list goes on and on, right? So, 6 months before detection, and suddenly there’s no protection actually that’s happening there. So, the reality is that if you skipped this protect phase, you just want to go to the detect and remediate phase, then you’ve already given half the battle to the bad guy. And so, you might have a proactive approach in your security for your company or for your organization, but the tools you use are still reactive. You’re still reactive, okay? And that’s another thing that I think we need to just identify. Another important thing to think about with this whole reactive versus proactive approach is that with a reactive approach, meaning you’re keeping track of what is bad, with the best threat intelligence that you get in the world, right? You can only be protected against some known threats from yesterday. Okay? Any undetected or any unknown thing that is there today or tomorrow, there is no protection against it. And so, there’s this philosophical problem with block listing, with the reactive approach, and that is that there’s always a victim. And I don’t want that victim to be me or people that I am protecting or that I care about, right? And then the next thing is, well, it is maybe known for this threat intelligence source, but maybe not that one, right? **David Redekop:** Right. **Francois Driessen:** And how much time goes by since it actually becomes known until it becomes available? **David Redekop:** Right. **Francois Driessen:** And those are key things that need to be considered. So, even if you have a proactive approach for security for your organization, but you’re using reactive tools, okay? Then, you are still reactive. **Francois Driessen:** That’s right. That means that the bad guy is always one step ahead of you. **Francois Driessen:** Right. All right. That really brings us to Zero Trust Connectivity, right? So, what are the core concepts in the philosophy that to you sit right at the bottom? **David Redekop:** Well, the one that is absolutely top of mind for anybody who’s been in this field for some time is don’t give me another product unless it’s practically implementable right away. **Francois Driessen:** No, you don’t need milk. **David Redekop:** Show me how it’s done so that I can do it today, right? It has to be practical, has to be available right away. That would be the number one. **Francois Driessen:** Okay? And then, of course, assume that you’re already being breached, right? Just assume that. And then, wouldn’t it be interesting if your remediation for if you have already been breached is the same that you use for your protection? Wouldn’t that be something, all right? And we’ll dive into that a little bit more. **David Redekop:** One of those components would be the next item, which is having leak-proof egress control. I want to be able to have the peace of mind that I can plug in an Ethernet device or attach something to a Wi-Fi network and know that it cannot do anything unless I’ve given it permission to do so first. So, that has to be leak-proof. **Francois Driessen:** So, and really the concept is to say, we stop trying to keep track of what is bad, we’re going to move our focus to keeping track of what is good. I mean, of course, bad and good, you have to keep track of both, but I’m saying the focus goes to let’s verify what is good, keep track of that, and those are the only connections that are going to be allowed, right? So, any new connection, everyone’s bad, trust no one, deny all connections by default, all right? Unless it’s verified to be good and is requested by actually one of your verified assets, right? **David Redekop:** And in order to do that, we have another requirement, which would be that we need to have maximum visibility to each endpoint. We don’t care if that device has its own firewall turned on. We need the visibility and have it not hide behind another bridge, not have it hide behind another router. And if it is, for it to be obvious, right? So that this whole shadow IT environment becomes exposed. **Francois Driessen:** Right. So, you absolutely need to have inventory of every single device that lives there. And the thing is this needs to happen automatically. **David Redekop:** That’s right. **Francois Driessen:** So, human error is out of the equation. This has to be part of: if you’re connected, it’s known that you are there, right? All devices must be protectable. Like even if there is no way to put an endpoint agent on that device, you must be able to protect it, right? And keep in mind that the supply chain now involves the homes of the employees that are working remotely, to your suppliers. So, the smart light bulb or the network camera or whatever the thing is, all of those things now suddenly become part of this crazy mush soup, okay? Of what needs to be protected. **Francois Driessen:** So, with Zero Trust Connectivity, you must be able to apply protection to an IoT device that cannot take your endpoint software. **David Redekop:** As it is in read-only firmware mode, it needs to be protectable if you’re going to maintain a zero trust network. **Francois Driessen:** And not to make it too mysterious, of course you can do that if you protect that connection. **David Redekop:** That’s right. **Francois Driessen:** Okay. And… Yeah. **David Redekop:** And another important element is that nowadays we live in the world where we have free open source threat intelligence. We have community crowdsourced threat intelligence. We have commercial threat intelligence. Well, we need to be able to combine them all in real time to provide protection, because this one source may know something that another source doesn’t know. This applies to the real geopolitical world the same as it does in the cybersecurity world. **Francois Driessen:** Absolutely agree. What is the best threat intelligence in the world? It’s not this guy or that guy which is number one, number two, and maybe tomorrow this is number one and number two and number three. It is combining all of them together, and whatever craft or AI data, but whatever you’re implementing, you want to be able to combine that threat intelligence. So, that’s a core tenet of Zero Trust Connectivity. But then also being able to apply it proactively. Meaning that it’s not the same old let’s know that it’s there, then we block it, or let’s detect that it’s there, then we block it. No, you just block everything and you use the threat intelligence to focus on what is actually good, verified, and what can be trusted. Right? It’s the other way around. **David Redekop:** Flipping the table on the bad guy is how I like to think about it. And flipping the table on that too is making sure that that protection is done custodially on a distributed basis. What we mean by that is these boxes need to offer protection in as many places as possible without relying on a central cloud service to proxy things through. That’s distributed custodial protection that we think is important. **Francois Driessen:** Right. And you know, let’s talk about, I mean, flexible perimeters. Reality is maybe you want it to live on the cloud edge. Maybe it needs to go with this device. Maybe the perimeter sits on this device itself. Maybe you want to put this in an access point network, in a cellular network. So, it needs to have flexible perimeter. **Francois Driessen:** Right. That can… and they are not static. Because if my machine, this endpoint, is allowed to access my banking during the day, there’s really no reason for it to be able to do that at 3:00 a.m. when I’m not doing that, right? So, it needs to open and it needs to collapse when not verified and not good. And so it’s not just a static environment that it’s okay now, but tonight at 3:00 a.m. it’s okay as well. No. **Francois Driessen:** Right. Okay? **David Redekop:** And then I would add one more, which is circumvention protection. **Francois Driessen:** Yeah. **David Redekop:** This is in multiple contexts, not just in terms of having a content filter that’s actually enforceable, but also to prevent the bad guys from writing malware that walks around a traditional egress control firewall, right? So, circumvention protection is absolutely essential. It ties in well with the egress control component, but there has to be a purposeful thought into making sure that you’re thinking like the red teamer or like the bad guy in the building, and protection against that. **Francois Driessen:** Right. And another one is just don’t break encryption along the way, you know? It has value. It has security value. It has privacy value. To try to get into the middle and break that for the sake of inspection, we feel that that’s not good practice. **David Redekop:** No, because at that point I am pretty much surrendering my credentials to my banking, my business banking, personal, to whoever houses that infrastructure. So, not zero trust. **Francois Driessen:** It’s kind of like, well, you’re shifting that risk. You’re just shifting it somewhere where you don’t actually have control. **David Redekop:** In fact, it should be called Focus Trust if someone proxies traffic for inspection. ### ZTc execution **Francois Driessen:** So, when we’re talking about zero trust in this context, it really comes down to what adam:ONE® became when 6 years ago there was a change of philosophy for you and the team, right, David? **David Redekop:** That’s correct. It was very obvious to us at that time that all of the traditional ways of trying to identify and block threats was just a runaway cat-and-mouse game that we could never win. **Francois Driessen:** Right. **David Redekop:** We had to take a step back and say, “How do we do this properly?” **Francois Driessen:** Right. And going to that first principle, which we’ll jump into in a second, okay? In my mind, this really expressed in adam:ONE three main technologies that were birthed from that. And the first is this dynamic allow-listing. **David Redekop:** Right. **Francois Driessen:** So, either the AI-driven dynamic allow-listing, which is AI and graph first, means it’s a default deny-all. As an asset requests, it checks to see that it’s safe, checks against the graph, and builds this dynamic list as the asset actually needs it. And then, or the reflex expression of that, which is more of a category-based, threat-intelligence-first approach to that, also a default deny-all, checking at the time of request, opening that dynamic allow list, and then collapsing it immediately after. So, that would be the first one. And then the next one would be Don’t Talk To Strangers, right? **David Redekop:** That’s right. In our world, the term strangers is an IP address that was not first resolved by an allowed DNS query. So, it takes care of that door that before had no protection. You have this DNS firewall in place, but then the IP door made it very leaky. And this is what effectively makes it leak-proof. **Francois Driessen:** Now you have a DNS firewall that works. Not just for the ones that are nice. **David Redekop:** That’s right. Absolutely. **Francois Driessen:** And then I think the other element that’s important to mention is DNSharmony®. And that is the ability to aggregate threat intelligence. Whatever threat intelligence source you actually want to aggregate, you can actually do that and aggregate that in real time. **David Redekop:** Right. Because gone are the days when you’re going to rely on a single vendor for a product. We know this at the global geopolitical scale, and this also applies to threat intelligence. DNS-based threat intelligence, there’s so much of this stuff that’s good, but we want to bring it all together and aggregate it in real time. **Francois Driessen:** Right. Right. So, how is this actually implemented? I think we should just give a quick rundown of how it actually is implemented as adam:ONE. **David Redekop:** Right. Well, at the core we have a highly optimized DNS caching resolver that is on each network segment. **Francois Driessen:** Okay. **David Redekop:** This is really important because it achieves that distributed custodial protection. It’s super efficient, multi-platform, so that it can scale across a variety of hardware and ecosystems. **Francois Driessen:** Right. And that’s in this brain-muscle configuration, that the muscle lives at the edge of whatever perimeter, whether that is inside the operating system of a device, or if it’s deployed on the network edge, or it could be a node in the cloud, or it could be forced onto assets with an always-on tunnel, or an access point network through cellular, or anything like that, right? But you have that muscle, which is distributed, it’s on each of these edges, and then you have your central brain. **David Redekop:** That’s right. **David Redekop:** Okay. And then the net result of that… The net result of that is that you can actually have an environment that allows for that decentralized custodial protection to happen at high performance, at high scalability, without reliance on your particular cloud to funnel everything through. **Francois Driessen:** And now suddenly you don’t actually need any endpoint software. So it is applicable to any IoT device or PLC or whatever. If it connects somewhere, it can actually protect it, cuz it’s not reliant on the operating system necessarily of the device. **David Redekop:** Right. And there’s also one other very important element here, which is that the muscle, because it’s a gateway, is a highly trusted interface to endpoints. And so therefore we can get really, really good information even if the endpoint is firewalled, like what the device name is, what the MAC address is, where it’s trying to go to, right? And be able to identify the device beyond the typical network scouring devices that look to scan the entire network to see what’s around. Most devices now that are modern are already firewalled, especially Windows, Mac, the new iOS, the new Android. So a scouring device can see very little, but the gateway can. And so that automatic inventorying is a really important component. **Francois Driessen:** Yeah. And of course all of these elements of this tech, I think it’s important just to say that it’s licensable. So if someone just wants to use the Don’t Talk To Strangers portion, or they just want to use the Zero Trust Connectivity with the ZTc adaptive allowance, these things are licensable. They don’t have to displace what you currently have. It can augment what you currently have. And that is another thing that I think is very, very important to just mention. ### ZTc consequence **Francois Driessen:** But let’s get to the most important part, okay? We spoke a lot about technology and philosophy of technology, but the most important part for me is how does this actually affect humans, okay? If the technology doesn’t make someone’s life better, if it doesn’t make them more secure, you know, what’s the purpose, right? **David Redekop:** Exactly. **Francois Driessen:** So, what are the consequences of effectively implementing Zero Trust Connectivity? And I’ll just answer what we have found with applying this through adam:ONE. So, first of all, right off the bat, is this idea of a BrightWeb™, okay? Where every organization has their own version of the internet. You get to press reset on the internet for your organization and you build dynamically where you can go. You’re essentially creating zero trust of the internet, okay? Without them authenticating between you and being in the same zero trust club as you, or being behind the same bottleneck proxy, or anything like that, right? You get to build your own version of the internet. That means any new threat that you don’t want to be part of your version of the internet is simply not part of it as you build it. If you properly build this, if all of the processes are running, right? It is a new version of the internet unique to every node, okay? And that is huge. **David Redekop:** Absolutely. Another really important consequence is that your attack surface is being reduced by a factor of 7,000 to 1. **Francois Driessen:** At least. **David Redekop:** At least that. **Francois Driessen:** Right. **David Redekop:** This comes from a real-life application of organizations of 50,000 or more employees. So, it’s a very large sample size, that it only needs about 15,000 domains out of the billion known that are out there. And that’s how the 7,000 to one aspect ratio… **Francois Driessen:** So let’s say that all domains out of those known domains that are there are all good, okay? So, just surface area, 7,000 to one reduction. But if you think about it, that 83% of new domains we know are for malicious intent, or whatever that number is today, then that number of actual protection of your attack surface is just so much, it’s exponentially more, right? **David Redekop:** Right. **Francois Driessen:** And then C2 attacks. **Francois Driessen:** That’s right. Just go silent, like radio silence to the C2 attackers. **David Redekop:** The bad robot’s already in your network. This is really important to stress, that the radio silence to the C2 attackers, even the ones that are not yet known. **David Redekop:** Absolutely. Because command and control operators in their attack chain at some point always use an IP address without a DNS name. **Francois Driessen:** Okay. **David Redekop:** And that’s why it’s very difficult for those in the traditional what sense to be not only detected, but then protected from. But with the consequence of zero trust, those are then actually blocked. **Francois Driessen:** And I think that Pegasus FORCEDENTRY… **David Redekop:** Yes. **Francois Driessen:** …Solorigate, these are very, very good examples that properly configured adam:ONE nodes, and clients that were behind these nodes, were immune to these attacks… **David Redekop:** Mhm. **Francois Driessen:** …before we knew that these vulnerabilities existed, just simply because you are properly managing the connections. **David Redekop:** Yeah. **Francois Driessen:** And that, I think, is… I mean, we can really stop the discussion right there. We can have all of these philosophical discussions and whatnot. This is practical. This is working. **Francois Driessen:** That’s right. And so this is something that we believe needs to be looked at seriously by any organization that wants to be protected. And that same mechanism also prevents data exfiltration. **Francois Driessen:** Of course. And… **David Redekop:** Right. In many cases threats are only identified after a leakage has occurred. **Francois Driessen:** Right. And what you really want is… your IP is already out there. **David Redekop:** Right. **Francois Driessen:** Your data is already out there for it. So never mind, you know, you being crypto-locked, but your data is out there being auctioned again and again and again for the best paying customers. And there’s no way that you’re going to get that back. **David Redekop:** Right. **Francois Driessen:** Right? So… And the next thing is the human factor. And to me this is really very important. Phishing vectors become almost useless in this environment. **David Redekop:** That’s right. **Francois Driessen:** Because whatever… And by the way, if we think of this on the reactive approach, the old way, this is why phishing is still a thing. Because with IPv6, there’s enough addresses to attack every person on the planet apparently 47 octillion times. That’s more zeros than I can write or count without my hand getting a cramp, okay? So you can actually spear phish every person on the planet 47 octillion times without using a single IP address twice. So let that go into the threat intelligence. Who cares? They just use a new one. **David Redekop:** That’s right. **Francois Driessen:** So with phishing, that domain or that IP, whatever that connection is that is being attempted there, just simply won’t work. **David Redekop:** Right. **Francois Driessen:** It’s not part of your BrightWeb, of your zero trust BrightWeb. **David Redekop:** Right. That’s right. Yeah. And at the same time, another consequence is that your shadow IT gets exposed, and that’s what makes it easy to clean up. **David Redekop:** Sure. Right? Half the time the reason it’s called shadow is because we don’t see it. **David Redekop:** Right. **David Redekop:** But, the moment you apply Zero Trust Connectivity, you see all of it. Nothing can hide. **David Redekop:** That’s right. **Francois Driessen:** Especially if you say, you know, no connections until they’re verified good. **David Redekop:** Right. **Francois Driessen:** Suddenly, Dropbox shows up, and Google Drive shows up, and whatever services that maybe were not sanctioned. They were in the shadows, but suddenly they’re all exposed. And I think that is actually going to make a lot of people’s lives a lot easier. **David Redekop:** Right. **Francois Driessen:** Especially with remote work and having satellite offices and so forth, right? **David Redekop:** I’ll give you one example right now. A typical IT manager, ask him how many IP devices do you have on your network, right? They’ll say 30. **David Redekop:** Right. **David Redekop:** It’s always three times. The moment you put in Zero Trust Connectivity, you see it’s 90, not 30. **David Redekop:** Right. It’s crazy. **Francois Driessen:** Yeah. And another big value, I think, is circumvention protection. And I’m not just talking here about willful employees or members of your organization, or any assets that are choosing to willfully bypass for whatever reason they might have. There’s also the malicious actor. **David Redekop:** That’s right. **Francois Driessen:** Okay? What’s the purpose of putting a door or a wall in place if you can just run around it? And that’s really where this whole zero trust thing came from, is that whatever was done in the past, you could just simply jump over it. **David Redekop:** That’s right. **Francois Driessen:** Okay? And then, of course, privacy. Because you do not need to break encryption. **David Redekop:** Mhm. **Francois Driessen:** Okay? Normally, you have privacy, you have security and content protection. If those are the things that you’re protecting for, these things generally fight against each other. The more private you want to get, the more you lose on the content protection, the more you lose on the security in some instances. But there is actually a way, you know, in adam:ONE, that these three things can actually exist in balance. And within the center of those, you can actually have a productive zero trust connected network, right? **David Redekop:** And that’s what leads to higher productivity, both from a technology point of view as well as a human point of view. Living in a zero trust world, there’s less traffic now on your network, right? There’s less to pay attention to. **Francois Driessen:** That’s only do you send to cater what you actually want. None of the noise that used to be there. **David Redekop:** In fact, if you have a security operations center, they’re likely going to be playing solitaire or twiddling their thumbs because there’ll be nothing to pay attention to, right? **David Redekop:** Right. Distributed custodial protection layer. The reason this is such an important consequence is that we have always wanted this, but then we kind of sacrificed the need and want for distributed and said, “Well, the only way we can do it is if we centralize it all in our cloud.” **Francois Driessen:** Centralized control, distributed performance, right? **David Redekop:** And so, this is where we are now: the control is still centralized, but everything in terms of the actual muscles, they are all distributed. So, you get the best of all worlds. You get one pane of glass. You get a central place of administration, but the actual protection happens in a distributed manner. ### Conclusion **Francois Driessen:** Yeah. The value of living in a digital world where everything that’s bad is outside, I think it’s actually hard to describe that. And this is the part where we really need to break into song. Don’t worry, we won’t. **David Redekop:** Thank you. **Francois Driessen:** We will definitely not do that, right? But just doing what everyone used to do faster, harder, stronger is not cutting it. Solorigate told us that. Pegasus told us that. You know, all of the breaches, just read the news, that told us lessons. And really stop being reactive and making a small adjustment here, and just take a full step back and say, “Design from first principles.” And that’s really what Zero Trust Connectivity is. A solution based on first principles that is practical and that actually works. **David Redekop:** That’s right. **Francois Driessen:** We’ll do some more videos that break out into every one of these, but I think in a nutshell this is a good introduction. **David Redekop:** That’s right. Thank you. **Francois Driessen:** Bye-bye. [Watch on YouTube](https://www.youtube.com/watch?v=i5DjoBfocwM) ## Related reading Announcements ### [ReflexAI completes adam:ONE with real-time allowlisting for default deny-all](https://adamnet.works/blog/reflex-ai-launch.md) March 18, 2025 Video ### [ZTc for OT and Critical Infrastructure Incident Response](https://adamnet.works/videos/ztc-ot-critical-infrastructure-incident-response.md) April 22, 2025 Video ### [Healing the Broken Philosophy That Keeps Hurting Healthcare](https://adamnet.works/videos/healing-broken-philosophy-healthcare-security.md) June 22, 2024 ## See it on your own network Zero Trust Connectivity reduces attack surface 7000:1 by denying egress by default. Talk to us about what that looks like in your environment. [Request a Demo](https://adamnet.works/contact.md) [How adam:ONE® Works](https://adamnet.works/how-it-works.md)