When it comes to security, the mantra to live by is “Trust No One.” It’s an essential policy in a business environment where data is money, the workforce is dispersed, encrypted ransomware attacks have risen by 500%, and traditional “moat and castle” security measures just don’t work.

“Thirty percent of malware [is] delivered through trusted apps such as file sharing and collaboration tools. And, so ultimately, the largest risk is lateral movement inside of the corporate networks,” said Ward Holloway (pictured), director of technology alliances at Zscaler Inc.

Holloway spoke with Lisa Martin, host of theCUBE, SiliconANGLE Media’s livestreaming studio, during last month’s Splunk .conf21 Virtual event. They discussed how Zscaler and Splunk Inc. are working together to provide businesses with zero-trust security to safeguard their data in the hybrid world. (* Disclosure below.)

Zero trust requires restricting access, minimizing the attack surface and monitoring pass-through

Zscaler is known for delivering security as a service, with its cloud native Zero Trust Exchange securing and intelligently routing enterprise traffic. Teaming up with Splunk, which provides observability and accessibility through its Data-to-Everything Platform, the company has created a simpler way for enterprise to achieve zero-trust security across their network and organizational ecosystems.

True zero trust incorporates three aspects, according to Holloway. First is zero network access, which limits lateral movement by restricting access to only the specific application required. Holloway describes this as “the difference between letting a guest in your office wander around your headquarters unescorted versus escorting a guest to a meeting room and then escorting them out once the meeting is over.”

Second is the ability to create a zero attack surface. Zscaler achieves this by making sure internal systems aren’t exposed on the open internet. “If they can’t find your application, they can’t attack,” Holloway said.

The third aspect is zero pass-through, which requires making sure that all connections are secure from threats and data loss and that access is only allowed based on the context of the data itself. Instead of going through a pass-through connection, Zscaler’s Zero Trust Exchange uses a proxy architecture that holds the data, inspects it, and then makes a verdict before allowing it to pass.

Together, Zscaler and Splunk are “providing our customers deeper insights through zero-trust analytics and orchestration,” Holloway stated. “Our integrated solution protects enterprises from threat campaigns, reduces security operations’ burdens through automation, and provides our customers with actionable data much faster than they can do on their own.”

Watch the complete video interview below, and be sure to check out more of SiliconANGLE’s and theCUBE’s coverage of during the Splunk .conf21 Virtual event. (* Disclosure: TheCUBE is a paid media partner for Splunk’s .conf21 Virtual conference. Neither Splunk Inc., the sponsor for theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE