Hi, I'm Patrick, and I'm going to talk to you about network security models. Traditional approaches to network security design are based on what is called a perimeter-based model. Although still relevant, perimeter-based security alone isn't sufficient in today's modern computing environment. A zero trust model enhances the perimeter-based security model by implementing important security concepts such as positive control, least privilege, and segmentation. Perimeter-based network security models date back to the early mainframe era, circa the late 1950s. When large mainframe computers were located in physically secure machine rooms that could only be accessed by a relatively limited number remote job entry, or RJE. Or dumb terminals directly connected to the mainframe in the same room, or nearby physically secure areas. Think Tom Cruise in Mission Impossible, except the room and terminals are nowhere near as cool. Today's data centers are the modern equivalent of machine rooms. But perimeter-based physical security is no longer sufficient for several obvious but important reasons. First, mainframe computers predate the Internet. In fact, mainframe computers predate Arpanet, which predates the Internet. Perimeter-based security worked well because there was no remote access. Remember in the movie War Games, Matthew Broderick's character was able to remote access a mainframe with a modem and a phone line. Today an attacker uses the Internet to remotely gain access rather than physically breaching the data center perimeter. Second, data centers today are remotely accessed by literally millions of remote endpoint devices from anywhere and at any time. Unlike the RJEs of the mainframe era, modern endpoints, including mobile devices, are far more powerful than many of the early mainframe computers, and are targets themselves. Finally, the primary value of the mainframe computer was its processing power. The relatively limited data produced was typically stored on near line media, such as tape. Today, data is the target and it is stored online in data centers and the cloud, and is a high value for any attacker. The primary issue with the perimeters centric network security strategy. In which countermeasures are deployed with a handful of well-defined ingress and egress point to the network. Is it relies on the assumption everything on the internal network can be trusted. However, this assumption is no longer safe given modern business business conditions and computing environments. Where remote employees, mobile users, and cloud computing solutions blur the distinction between internal and external. For instance, wireless technologies, the proliferation of partner connections, and the need to support guest users introduced countless additional pathways into the network. Including branch offices that may be located in untrusted countries or regions. And insiders, whether intentionally malicious or just careless, may present a very real security threat. Perimeter-based approach strategies fail to account for the potential for sophisticated cyber threats to penetrate perimeter defenses. Which would allow free passes on the internal network once the only existing defense was breached. Scenarios where malicious users are able to gain access to the internal network and sensitive resources by using the stolen credentials of trusted users. And the reality, internal networks are really homogenous. But instead include pockets of users and resources with inherently differently levels of trust or sensitivity and should ideally be separated. For example, research and development financial systems vs print and file servers.