Uploaded byEyesOpen Association
Zero Trust : How to Get Started
The document provides an overview of the zero trust security model, emphasizing the need for verification and protection in an evolving risk landscape. Key principles include strong authentication, dynamic policy enforcement, and the focus on securing data rather than trusting networks. Getting started involves identifying critical assets, governance, and implementing security controls across users, devices, and networks.
More Related Content
Similar to Zero Trust : How to Get Started
![[Round table] zeroing in on zero trust architecture](https://cdn.slidesharecdn.com/ss_thumbnails/roundtablezeroinginonzerotrustarchitecture-200323112004-thumbnail.jpg?width=640&height=640&fit=bounds)
Zero Trust : How to Get Started
- 2. 1.Overview of ZeroTrust 2.Why Does Zero Trust Matter? 3.Principles of Zero Trust 4.Getting Started 5.Conclusion PLAN
- 3. Trust: Human interactions areguided by the concept of trust Overview of Zero Trust
- 4.
- 5. Overview of ZeroTrust • “Zero Trust Model” was coined by Forrester Research analyst and thought-leader John Kindervag in 2010 • “never trust, always verify.” • based on the assumption that risk is an inherent factor both inside and outside the network.
- 6. Overview of ZeroTrust
- 7. 1.Overview of ZeroTrust 2.Why Does Zero Trust Matter? 3.Principles of Zero Trust 4.Getting Started 5.Conclusion PLAN
- 8. Why Does ZeroTrust Matter? • The human concept of boundaries or the perimeter • The evolving nature of risk and threats
- 9. Why Does ZeroTrust Matter? The human concept of boundaries or the perimeter
- 10. Why Does ZeroTrust Matter? The human concept of boundaries or the perimeter Change of tactics. Breach from the INSIDE!
- 11. Why Does ZeroTrust Matter? The evolving nature of risk and threats – LANDSCAPE SHIFT
- 12. Why Does ZeroTrust Matter? LANDSCAPE SHIFT – Information & Technology
- 13. Why Does ZeroTrust Matter? Business Challenges: Increased access, attack surface & gaps in visibility
- 14. 1.Overview of ZeroTrust 2.Why Does Zero Trust Matter? 3.Principles of Zero Trust 4.Getting Started 5.Conclusion PLAN
- 15. Principles of ZeroTrust Traditional Zero Trust Move away from • Assumptions • Implicit Trust Move towards • Strong authentication • Context • Explicit Trust
- 16. Principles of ZeroTrust Focuses on protection of data, not on attacks Assumes all environments are hostile and breached No access device until user + device is proven “trusted” Authorize and encrypt all transactions and flows All activity is logged
- 17. 7 Zero TrustFoundational Rules 1. All data sources and computing services are considered resources. 2. All communication is secured regardless of network location. 3. Access to individual enterprise resources is granted on a per-session basis. 4. Access to resources is determined by dynamic policy. 5. The enterprise monitors and measures the integrity and security posture of all owned and associated assets. 6. All resource authentication and authorization is dynamic and strictly enforced before access is allowed. 7. The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications, and uses it to improve its security posture. Source: NIST Special Publication (SP) 800-207 (2020), Zero Trust Architecture Principles of Zero Trust
- 18. Principles of ZeroTrust Source: NIST SP 800-207 ZERO TRUST ARCHITECTURE
- 19. Principles of ZeroTrust Types of Trust Algorithms • Criteria- versus score-based • Singular versus contextual”
- 20. Principles of ZeroTrust
- 21. 1.Overview of ZeroTrust 2.Why Does Zero Trust Matter? 3.Principles of Zero Trust 4.Getting Started 5.Conclusion PLAN
- 22. Getting Started • Whatare your ‘crown jewels’? • Where are they? • Who looks after them?
- 23.
- 24. Getting Started Users &Devices • MFA • Biometrics • PKI • IoT Apps & Data • Data Classification • DLP • Microservices • APIs • DevSecOps Networks • Microsegmentation • Cloud • SD-WAN • SASE
- 25. 1.Overview of ZeroTrust 2.Why Does Zero Trust Matter? 3.Principles of Zero Trust 4.Getting Started 5.Conclusion PLAN
- 26. Conclusion • The perimeterno longer exists • Identity and credentials are the new perimeter • Assume breach • Insiders carry the greatest risk – as targets and as threats • Start your Zero-Trust Initiative with Zero-Trust Thinking • Automate & Orchestrate your Security Policy
- 27. Call to Action Verify,then trust!
- 28. M E RC I ! T H A N K Y O U ! QUESTIONS ?
- 29. Resources Microsoft Assessment https://www.microsoft.com/en-ww/security/business/zero-trust/maturity-model-assessment-tool BeyondCorp: Google’sImplementation of Zero Trust https://cloud.google.com/beyondcorp