Zero Trust
I Really Don’t Trust You Anymore
by
Book Cover & Preview Text
Zero Trust has a foundation like all frameworks in both the business and technical specifications. Unlike other issues of the day, however, the existing investments that businesses have already made in cybersecurity is significant in terms of creating a Zero Trust platform. Interoperability will be one of the most significant issues to be considered and addressed. Security solutions, across hardware, software, and services, must not “block” the larger solution. There is always a concern about creating intellectual property, then having it in the public domain or otherwise compromised for more generic usage. If this becomes an issue for Zero Trust, the architecture will clearly be sub-optimized. The business issues that will ultimately define Zero Trust need to be addressed up front and agreed upon by a diverse set of stakeholders. Deciding what the “common good” is will be a challenge. The “goal posts” for the solution will constantly be moving since the cyberattacks will change and morph rapidly. The framework needs to be agile so that interoperability is not an inhibitor. As a reference point, health care has been at the vanguard of this issue. There are now rules, regulations, and guidance about “blocking”. Perhaps the same strategy can be applied to the Zero Trust framework. There needs to be a very compelling business case created for Zero Trust. The reasoning is really twofold. The first is to address the emotional issues that will be associated with Zero Trust and the second is the actual quantifiable business case. Both are requirements to successfully “sell” the solution to most organizations internally. From an emotional perspective, Zero Trust represents an “admission” of sorts that all of the investments to date in security are deficient in some manner. Many of the decision-makers for the myriad of security counter measures already in place will likely take issue with that premise that a new architecture might be required. Human nature being what it is, being defensive if the solution is not appropriately positioned could create an issue to be addressed. To be clear, Zero Trust is a response to the developing and future issues of how the bad actors will continue to attack our organizations. It is not suggesting that they have won or that we are not on top of security. We are in front to the degree of what we can identify and deflect. Zero Trust is that next line of defense.
Formats
Book Details
About the Book
Many of the security counter measures being leveraged by businesses today simply address the past (trust then verify). These tools advise and protect when issues are detected, then the problems can be addressed. There is often a time lag from identification, addressing the issues, and resolving the actual issues. To understand the overall state of security in an organization there are a considerable number of tools required. For the most part, each of these tools have an application agent to be deployed. The result is often a “one of everything” approach. Zero Trust is a framework not a solution. Zero Trust is a part of an ongoing continuous process improvement plan, and should evolve with the times to deliver true security to an organization. The common thread is the ability to identify known vectors of end user satisfaction or organizational risk to address issues. The comment about “known” vectors is the key - security counter measures can only respond to what is known and understood at a particular moment in time. Risk is a very straightforward concept. Risk is either real or not. Closed Loop Lifecycle Planning© in its research called The Risk Cycle© concluded that risk does not have a “gray” area - something is either a risk or not. Our book has challenged the assumption that there is such a thing as “reasonable risk”. The theory of reasonable risk is that businesses and organizations make a conscious decision that a risk is reasonable to take, and then accepts the exposure. Zero Trust would argue that the approach itself is not reasonable.
About the Author
Bruce Michelson Bruce Michelson is an HP Distinguished Technologist (Emeritus) and the Manager of Close Loop LLC. Bruce has over 36+ years in delivering industry white papers and customer engagements. Bruce’s White Papers total over 1,000+ and engagements total over 350+. Bruce is the author of 7 books covering lifecycle management and user segmentation, among other topics. Bruce has numerous copyrights and patents regarding his expertise including Closed Loop Lifecycle Planning©, User Segmentation©, Cost of Change©, Appropriate Incumbent Behavior© The Ready State©, and other intellectual property. Bruce is currently adjunct instructor at Florida Atlantic University in Boca Raton, Florida, where he teaches Health Care IT and Advanced Systems and Design. Cody Gerhardt Cody Gerhardt is an HP Distinguished Technologist and Chief Technologist with over 16 years’ experience. Cody is a leader in security, manageability, modern workplace, cloud, and virtualization. Cody is well credentialed, and his expertise is in high demand across various industries. Cody has been certified by ICS2 as a Certified Information Systems Security Professional (CISSP). Cody has several published intellectual properties, pending patents and defensive publications including the Accelerated State©, teamed with Bruce. Cody works with customers on modern management adoption, security, cloud adoption, virtualization, operating system management, and persona development. Cody has published or co-published over 60+ industry white papers.