Cloud 101CircleEventsBlog
Join us for Cybersecurity Awareness Month! Strengthen your cyber resilience with essential security tips and resources for everyone.

Download Publication

Defining the Zero Trust Protect Surface
Defining the Zero Trust Protect Surface
Who it's for:
  • Zero Trust Architects and Implementation Teams
  • CISOs and other CxOs
  • Information Security Managers and Analysts
  • Privacy and Compliance Officers
  • IT Auditors and Assessors
  • Software Developers
  • Network Security Engineers

Defining the Zero Trust Protect Surface

Release Date: 03/05/2024

Working Group: Zero Trust

Enterprise adoption and implementation of Zero Trust is broad and growing. Venture Beat reports that 90% of organizations moving to the cloud are adopting a Zero Trust strategy, while Gartner predicts that 10% of large enterprises will have a mature and measurable Zero Trust security program in place by 2026. How is a mature Zero Trust program achieved? The NSTAC Report to the President on Zero Trust and Trusted Identity Management outlines a five-step process. 

This publication by the CSA Zero Trust Working Group provides guidance on iteratively executing the first step of the Zero Trust implementation process, “Defining the Protect Surface.” Defining the protect surface entails identifying, categorizing, and assessing an organization's data, applications, assets, and services (DAAS); business risk; and current security maturity. In this document, readers will find valuable guidance that starts their Zero Trust security journey on the right path.

Key Takeaways: 
  • The definition of Zero Trust and the Zero Trust protect surface
  • How to initiate the Zero Trust implementation process by defining, analyzing, and prioritizing the organization’s protect surfaces
  • How to identify the DAAS elements to be protected
  • The risks and potential impacts of protect surface compromises
  • The difference between the attack surface and the protect surface
Download this Resource

Bookmark
Share
Related resources
AI in Medical Research: Applications & Considerations
AI in Medical Research: Applications & Consider...
Don’t Panic! Getting Real about AI Governance
Don’t Panic! Getting Real about AI Governance
Zero Trust Guiding Principles v1.1
Zero Trust Guiding Principles v1.1
How to Maximize Alignment Between Security and Compliance Teams
How to Maximize Alignment Between Security and Compliance Teams
Published: 10/04/2024
Embracing AI in Cybersecurity: 6 Key Insights from CSA’s 2024 State of AI and Security Survey Report
Embracing AI in Cybersecurity: 6 Key Insights from CSA’s 2024 State...
Published: 10/04/2024
Secure by Design: Implementing Zero Trust Principles in Cloud-Native Architectures
Secure by Design: Implementing Zero Trust Principles in Cloud-Nativ...
Published: 10/03/2024
What ‘Passwordless’ Really Means for Privileged Access Management
What ‘Passwordless’ Really Means for Privileged Access Management
Published: 10/03/2024
Defending Against the Cloud Adversary: Detection and Response in the Cloud
Defending Against the Cloud Adversary: Detection and Response in th...
October 24 | Online
Achieve Zero Trust Identity with the new 7 A’s of IAM
Achieve Zero Trust Identity with the new 7 A’s of IAM
November 7 | Online

Acknowledgements

Erik Johnson
Erik Johnson
Cloud Security Specialist & Senior Research Analyst, CSA

Erik Johnson

Cloud Security Specialist & Senior Research Analyst, CSA

Worked for the Federal Reserve for many years and volunteered with the CSA with a focus on CCM/CAIQ V4, specifically the STA domain, and developing a comprehensive framework and guidance for defining and managing the cloud shared security responsibility model (SSRM).

I recently retired from the Federal Reserve and am now consulting with the CSA as a Senior Research Analyst with a focus on Zero Trust and Financial Services.

Linke...

Read more

Shamik Kacker Headshot Missing
Shamik Kacker

Shamik Kacker

Shruti Kulkarni
Shruti Kulkarni

Shruti Kulkarni

I am a security professional with experience across various domains of security. I work in defining organisation’s security strategy, security architecture and security practices. Translating business objectives and risk management strategies into specific security processes enabled by security technologies and services. I work on gap analysis, design, implementation and...

Read more

Krishna Narayanaswamy Headshot Missing
Krishna Narayanaswamy

Krishna Narayanaswamy

Michael Roza
Michael Roza
Risk, Audit, Control and Compliance Professional

Michael Roza

Risk, Audit, Control and Compliance Professional

Since 2012 Michael has contributed to over 100 CSA projects completed by CSA's Internet of Things, Zero Trust/Software-Defined Perimeter, Top Threats, Cloud Control Matrix, Containers/Microservices, DevSecOps, and other working groups. He has also served as co-chair of CSA's Enterprise Architecture, Top Threats, and Security-as-a-Service working groups while also serving as the Standards Liaison Officer for IoT, ICS, EA, SECaaS, and Cloud K...

Read more

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?

Related Certificates & Training