Map the Transaction Flows for Zero Trust
Released: 11/18/2024
The NSTAC Report to the President on Zero Trust defines five steps to implementing a Zero Trust security strategy. This publication provides guidance on executing the second step: mapping transaction flows for the protect surface. CSA is developing separate research documents to elaborate detailed guidance for each of the five steps. Explore Step 1, defining the protect surface, in our first publication.
The Zero Trust protect surface consists of Devices, Assets, Applications, and Services (DAAS). Mapping the transaction flows establishes granular visibility into communication between these elements, with other protect surfaces, and with users and external services. This helps you understand how the business system works before defining security policies in subsequent steps.
The mapping methods explored in this document include comprehensive system analysis and leveraging scanning tools. The document also delves into how these methods can help refine protect surfaces and design Zero Trust architectures. Additionally, it outlines the benefits of mapping transaction flows and provides a maturity model for evaluating the effectiveness of transaction flow mapping practices.
Navigate the complex task of understanding system architecture, transaction flows, and security maturity within the Zero Trust security model. Enhance your cybersecurity resilience and establish a foundation for enforcing an adaptive and robust security posture in your organization.
Key Takeaways:
- A review of Zero Trust strategy and the five-step Zero Trust implementation process
- How to validate the protect surface’s DAAS elements and refine their metadata
- How to identify and document users of the protect surface and the types of endpoint devices they use
- How to identify dependencies and transactions among DAAS elements, users, other business systems, and external services
- How to map data flows
- How to validate and refine the understanding of the relative sensitivity and security maturity of the system
- Specific considerations for cloud, OT, and IoT devices
- Challenges of mapping transaction flows
- Benefits of mapping transaction flows
Best For:
- Zero Trust implementation teams
- Security managers, architects, and analysts
- Business system owners
- CISOs
- Compliance officers
