Step 5: Monitor and Maintain the Zero Trust Environment - Operating an Enterprise Zero Trust Environment

Zero Trust has emerged as a paradigm shift in cybersecurity strategy, advocating a "never trust, always verify" approach. The objective of this document is to provide guidance for iteratively executing the fifth step in the five-step Zero Trust implementation process described in the NSTAC Report to the President on Zero Trust and Trusted Identity Management, originally formulated and socialized by John Kindervag. Separate CSA research documents are being developed to elaborate detailed guidance for each of the five steps. The preceding four steps are Defining the Protect Surface, Mapping the Transaction Flows, Building the Zero Trust Architecture, and Creating Zero Trust Policies. Monitoring and maintaining a secure, production technology environment is critical in today’s rapidly evolving threat landscape. This requires broad, full stack operational visibility, analytics to detect breaches, and automation and orchestration to investigate and restore secure operations in the event of breaches. Monitoring and maintaining the network should not be construed literally to focus on just the network layer, as environments are composed of the entire technology stack, including all the Data, Applications, Assets and Services (DAAS elements) comprising the organizations’ business systems (protect surfaces). The process of monitoring and maintaining the technology environment is key to operational resilience, including the ability to adapt to an ever changing threat landscape. Monitoring provides visibility to the inner workings, analytics helps identify deviations and anomalies across the technical stack and the supply chain. Zero Trust automation and orchestration provides methods to identify and remediate deviations, anomalies and breaches. Organizations must respond to new threats and securely manage changes to their environment. The Zero Trust journey includes incrementally climbing the maturity model ladder over time in support of business objectives, while iteratively executing and refining Zero Trust processes for new and existing protect surfaces accordingly.

Key Takeaways

• Zero Trust has emerged as a paradigm shift in cybersecurity strategy, advocating a "never trust, always verify" approach. The objective of this document is to provide guidance for iteratively executing the fifth step in the five-step Zero Trust implementation process described in the NSTAC Report to the President on Zero Trust and Trusted Identity Management, originally formulated and socialized by John Kindervag. Separate CSA research documents are being developed to elaborate detailed guidance for each of the five steps. The preceding four steps are Defining the Protect Surface, Mapping the Transaction Flows, Building the Zero Trust Architecture, and Creating Zero Trust Policies.
• Monitoring and maintaining a secure, production technology environment is critical in today’s rapidly evolving threat landscape. This requires broad, full stack operational visibility, analytics to detect breaches, and automation and orchestration to investigate and restore secure operations in the event of breaches. Monitoring and maintaining the network should not be construed literally to focus on just the network layer, as environments are composed of the entire technology stack, including all the Data, Applications, Assets and Services (DAAS elements) comprising the organizations’ business systems (protect surfaces).
• The process of monitoring and maintaining the technology environment is key to operational resilience, including the ability to adapt to an ever changing threat landscape. Monitoring provides visibility to the inner workings, analytics helps identify deviations and anomalies across the technical stack and the supply chain. Zero Trust automation and orchestration provides methods to identify and remediate deviations, anomalies and breaches.
• Organizations must respond to new threats and securely manage changes to their environment. The Zero Trust journey includes incrementally climbing the maturity model ladder over time in support of business objectives, while iteratively executing and refining Zero Trust processes for new and existing protect surfaces accordingly.