The CCZT Program: Built for the Industry, By the Industry

The CSA Security Update podcast is hosted by John DiMaria, Director of Operations Excellence at CSA. The podcast explores the CSA STAR program, cloud security best practices, and associated technologies. In this blog series, we edit key podcast episodes into shorter Q&As.

Today’s post features Anna Schorr, Training Program Director at CSA. Anna and John discuss CSA's groundbreaking Certificate of Competence in Zero Trust (CCZT), the recipient of the 2024 Global InfoSec Award for Cutting-Edge Cybersecurity Training. Delve into the development of the CCZT and learn how it helps individuals and organizations enhance their cybersecurity strategies.

Listen to the full podcast episode here.

John DiMaria: Hello everyone and welcome to another episode of the CSA Security Update. CSA recently was the recipient of the 2024 Global InfoSec Award for Cutting-Edge Cybersecurity Training. This award acknowledges CSA's groundbreaking Certificate of Competence in Zero Trust, known as CCZT, the industry's first authoritative training and certificate program dedicated to Zero Trust architecture and best practices.

Today I have the honor of speaking with Anna Schorr, our Training Program Director at Cloud Security Alliance. Welcome, Anna,.

Anna Schorr: Thanks, John. I'm excited to be here and I appreciate you taking the time.

Introducing the CCZT

JD: Could you share with us some of the motivations behind the creation of the CCZT program and what goals CSA aims to achieve?

AS: Yeah, absolutely. There were a few motivations behind the creation of the CCZT program. Most notably, it was to address the evolving technology landscape with the increasing adoption of new technologies like cloud computing, edge computing, and IoT. This is only compounded by accelerated changes in org structures and policies due to remote work and contractors.

The traditional concept of perimeter security is no longer sufficient. Zero Trust architecture aims to address these challenges by creating virtual enclaves and operating on the principle of “never trust, always verify” before allowing access to resources. CSA's goal was to create a training program on Zero Trust to equip professionals with the knowledge and skills to effectively implement a Zero Trust strategy and move away from traditional perimeter security.

JD: Zero Trust is obviously a very hot topic. And as we know, when hot topics hit, everybody jumps on the bandwagon. There are lots of training programs out there. I see this award as a stamp that says, “yeah, there might be a lot out there. But this program is world class.” So what are some of the unique features of the CCZT that sets it apart from other similar programs?

AS: I think that's a great question, John. The CCZT program is unique for a couple of reasons. First, it’s the industry's first and most authoritative vendor-neutral Zero Trust training. We do rely on authoritative sources such as NIST, ISO, and CISA, to create the content. But it was also built with subject matter experts from across the globe. When it was all said and done, the CCZT was built and reviewed by hundreds of experts.

We also received a lot of guidance from leaders in Zero Trust. Notably John Kindervag, who has been quoted as one of the people who founded the concept of Zero Trust. He was an integral factor in the development of the CCZT program.

JD: That’s what I call “built for the industry, by the industry.”

Why Zero Trust?

JD: Zero Trust, to me, is something that’s kind of common sense. Why wouldn't you be doing this? Why is this a new thing? But in the cybersecurity landscape today, it's becoming more and more of a critical aspect. After working with all these volunteers and having these discussions, where do they see the broader implications of adopting Zero Trust? Why is this becoming such a critical aspect of cybersecurity?

AS: I agree. When I started on my journey with Zero Trust, it seemed pretty straightforward: “never trust, always verify.” But what does that actually mean and why is that so important?

In my opinion, and what I've heard from the volunteers, is that Zero Trust is really important because not only is it the future of cybersecurity, but personal data and intellectual property are often the most valuable assets for an organization. And given the proliferation, distribution, and dispersion of data; given the changing technology landscapes of cloud, remote workers, et cetera; this is putting that data at risk more than ever before. We have to change our approach.

Debating Zero Trust Principles

JD: Working with all these experts, I’m sure there was a lot of give-and-take about the challenges that organizations face. Debating the Zero Trust principles.

AS: Yes, there were a lot of heated discussions about best practices. And there was a lot of debate between what was realistic and what was best in theory.

Zero Trust is a cybersecurity theory, it’s a strategy. Zero Trust architecture is how you actually implement that strategy. So although a lot of it sounds great when you're talking about it, it's not always realistic when it comes to implementing it. When we got to the implementation section, that's where the conversations got a little bit more heated. What's actually realistic when it comes to implementing Zero Trust?

For example, one of the principles of Zero Trust is logging and monitoring. First you need to decide what you’re going to log, and you need to have an architecture that actually has good logging practices. But a common challenge is that legacy infrastructure is not built to have Zero Trust in mind.

Also, there is a need to drive a cultural shift within your organization when you’re moving to Zero Trust, which can be difficult. It might take some time. We actually cover that in our training, how it's a step-by-step process. And it's not always linear. Sometimes you're going to be going up, sometimes you're going to be lagging, and sometimes you're going to be going down, but it's something that you have to continually work on.

Learn More & Get Involved

AS: We actually have our study guide available to download for free so that anyone in the public can access it. If people just want to study for their own self-learning, they can do that. We also have research on Zero Trust. We already have a couple dozen research papers on Zero Trust that are all available to download for free. We also have training available in terms of self-paced learning and instructor-led training.

If there's anyone that would like to get involved, we'd love to have you. Please do reach out. Specifically with the CCZT project, I would suggest getting involved with the Zero Trust Working Group. Partway down the page is a big orange section that says “Want to join this working group?” Also, if you’re having any troubles navigating our site, you can always just send an email to our support team and we can get you in touch with the correct group.

Lastly, if you want to learn more about the CCZT, visit our CCZT page. There, you can learn more about the program, read testimonies, and see the contributors.

JD: These awards are not easy to come by. It truly is a milestone and a great accomplishment. I really appreciate you coming on. Thanks for some great insights.