Cloud 101
Circle
Events
Blog

Working Group

Zero Trust

This group is working to raise awareness of best practices for operating secure Zero Trust architectures.
View Current Projects
CISO Perspectives and Progress in Deploying Zero Trust
CISO Perspectives and Progress in Deploying Zero Trust

Download

Working Group Overview

This working group aims to develop Zero Trust standards to achieve consistency for cloud, hybrid and mobile endpoint environments. The topic of group discourse include Zero Trust benefits, architecture, automation and maturity models, publication reviews, and relevant industry forums and events.

What do we discuss?

During our meetings, we typically discuss changes in the industry and collaborate on projects the group is currently working on. This group will have the following nine workstreams:

  1. Zero Trust as a Philosophy & Guiding Principles
  2. Zero Trust Organizational Strategy & Governance
  3. Pillar: Identity
  4. Pillar: Device
  5. Pillar: Network/Environment
  6. Pillar: Applications & Workload
  7. Pillar: Data
  8. Automation, Orchestration, Visibility & Analytics
  9. Zero Trust Architecture, Implementation, and Maturity Model

We welcome anyone who would like to join, even if you would like to just listen in on any calls. Interest in participation can be submitted to [email protected] describing your interests and expertise.


Drafts & Important Docs

Working Group Leadership

Daniele Catteddu
Daniele Catteddu

Daniele Catteddu

Chief Technology Officer, CSA

Daniele Catteddu is an information security and risk management practitioner, technologies expert and privacy evangelist with over 15 of experience. He worked in several senior roles both in the private and public sector. He is member of various national and international security expert groups and committees on cyber-security and privacy, keynote speaker at several conferences and author of numerous studies and papers on risk management, ...

Read more

Erik Johnson
Erik Johnson

Erik Johnson

Cloud Security Specialist & Senior Research Analyst

Worked for the Federal Reserve for many years and volunteered with the CSA with a focus on CCM/CAIQ V4, specifically the STA domain, and developing a comprehensive framework and guidance for defining and managing the cloud shared security responsibility model (SSRM).

I recently retired from the Federal Reserve and am now consulting with the CSA as a Senior Research Analyst with a focus on Zero Trust and Financial Services.

Linke...

Read more

John Yeoh
John Yeoh

John Yeoh

Global Vice President of Research, CSA

With over 15 years of experience in research and technology, John excels at executive-level leadership, relationship management, and strategy development. He is a published author, technologist, and researcher with areas of expertise in cybersecurity, cloud computing, information security, and next generation technology (IoT, Big Data, SecaaS, Quantum). John specializes in risk management, third party assessment, GRC, data protection, incid...

Read more

Working Group Co-Chairs

Jerry Chapman
Jerry Chapman

Jerry Chapman

Engineering Fellow

With over 25 years of industry experience, Jerry has successfully guided numerous clients in the design and implementation of their enterprise IAM strategies, in ways that align with both security and business objectives. His job roles have spanned enterprise architecture, solution engineering, and software architecture and development. Jerry is a co-author of “Zero Trust Security: An Enterprise Guide”.

Read more

Jason Garbis
Jason Garbis

Jason Garbis

Chief Product Officer of Appgate, Inc.

Jason Garbis is Chief Product Officer for Appgate, responsible for the company’s security product strategy and product management, and co-chair of the SDP Zero Trust Working Group at the Cloud Security Alliance, where he helps lead research and publication initiatives. He has over 30 years of product management, engineering and consulting experience at security and technology firms, including RSA, where he focused on identity management and...

Read more

Chris Steffen
Chris Steffen

Chris Steffen

Managing Research Director

Chris is the director of information security/risk and compliance management for a technology industry analyst and consulting firm. He is an industry thought leader and has presented at numerous industry conferences and has been interviewed by multiple media sources. He holds over a dozen technical certifications, including CISSP and CISA.

Read more

Publications in ReviewOpen Until
Security Guidance for Critical Areas of Focus in Cloud Computing v5 - OutlineMar 31, 2023
View all
Who can join?

Anyone can join a working group, whether you have years of experience or want to just participate as a fly on the wall.

What is the time commitment?

The time commitment for this group varies depending on the project. You can spend a 15 minutes helping review a publication that's nearly finished or help author a publication from start to finish.

Virtual Meetings

Attend our next meeting. You can just listen in to decide if this group is a good for you or you can choose to actively participate. During these calls we discuss current projects, and well as share ideas for new projects. This is a good way to meet the other members of the group. You can view all research meetings here.

No scheduled meetings for this working group in the next 60 days.

See Full Calendar for this Working Group

Open Peer Reviews

Peer reviews allow security professionals from around the world to provide feedback on CSA research before it is published.

Learn how to participate in a peer review here.

Security Guidance for Critical Areas of Focus in Cloud Computing v5 - Outline

Open Until: 03/31/2023

The proposed outline for the Cloud Security Alliance Security Guidance for Critical Areas of Focus in Cloud Computing v5 is...

Zero Trust Working Group Sponsors

Organizations show their commitment to building awareness and understanding of zero trust principles when they become a Zero Trust Champion for CSA. Sponsor organizations demonstrate thought leadership in providing relevant security solutions for the next generation of IT-cloud computing.