Zero Trust Resource Hub

This is the keynote address from the founder of Zero Trust. It provides a good high-level overview of Zero Trust architecture principles, strategy, and a five-step implementation methodology.   

The US ZT Strategy and the US Office of Management and Budget's Zero Trust Strategy Press Release have been issued in response to the Executive Order on Improving the Nation’s Cybersecurity. 

Zero Trust solutions are critical to meeting the mandates in President Biden’s Executive Order on Improving the Nation’s Cybersecurity. The implications of a diverse solutions landscape and challenges to deliver a Zero Trust Architecture (ZTA) are explored in this paper. 

Directional executive order from the White House for improving the US cybersecurity posture. The press release for the EO can be found here.   

This document is being provided by Cloud Security Alliance. 

Zero Trust Security uniquely covers the breadth of enterprise security and IT architectures, providing substantive architectural guidance and technical analysis with the goal of accelerating your organization‘s journey to Zero Trust. 

The US Department of Defense ZT Reference Architecture is a key CSA ZT source document that describes ZT standards and capabilities. ZT is a security strategy and framework that embeds security throughout the architecture to prevent unauthorized access. It provides zones for visibility and positions mechanisms throughout the architecture to secure, manage and monitor every device, user, application, and transaction. 

A foundational tenet of ZT is that no internal or external actor, system, network, or service is trusted. Instead, we must verify anything and everything attempting to establish access. It is a dramatic paradigm shift in how we secure infrastructure, networks, and data.

NSA cybersecurity guidance explains the Zero Trust security model and its benefits, as well as challenges for implementation. It discusses the importance of building a detailed strategy, dedicating the necessary resources, maturing the implementation, and fully committing to the Zero Trust model to achieve the desired results. The following recommendations will assist cybersecurity leaders, enterprise network owners, and administrators who are considering embracing this modern cybersecurity model.

This report addresses the technical, social, policy, and regulatory issues associated with creating trust frameworks in a Zero Trust world. Industry and government are called to solve issues in ways that continue to protect the right to user privacy. 

The US National Institute of Standards and Technology (NIST) Zero Trust Architecture (ZTA) document describes ZT for enterprise security architects. It is meant to aid understanding of ZTA and provide an enterprise implementation roadmap for zero trust security concepts. Cybersecurity managers and network administrators may also gain ZTA insight from IT. It is not intended to be a single deployment plan for ZTA as enterprises will have unique business use cases and data assets to safeguard. Starting with a solid understanding of the organization’s business and data will result in a strong approach to zero trust. 

Zero Trust using Software-Defined Perimeter principles allows organizations to defend new variations of old attack methods in perimeter-centric networking models. This paper will show how SDP can be used to implement ZTNs and why SDP is applied to network connectivity. 

The CSA Software Defined Perimeter (SDP) Architecture Guide is designed to leverage proven, standards-based components to stop network attacks against application infrastructure. The architecture guide will help increase awareness and adoption of SDP and ZT, improve understanding of how SDP can be used in different environments, and help enterprises successfully deploy SDP solutions and ZT architecture recommendations. 

The US Department of Defense Acquisition University's Cybersecurity Channel includes recordings of the entire  4/4-5/23 DoD ZT Symposium that the DOD hosted virtually in collaboration with the CSA and MIT Lincoln Labs. John Kindervag's session is on Day 1 and CSA CTO and Industry Panel sessions are on Day 2.

This guidance is aimed at those implementing a zero trust architecture in an enterprise environment - this includes public and private sectors.

The principles within this guidance will help you design and review a zero trust architecture that meets your organization's individual requirements.

There are many vendors and open source offerings providing zero trust based services. These principles will help you select which combination of services can best support your journey to zero trust.