topic Re: Zero Trust is coming - are you prepared? in Industry News

Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 09 Oct 2023 10:00:19 GMT

Hi All

An interesting piece by an Australian Technology Journalist, he has the right idea, but full of myths and half truths as usual.

https://ia.acs.org.au/content/ia/article/2021/zero-clue-about-zero-trust--.html?ref=newsletter

Regards

Caute_Cautim

Re: Zero Trust is coming - are your prepared?

mgorman — Tue, 12 Oct 2021 11:35:00 GMT

I think you are being generous, I couldn't find enough information in the article to identify myths or half truths. Everyone is jumping on the bandwagon, and the Zero Trust noise level is so high, it is hard for people who know the technology, the risks, etc. to make sense of the landscape, much less those at the edge.

Re: Zero Trust is coming - are your prepared?

AppDefects — Tue, 12 Oct 2021 15:13:57 GMT

(ISC)2 members have access to a Zero Trust express learning (approximately 2 hours in length). Check it out here: "Preparing for a Zero Trust Initiative".

Re: Zero Trust is coming - are your prepared?

Masahiro — Wed, 13 Oct 2021 09:08:15 GMT

I would like to say "don't be satisfied with implementing ZTA and completely throw VPN, active directory and something vulnerable away".

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Sun, 17 Oct 2021 19:52:41 GMT

@Masahiro Great thoughts I would also like to put forward an IBM Business Point of View on the subject with statistics. https://www.ibm.com/thought-leadership/institute-business-value/report/zero-trust-security

Download the article and give it a read for yourselves.

Regards

Caute_cautim

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Sun, 17 Oct 2021 19:52:22 GMT

@AppDefectsThanks I will test it out, and provide comments as a result.

Regards

Caute_cautim

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 06 Dec 2021 22:25:57 GMT

@mgorman Well ZTNA is a myth it is a construct invented by Gartner, and it only illustrates one Use Case, the protecting remote workers - there are currently about 43 Use Cases available.

The term ZTNA was never part of the original Zero Trust principles.

Rather like another well known vendor stating they have Trusted Access, if you cannot trust anyone, anything, how can you have trusted access?

Regards

Caute_Cautim

Re: Zero Trust is coming - are your prepared?

mgorman — Mon, 18 Oct 2021 10:19:51 GMT

I do not disagree, as I said, Zero Trust has become the latest buzz word to justify budgets and market products. It has also expanded the definitions over time. While I agree with you 100% that a gateway model is not Zero Trust, as you are then trusting the gateway, it has become commonly accepted, and is even noted in NIST work. At the same time we can say that ZTNA isn't real Zero Trust, that is an argument at almost any implementation level, because it is not a standard, it is not a given model, it is a set of principles and a goal. Like any other security layer, partially implementing Zero Trust principles may have beneficial effects, if done properly. As privacy regulation helped a lot of organizations clean up their data stores, perhaps Zero Trust will lead to better segmentation and permission management, at least for a while.

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 06 Dec 2021 22:26:40 GMT

@mgorman Thank you for your comments and wise words.

An interesting article popped up from the CSOonline, which spells out some of those myths iand misconceptions is shown below:

https://www.csoonline.com/article/3634395/6-zero-trust-myths-and-misconceptions.html#tk.rss_all

Regards

Caute_Cautim

Re: Zero Trust is coming - are your prepared?

mgorman — Mon, 18 Oct 2021 23:53:28 GMT

I think the best one is that this means you don't trust your employees. I have had this conversation several times recently about other controls. I trust our employees, generally, I don't trust whoever SAYS they are our employee, until they PROVE they are our employee. Once you get there in your head, Zero Trust becomes easy, you just have to ask that question over and over, and over. Who is this, and how do I KNOW that?

Re: Zero Trust is coming - are your prepared?

Caute_cautim — Wed, 27 Oct 2021 21:39:25 GMT

@mgorman I agree.

One way to look at it is to refer back to the famous story from Rudyard Kipling 1902 - The Elephants Child. One of the most famous lines is about the following:

"I Keep Six Honest Serving Men

I KEEP six honest serving-men
(They taught me all I knew);
Their names are What and Why and When
And How and Where and Who."

Ask those important questions What. Why, When, How, Where and Who every time will give you full context.

https://sergiocaredda.eu/inspiration/i-keep-six-honest-serving-men-a-poem-by-rudyard-kipling/

Regards

Caute_cautim

Re: Zero Trust is coming - are your prepared?

LiuHuasong — Wed, 03 Nov 2021 01:09:48 GMT

@Caute_cautim wrote:
@mgorman Well ZTNA is a myth it is a construct invented by Gartner, and it only illustrates one Use Case, the protecting remote workers - there are currently about 43 Use Cases available.

The term ZTNA was never part of the original Zero Trust principles.

Rather like another well known vendor stating they have Trusted Access, if you cannot trust anyone, anything, how can you have trusted access?

Regards

Caute_Cautim

"Zero Trust" is not a good term, think it literally and logically then it's just a BUZZ word.

We need Precise Trust or Fine Grained Trust or some clear term, then lead to "More Trust", not the "Zero Trust" confusion.

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 06 Dec 2021 22:28:33 GMT

@LiuHuasong I disagree, "Trust" by itself is just a term, which can be interpreted in many ways through legal such as "Trusts" as a concept. Trust by itself is a philosophical condition, both human and very open to misinterpretation.

But if you add terms such as Explicit Trust or Implicit Trust represents a scale as to the extent a human being feels, intuitively feeling safe or protected.

Zero Trust is not a buzz word - look at the original term invented by John Kindervag. It is an architecture hence the name Zero Trust Architecture, it is a framework, a concept, a construct,

https://www.youtube.com/watch?v=0GbqUxBYvyo

Go back to the original key resources including those from NIST and the released DoD Architecture framework, ignore the myths and misinterpretations.

Regards

Caute_cautim

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 06 Dec 2021 22:28:10 GMT

Hi All

I came across an interesting book, if you are interested in reading over Christmas:

https://www.amazon.com/Zero-Trust-Security-Enterprise-Guide/dp/148426701X#customerReviews

Also available on Kindle too:

Or if you have an organisation which allows you access to O'Reilly, there is also a link to it:

https://learning.oreilly.com/library/view/zero-trust-security/9781484267028/

I would be interested to see what people think of it and its approach.

Plus of course 8 hours plus of CPD's available too to booster up the certification.

Regards

Caute_Cautim

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 06 Dec 2021 22:28:54 GMT

@mgorman"John Kindervag, then an analyst at Forrester Research, in 2010 coined the phrase “Zero Trust” to describe the security model that organizations should not automatically trust anything outside or inside their perimeters, and instead must verify everything and anything before connecting them to their systems and granting access to their data."

The above s what is meant by Zero Trust not the re-interpretation, by many others. As stated previously always go back to the original source and verify for yourselves.

Regards

Caute_Cautim

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 06 Dec 2021 22:27:42 GMT

There is a great deal more interest in Zero Trust and Zero Trust Architect (ZTA):

For instance the National Cyber Security Centre (NCSC) for UK provided the start of this very interesting series of blogs, which you may find interesting:

https://www.ncsc.gov.uk/blog-post/zero-trust-is-it-right-for-me

https://publications.opengroup.org/g21f

The Zero Trust Commandments presented in this document build on the Zero Trust Core principles.

Those of you who are members of the Open Group, will have access to this document for review purposes.

Regards

Caute_Cautim

Re: Zero Trust is coming - are you prepared?

Caute_cautim — Mon, 06 Dec 2021 22:27:17 GMT

It appears that even 2022 predictions are now stating that Zero Trust Architecture and approach will lead to 144% increase in efficacy.

https://venturebeat.com/2021/11/26/report-zero-trust-architecture-is-expected-to-increase-cybersecurity-efficacy-by-144/

https://venturebeat.com/2021/06/26/7-keys-to-evaluating-zero-trust-security-frameworks/

Some interesting comments arising on the subject.

Regards

Caute_Cautim

Re: Zero Trust is coming - are your prepared?

csjohnng — Sun, 05 Dec 2021 18:00:09 GMT

interesting.. 144%

Re: Zero Trust is coming - are your prepared?

Caute_cautim — Wed, 05 Jan 2022 23:29:26 GMT

Hi All

To add to the reasons why we need to take on Zero Trust and fight Log4J, given it is likely to be with us for years!! Yes years, so buried and embedded this issue is without current systems:

https://www.cio.com/article/302868/why-the-log4j-vulnerability-makes-endpoint-visibility-and-zero-trust-security-more-important-than-ever.html

Regards

Caute_Cautim

Re: Zero Trust is coming - are you prepared?

CJM — Mon, 10 Jan 2022 11:18:56 GMT

Great article - credible sources and references.