Security Weekly Podcast Network (Video) Clearing the Air on Zero Trust - Steven Turner - ESW #267
Cybersecurity buzzwords tend to go through a process. They're used as a differentiator. Then everyone adopts them and things get out of control. The term Zero Trust originally gained traction in InfoSec thanks to the model designed by John Kindervag during his time at Forrester. These days, you could be seeing the term Zero Trust because:
1. a vendor makes a product that fits into any one of dozens of categories that contribute to a Zero Trust architecture (IAM, MFA, ZTNA, micro segmentation, directory services, etc)
2. a vendor is using 'zero trust' as a metaphor (small z, small t)
3. a vendor is using 'zero trust' as a philosophy, or company principle (small z, small t)
4. the CMO said it needs to be somewhere on the website for SEO
5. someone told a founder to put it in the sales and/or pitch deck
Steve joins us to separate the cyber virtue signaling from the truth of what Zero Trust actually looks like, why it's difficult, and what impact federal interest in Zero Trust will have on this trend.
Segment Resources:
NIST SP 800-207
https://csrc.nist.gov/publications/detail/sp/800-207/final
UK NCSC ZT Guidance
https://github.com/ukncsc/zero-trust-architecture
USA CISA/OMB ZT Guidance
DOD ZT Reference Architecture
https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf
Microsoft ZT Guidance
https://docs.microsoft.com/en-us/security/zero-trust/
Visit https://www.securityweekly.com/esw for all the latest episodes!
Show Notes: https://securityweekly.com/esw267