![\"\"](\"https:\/\/dtasiagroup.com\/wp-content\/uploads\/2022\/10\/gaw.jpg\")
<\/p>\nWhen we look at Zero Trust, it helps to take a step back. The internet is flooded with articles, hot takes, and it\u2019s all too easy to get caught up in the hype. We run the risk of going too fast and missing important fundamentals. There\u2019s an airplane analogy — in turbulence, a rookie pilot might be tempted to speed up and get through the storm quickly. That, however, will lead to instability and further risk of peril. The more experienced pilot cuts all that is unnecessary, slows down, and stabilizes the aircraft.<\/p>\n
<\/p>\n
That\u2019s what we need to do with Zero Trust: look before we leap, prioritize alignment and consistency, and avoid the hype. We\u2019re developing the security architecture that will underpin our organizations as they plant their flag in the digital revolution. As threats increase and margins of error decrease, doing it right the first time will make a big competitive difference in the future.<\/p>\n
Zero Trust is confusing<\/b><\/strong><\/p>\n Zero Trust can often engender confusion. We struggle to find consensus on what exactly Zero Trust is, whose definition to use, what\u00a0exactly\u00a0it entails, or who\u2019s doing it right. It\u2019s a bit of a “throw spaghetti at the wall” deal and we\u2019re hoping things stick.<\/p>\n As security practitioners, we heed the temptation to rush towards the “new\u00a0new thing” and can forego the necessary internal strategy discussions first. You don\u2019t know how to get where you\u2019re going without a map, so start there. Next there\u2019s the sprawl. No perimeter means boundless options for securing an even more overwhelming number of vectors. And we\u2019re supposed to secure all that to the Nth degree?<\/p>\n If this is possible to\u00a0any\u00a0degree, it will require a paradigm shift. And that precipitates a return to basics.<\/p>\n Prepare<\/b><\/strong><\/p>\n To push through an organization-wide initiative that will affect the day-to-day work of all departments in IT, security, and operations, you need to have all the right people on board. That\u2019s why alignment is not an option, it\u2019s a bare minimum. Create a core team of key players that are “restless for better”, taken from the ranks of Ops, Red Teams, Blue Teams, and IT infrastructure, among others.<\/p>\n Next, establish a solid understanding of Zero Trust within that group. It\u2019s fine to take a while on this step — this will lay the groundwork for all the others, so dig into the data. Learn about Zero Trust architecture, the recommendations and frameworks, and establish a plan of how you\u2019re going to apply the data to your organization. Here\u2019s a great set of foundational resources I\u2019d recommend you and your team start with:<\/p>\n Once you\u2019ve familiarized yourself with the literature, it\u2019s time to start. Take a methodical approach to Zero Trust adoption, and you\u2019ll find your changes “stick” — not only in the architecture, but with those who are going to implement, use and maintain it.<\/p>\n Categorize<\/b><\/strong><\/p>\n What would happen if Asset X was compromised? What about from there? That will guide your priorities. And remember, when categorizing your assets and their respective values, simple is best.<\/p>\n Select<\/b><\/strong><\/p>\n It\u2019s the survival of the most important. Once you\u2019ve categorized it into “my business couldn\u2019t live without\u00a0this” and on downward from there, you establish your protection surface. Draw a line around those key assets and secure them first. Pick your top ten to work on, then start on your top three. Yes —\u00a0only\u00a0the top three.<\/p>\n Implement<\/b><\/strong><\/p>\n This is the ops stage. Look around now and determine what you have in terms of resources, and what you still need. Find a handful of great partners and services then build out your strategy from there. Lean on your core team. Remember when you pulled them from all different parts of IT? This is where they really shine, taking ownership over their own individual specialties and making sure the Zero Trust architecture there is implemented with accuracy, completeness, and compliance. Don\u2019t reinvent the wheel between departments; try to stick with consistent policies across the board.<\/p>\n\n