Editorial content. Not sponsored and not written by a vendor.
Definition
NIST SP 800-207 describes Zero Trust as an evolving set of principles that move defenses from static network perimeters to users, assets, and resources.
The CISA pillars
- Identity
- Devices
- Networks
- Applications and workloads
- Data
A practical starting point
- Enforce MFA everywhere
- Inventory devices and applications
- Replace broad network access with per-application access
Questions to ask about any Zero Trust initiative
- Which of the CISA pillars does this product cover, and which does it assume we already have?
- How does it integrate with our identity provider and MFA?
- What can we phase in first without disrupting how people work?
- How do we measure progress rather than take 'Zero Trust' on trust?