Project Zero Trust

Appendix AZero Trust Design Principles and Methodology

The Four Zero Trust Design Principles

1. Define business outcomes: Ask the question “What is the business trying to achieve?” This aligns Zero Trust to the grand strategic outcomes of the organization and makes cybersecurity a business enabler instead of the business inhibitor that it is often seen as today.
2. Design from the inside out: Start with the data, applications, assets, and services (DAAS) elements and the protect surfaces that need protection and design outward from there.
3. Determine who or what needs access: Determine who needs to have access to a resource in order to get their job done. It is very common to give too many users too much access to sensitive data for no business reason.
4. Inspect and log all traffic: All traffic going to and from a protect surface must be inspected and logged for malicious content and unauthorized activity, up through Layer 7.

The Five-Step Zero Trust Design Methodology

1. Define the protect surface: Identify the DAAS elements: data, applications, assets, and services, that you want to protect.
2. Map the transaction flows: Zero Trust is a system, and in order to secure the system, understanding how the network works is imperative to a successful Zero Trust deployment. The mapping of the transaction flows to and from the protect surface shows how various DAAS components interact with other resources on your network and, therefore, where to place the proper controls. The way traffic moves ...