book

Zero Trust Architecture

Name: Zero Trust Architecture
ISBN: 9780137899722

by Cindy Green-Ortiz, Brandon Fowler, David Houck, Hank Hensel, Patrick Lloyd, Andrew McDonald, Jason Frazier

August 2023

Intermediate to advanced

336 pages

11h 32m

English

Cisco Press

Audiobook available

Read now

Unlock full access

Cover Page
About This eBook
Title Page
Copyright Page
Figure Credits
About the Authors
About the Technical Reviewers
Dedications
Acknowledgments
Contents at a Glance

Contents
Icons Used in This Book
Command Syntax Conventions
Preface
Prologue: Jason Penn, Cisco Director, Customer ExperienceForeword: John Strong, FBI Special Agent in Charge, Retired
Introduction
Goals and MethodsWho Should Read This Book?Strategies for Implementation of Zero TrustHow This Book Is Organized
Chapter 1. Overview of Zero Trust (ZT)
Chapter Key Points:Zero Trust OriginsPlanning for Zero TrustZero Trust Organizational DynamicsCisco’s Zero Trust CapabilitiesSummaryReferences in This Chapter
Chapter 2. Zero Trust Capabilities
Chapter Key Points:Cisco Zero Trust CapabilitiesPolicy & Governance PillarIdentity PillarVulnerability Management PillarEnforcementAnalytics PillarSummaryReferences in This Chapter
Chapter 3. Zero Trust Reference Architecture
Chapter Key Points:Zero Trust Reference Architecture: Concepts ExploredSummaryReference in This Chapter
Chapter 4. Zero Trust Enclave Design
Chapter Key Points:User LayerProximity NetworksCloudEnterpriseBusiness ServicesSummary
Chapter 5. Enclave Exploration and Consideration
Chapter Key Points:Addressing the BusinessIdentifying the “Crown Jewels”Identifying and Protecting Shared EnclavesBringing Blurred Borders Back into FocusIncorporating New Services and EnclavesUsing Automation in EnclavesConsiderations on the Physicality of an EnclaveSummaryReferences in This Chapter
Chapter 6. Segmentation
Chapter Key Points:A Brief Summary of the OSI ModelUpper Layer Segmentation ModelsCommon Network-Centric Segmentation ModelsNorth-South Directional SegmentationEast-West Directional SegmentationDetermining the Best Model for SegmentationApplying Segmentation Throughout Network FunctionsHow To: Methods and Considerations for Segmentation in an Ideal WorldRestricting Peer-to-Peer or Jump-Off PointsSummaryReferences in This Chapter
Chapter 7. Zero Trust Common Challenges
Chapter Key Points:Challenge: Gaining Visibility into the Unknown (Endpoints)Overcoming the Challenge: The Use of Contextual IdentityChallenge: Understanding the Expected Behavior of EndpointsOvercoming the Challenge: Focusing on the EndpointChallenge: Understanding External Access RequirementsOvercoming the Challenge: Mapping External Communication RequirementsChallenge: Macrosegmentation vs. Microsegmentation for the NetworkOvercoming the Challenge: Deciding Which Segmentation Methodology Is Right for an OrganizationChallenge: New Endpoint OnboardingOvercoming the Challenge: Consistent Onboarding ProcessesChallenge: Policies Applied to Edge NetworksOvercoming the Challenge: Ubiquitous Policy ApplicationChallenge: Organizational Belief That a Firewall Is EnoughOvercoming the Challenge: Defense in Depth and Access-Focused SecurityOvercoming the Challenge: The Case for Securing the Application, Not the NetworkSummaryReferences in This Chapter
Chapter 8. Developing a Successful Segmentation Plan
Chapter Key Points:Planning: Defining Goals and Chapter Key Points:Plan: Segmentation DesignImplement: Deploying the Segmentation DesignImplement: The Segmentation ModelSummaryReferences in This Chapter
Chapter 9. Zero Trust Enforcement
Chapter Key Points:A Practical Plan for Implementing SegmentationEndpoint Monitor ModeEndpoint Traffic MonitoringEnforcementNetwork Access ControlEnvironmental ConsiderationsPractical Considerations Within Contextual IdentitySummary
Chapter 10. Zero Trust Operations
Chapter Key Points:Zero Trust Organization: Post-Implementation OperationsThe Life Cycle of Zero Trust PoliciesMoves, Adds, and Changes in a Zero Trust OrganizationSummaryReferences in This Chapter
Chapter 11. Conclusion
Chapter Key Points:Zero Trust Operations: Continuous ImprovementsSummary
Appendix A. Applied Use Case for Zero Trust Principles
Business ProblemGoals and DriversApplication of the Principles of Zero TrustConclusion
Index
Code Snippets

Content preview from Zero Trust Architecture

Index

Numbers

802.1X, 17, 81–82

A

AAA (authentication, authorization, and accounting), 13, 31–32
access
- access-focused security, 176–180
  - endpoint-based analysis policies, 180
  - malware prevention and inspection, 179–180
  - vulnerability scanners, 179
- ACLs (access control lists), 18, 22, 67, 101–102, 125–126, 136–137, 265
- external access requirements, 164–168
- privileged, 35
accounting, 31–32
ACI Fabric Policy Model, 73
ACLs (access control lists), 18, 22, 101–102, 125–126, 136–137, 141, 265
acquisitions. See mergers and acquisitions, onboarding and
Active Directory, 32, 81, 146, 208–209, 216, 258
activists, cyber, 106
Address Resolution Protocol (ARP), 138
addresses
- IP (Internet Protocol), 20, 67, 108, 123, 165–166, 212
- MAC (media access ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780137899722

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Zero Trust Architecture

by Cindy Green-Ortiz, Brandon Fowler, David Houck, Hank Hensel, Patrick Lloyd, Andrew McDonald, Jason Frazier