Every so often I sit in a workshop where someone proudly tells me that they are well on their way with Zero Trust. Then they show me the network diagram.<\/p>\n
Microsegmentation, new firewalls, a few more VLANs. All good stuff, I\u00b4m not saying it isn\u00b4t. But if that is all you do you have just built a smaller version of the same castle and moat we had twenty years ago.<\/p>\n
Zero Trust is about verifying every access, every time. That means the identity has to be strong, with phishing resistant MFA and no standing admin rights. The device has to be managed and healthy before it gets anywhere. The applications need to know who is calling them and why. The data needs to be classified and protected so it stays protected when it leaves your network, because it will. And on top of that you need monitoring that actually connects the dots between all of it.<\/p>\n
Think of it as a chain. The attacker doesn\u00b4t care how fine grained your segmentation is if he can logon with a stolen password from an unmanaged laptop. He\u00b4ll walk right through your segments with a valid account and your firewalls will happily let him.<\/p>\n
So by all means, segment your network. Just don\u00b4t call it Zero Trust until you have done the rest.<\/p>\n","protected":false},"excerpt":{"rendered":"
Every so often I sit in a workshop where someone proudly tells me that they are well on their way with Zero Trust. Then they show me the network diagram. Microsegmentation, new firewalls, a few more VLANs. All good stuff, I\u00b4m not saying it isn\u00b4t. But if that is all you do you have just […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[24,25,23],"class_list":["post-1031","post","type-post","status-publish","format-standard","hentry","category-security-architecture","tag-identity","tag-network-segmentation","tag-zero-trust"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1031"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1031\/revisions"}],"predecessor-version":[{"id":1033,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1031\/revisions\/1033"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}