دانلود کتاب اعتماد صفر و ریسک شخص ثالث – کاهش شعاع انفجار

Zero trust is like kung fu. Before we get into a debate about whether Brazilian jiu jitsu or Krav Maga is better, I’m just using kung fu as a general term for the personal discipline involved in mastering a martial art. Zero trust is the discipline of protecting yourself and your community in the cyber world. In the cyber world, it’s illegal to attack back, so our discipline is defensive. Our adversaries don’t have the element of surprise anymore. We know what they’re after: money, information, secrets. We also know how they get it. No matter what technology you use, what industry you’re in, or what role you may play in your organization, the one common denominator of the thing that attackers exploit is trust. We’ve evolved our defense to focus on trust relationships in digital systems, hence the name zero trust. Our discipline focuses on how to remove the trust relationships in digital systems. In my book, Project Zero Trust (Ascent Audio, 2022), I argue that everyone inside your organization should play a role in your zero trust effort, both inside IT and outside of IT. But what about people outside of your company? Your partners, your suppliers, your vendors? Most martial arts can be traced back to a school or group of people who founded it as a school of thought. For zero trust, John Kindervag is the kung fu master. In 2010, while he was the lead analyst for cybersecurity at Forrester Research, John coined the term zero trust. In these two words, John attempted to distill the most successful strategy for preventing breaches that he had seen deployed in real companies around the world. John wrote this strategy, not just for security people who were already starting to make a shift in their defensive strategies based on changes to technology and our adversaries’ evolving tactics but for everyone else in information technology as well. Zero trust isn’t just for us security nerds. We need everyone in our organizations to help. In Project Zero Trust, I worked with John to create a fictional case study about a company that uses his repeatable five-step design methodology and his zero trust maturity model to secure their systems after a ransomware incident. I brought my experiences as a chief information security officer to highlight how organizations can apply zero trust to every critical aspect of cybersecurity: from physical security to enterprise resource planning (ERP) or customer relationship management (CRM) software, to identity, to cloud, DevOps, and security operations centers. In other words, I wrote my book for your internal team. But even if you get everything right in your own organization, that might not be enough in your zero trust journey. Today, two-thirds of all breaches are caused by vendors. Even if you’ve gotten everything right in your organization, you may have a blind spot to one of your biggest risks. If zero trust is like kung fu, then Gregory Rasner is one of the blackbelts.