Cloud Security Alliance CCZT - Certificate of Competence in Zero Trust (CCZT)

The scope of the target state definition in Zero Trust planning is significantly influenced by an organization's risk appetite. This entails a strategic evaluation of the level of risk an organization is willing to accept in pursuit of its objectives. Continuous authentication and authorization, integral to Zero Trust, adapt to the dynamic state of threats and the organization's risk posture, ensuring that authorization decisions align with the prevailing risk appetite and the changing security landscape​​.

To ensure a successful ZT effort, it is important to engage stakeholders across the organization and at all levels, including functional areas. This helps to align the ZT vision and goals with the business priorities and needs, gain buy-in and support from the leadership and the users, and foster a culture of collaboration and trust. Engaging stakeholders also enables the identification and mapping of the critical assets, workflows, and dependencies, as well as the communication and feedback mechanisms for the ZT transformation.

References =

Certificate of Competence in Zero Trust (CCZT) prepkit, page 7, section 1.3

Zero Trust Planning - Cloud Security Alliance, section “Scope, Priority, & Business Case”

The ‘Zero Trust’ Model in Cybersecurity: Towards understanding and …, section “3.1 Ensuring buy-in across the organization with tangible impact”

To ensure an acceptable user experience when implementing SDP, a security architect should collaborate with IT to model and plan the user experience, client software distribution, and device onboarding processes. This is because SDP requires users to install and use client software to access the protected resources, and the user experience may vary depending on the device type, operating system, network conditions, and security policies. By modeling and planning the user experience, the security architect and IT can ensure that the SDP implementation is user-friendly, consistent, and secure.

References = Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 7: Network Infrastructure and SDP

ZTA is based on the principle of never trusting any user or device by default, regardless of their location or ownership. ZTA policies can use various methods to verify the identity and context of third-party users and devices, such as tokens, certificates, multifactor authentication, device posture assessment, etc. ZTA policies can also enforce granular and dynamic access policies that grant the minimum necessary privileges to third-party users and devices for accessing specific resources, while hiding all other assets from their view. This reduces the attack surface and prevents unauthorized access and lateral movement within the network.

In the context of a Software-Defined Perimeter (SDP) that incorporates Single Packet Authorization (SPA), after successful authentication and authorization, the client typically generates an SPA packet and sends it to the accepting host. This process involves the client creating a specially crafted packet that is designed to be recognized by the accepting host's SDP gateway. Upon receiving and validating the SPA packet, the gateway allows the client to establish a connection to the designated services or resources. This mechanism ensures that only authorized clients can initiate connections, enhancing security by preventing unauthorized access.

Data sources are the ZT element that provide information that providers can use to keep policies dynamically updated. Data sources are the inputs that feed the policy engine and the policy administrator with the relevant data and context about the entities, resources, transactions, and environment in the ZTA. Data sources help to inform the policy decisions and actions based on the current state and conditions of the ZTA. Data sources can include identity providers, device management systems, threat intelligence feeds, network monitoring tools, etc.

References = Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 3: ZTA Architecture and Components

SDP features, like multi-factor authentication (MFA), mutual transport layer security (mTLS), and device fingerprinting, protect against phishing attacks by verifying the identity and authenticity of both the user and the device before granting access to a resource. Phishing attacks are attempts to trick users into revealing their credentials or other sensitive information by impersonating a legitimate entity or service1. SDP features can prevent phishing attacks by:

MFA: MFA is a security mechanism that requires a user to provide more than one piece of evidence to prove their identity, such as a password, a one-time code, a biometric factor, or a physical token2. MFA can protect against phishing attacks by making it harder for attackers to access a resource even if they manage to obtain the user’s password or other credentials2.

mTLS: mTLS is a security protocol that enables mutual authentication and encryption between two parties, such as a client and a server3. mTLS can protect against phishing attacks by ensuring that both the client and the server have valid and trusted certificates, and by preventing attackers from intercepting or modifying the communication between them3.

Device fingerprinting: Device fingerprinting is a technique that identifies and verifies a device based on its unique characteristics, such as its operating system, browser, IP address, or hardware configuration4. Device fingerprinting can protect against phishing attacks by allowing only authorized devices to access a resource, and by detecting any anomalies or changes in the device’s attributes that may indicate a compromise4.

References =

What is Phishing? | How to Identify & Prevent Phishing Attacks | Cloudflare

What is Multi-Factor Authentication (MFA)? | Cloudflare

What is Mutual TLS (mTLS)? | Cloudflare

What is Device Fingerprinting? | Cloudflare

In a ZTA, automation and orchestration can increase security by using the following means:

Infrastructure as code (laC): laC is a practice of managing and provisioning IT infrastructure through code, rather than manual processes or configuration tools1. laC can increase security by enabling consistent, repeatable, and scalable deployment of ZTA components, such as policies, gateways, firewalls, and micro-segments2. laC can also facilitate compliance, auditability, and change management, as well as reduce human errors and configuration drifts3.

Identity lifecycle management: Identity lifecycle management is a process of managing the creation, modification, and deletion of user identities and their access rights throughout their lifecycle4. Identity lifecycle management can increase security by ensuring that users have the appropriate level of access to resources at any given time, based on the principle of least privilege5. Identity lifecycle management can also automate the provisioning and deprovisioning of user accounts, enforce strong authentication and authorization policies, and monitor and audit user activity and behavior6.

References =

What is Infrastructure as Code? | Cloudflare

Zero Trust Architecture: Infrastructure as Code

Infrastructure as Code: Security Best Practices

What is Identity Lifecycle Management? | One Identity

Zero Trust Architecture: Identity and Access Management

Identity Lifecycle Management: A Zero Trust Security Strategy