Adoption with the Three-Pillar Model

“No one can whistle a symphony. It takes a whole orchestra to play it.”

– H.E. Luccock

Now that we have a clear overview of Zero Trust and what success looks like, it’s time to shift into planning mode. The remaining chapters will focus on the playbook approach that enables you to achieve and benefit from the promised benefits of Zero Trust.

This chapter discusses the three-pillar model used as the foundation of the playbooks that helps you orchestrate Zero Trust and integrate it with your whole organization. The next chapter will cover the six-stage plan based on these pillars that guides the overall journey. The final chapter describes the role-based guidance in the playbooks that make Zero Trust personal, actionable, and crystal clear to every role.

The key topics covered in this chapter are as follows:

• Introduction to the three pillars that enable you to transform an...

Introduction to the three pillars

What matters to an organization? The ability to conduct business, achieve its mission, and grow its business.

Doing this in today’s dynamically changing world is like navigating a constantly changing obstacle course. You must have a clear plan to get to your objectives and you must keep moving forward, but you also have to be flexible and adjust based on what you learn on that journey.

To enable this, we recommend using a simple three-pillar model based on The Open Group’s SOA for Business Technology guide (http://www.opengroup.org/soa/source-book/wp_soa4bt/p2.htm).

At its very simplest, this is a plan → do → run framework, but it has been tailored to Zero Trust and the complex and continuously changing business, technology, and threat environments of today.

This model provides much-needed clarity on how to integrate security and Zero Trust into an organization’s strategy, processes, and daily operations...

Playbook structure

Now that we understand the model, let’s dive into the playbook structure and how it is woven throughout the playbooks. This chapter will take a deeper dive into each of the three pillars (strategic, operational, and operating model) and then summarize how they tie together into a single, coherent, detailed model that is implemented in phases. We will use Acme examples for different industries throughout this chapter and the rest of the playbook to show how to apply these in real life in different industries.

Playbook layout

The playbook series provides a single overarching approach that is then detailed in role-specific guidance. This naturally provides immediate actionable guidance while keeping everyone in the organization focused on working in the same direction. This approach also provides clarity and structure while maintaining flexibility to adapt the playbook to your organization and changing requirements. You can start anywhere and continuously...

Stitching it all together with the Zero Trust Playbook

Now that we have all three pillars of the model, we can put them together and move forward on making it real at scale. We now implement sustainable and effective Zero Trust capabilities that all fit together in an actionable, living, breathing strategy—the Zero Trust Playbook.

We will next look at the overall system of three interconnected pillars and their individual components. We will introduce the six-stage plan in Chapter 9, The Zero Trust Six-Stage Plan, and then proceed to build it throughout the rest of the playbook.

Figure 8.15 describes each playbook component and how they all flow together, much like a blueprint describes all aspects of a building’s architecture:

Figure 8.15 – Zero Trust Playbook overall components and relationships

This diagram explains the relationships in the overall system:

• Each of the dark green boxes at the top of the pillars represents...

Summary

In this chapter, we learned about the three pillars of the playbook and how they enable security agility and security integration with the organization’s business and technical priorities and processes. We learned about how the strategic roadmap is formed and the context that goes into it, how the operational pillar implements this roadmap, and how the operating model allows you to monitor and adjust Zero Trust to keep it on track.

Next up is Chapter 9, The Zero Trust Six-Stage Plan, which describes the six-stage approach that resolves the three pillars into specific implementation stages and prescriptive actionable steps to coordinate the overall journey across roles. The role-by-role guidance in the playbook translates these into the language and culture of each role, outlining changes with Zero Trust and what the resulting daily tasks and routine look like for each role.