How to Scope, Size, and Start Zero Trust

The journey of a thousand miles begins with a single step.

– Lao Tzu

Now that we understand Zero Trust and its role in managing Artificial Intelligence (AI) security risks, let’s address the top questions about planning and getting started with a Zero Trust transformation.

This chapter covers the following topics:

• Agile security – think big, start small, move fast – Zero Trust enables agile security that overcomes perfection myths to enable continuous improvement and prioritization.
• Scoping, sizing, and starting Zero Trust – common questions on how to plan a Zero Trust transformation and tailor playbooks to your organization.
• Key terminology changes and clarification – addresses key wording changes in Zero Trust as well as common points of confusion with terminology that is used differently by different teams in an organization.

Let’s start by...

Agile security – think big, start small, move fast

Security must be agile!

As we discussed in Chapter 3, Zero Trust Is Security for Today’s World, security must continuously adapt to ongoing changes in business conditions, technology platforms, and attackers who are creative, intelligent, and motivated to learn and adapt.

Staying adaptive to these changes requires an agile approach to security that assumes failure (assumes compromise) and focuses on incremental progress rather than deferred perfection.

What is agile security?

Agile security is simply acknowledging that the real world is messy and unpredictable, and adapting to that.

Zero Trust enables an agile approach to security. Zero Trust enables security to be agile and keep up with continuously changing requirements (business requirements, technology platforms, security threats, and more).

While this is simple, it isn’t easy to adopt this way of thinking if you have been used to classic...

Scoping, sizing, and starting Zero Trust

There is only one way to eat an elephant: a bite at a time.

– Desmond Tutu

You can start Zero Trust in many different ways. In fact, many organizations have already started on parts of Zero Trust without realizing it or without calling it Zero Trust. This could include ensuring the integration of security risk into business risk management, adopting modern security operations practices, updating access control and other security approaches for the cloud, and more.

A Zero Trust transformation involves changes across many teams and connecting teams together to work as a team of teams. This is a large scope of changes for an organization to understand, plan, and execute. This naturally leads to questions on how best to scope, size, and start the Zero Trust journey.

The top questions that often arise are the following:

• Will Zero Trust work in my organization? How will it apply to our size, industry, culture, and processes...

Key terminology changes and clarification

One of the side effects of connecting business, technology, and security teams together is terminology confusion. As these teams start working more closely together, they often face points of confusion around language, terminology, and its meaning.

Some terminology and concepts are new to teams that haven’t worked together before, some of the same (or similar) terminology has different meanings to different teams, some terminology is new to everyone, and some common terminology is just outdated and misleading.

The most common points of confusion typically center around the use of the words assets (and related words), operations (and related words), and the network (or the enterprise).

Newer terminology – technical estate

The series uses “technical estate” or “technology estate” to refer to all technology used by an organization to get work done, including all data and all IT, Operational...

Summary

In this chapter, we answered some common questions around scoping, sizing, and starting Zero Trust, which helped us think about structuring the approach to meet the unique needs of an organization. We saw how these playbooks are compatible with any size organization and any style, from well-established organizations to digital-native organizations.

Next up, in Chapter 7, What Zero Trust Success Looks Like, we will take a look at common causes of technology project failures and how to avoid them on this Zero Trust journey.