A NIST 800-207 Playbook: Zero Trust from the Whiteboard to the Boardroom
summary
NIST 800-207 becomes a concrete playbook: move from a network perimeter to an identity‑centric model using a brokered policy enforcement point that decrypts TLS, consults PKI/CMDB/telemetry, evaluates posture and identity via SAML/SCIM, then enforces session‑level least privilege. Four starter use cases are threat protection, data protection, segmentation and M&A; implementations go selective or opportunistic with week/3‑month/6‑month milestones. Core claim: assume breach, treat identity and context as the new perimeter and remove direct endpoint IP reachability.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:551990's Trust model expressed in hardware
- 6:302020's: Trust was reimagined
- 13:06Network Security versus Zero Trust Architecture
- 15:53Macro Trends driving Zero Trust
- 18:31A Zero Trust view of the Network
- 21:11Tenets of Zero Trust
- 25:16Whiteboarding your Zero Trust strategy
- 26:14The WHY | Understand the drivers
- 27:38The WHAT | Defining the North Star
- 28:14The HOW | Building your Zero Trust strategy
- 34:24Threat Protection with Zero Trust
- 39:00Mergers, Acquisitions, Divestitures with Zero Trust
- 40:47Zero Trust Network Access (ZTNA) traffic flow
- 45:02Zero Trust adoption Best Practices
- 47:05Overcoming analysis paralysis
- 48:27General considerations preparing for the Board
- 51:12Articulating Zero Trust to the Board
- 52:18Apply What You Have Learned Today
related talks
45mZero Trust: Getting to Step One..and What to Do When You Get There
40mZero Trust and Privacy: Moving Security Closer to the Target
39mOn Establish a Production Zero Trust Architecture
31mEmbracing Zero Trust When You Aren't the World's Largest Internet Company
19mBeyond Perimeters: Implementing Zero Trust at Enterprise Scale
35mDefense Through Invisibility: Zero Trust Security for the Enterprise
10mEconomics of Zero Trust
28mZero Trust Architecture - Now We Must, But What It Means?