WEBVTT

1
00:00:00.000 --> 00:00:01.530
In this section of the course,

2
00:00:01.530 --> 00:00:04.682
we are going to discuss Zero Trust Design.

3
00:00:04.682 --> 00:00:07.020
The Zero Trust Design section of the course

4
00:00:07.020 --> 00:00:10.530
focuses on Domain 2: Security Architecture,

5
00:00:10.530 --> 00:00:13.350
specifically, objective 2.6

6
00:00:13.350 --> 00:00:15.780
which states that given a scenario,

7
00:00:15.780 --> 00:00:17.460
you must be able to integrate

8
00:00:17.460 --> 00:00:21.600
Zero Trust concepts into system architecture design.

9
00:00:21.600 --> 00:00:25.050
Zero trust is used because traditional security models,

10
00:00:25.050 --> 00:00:27.000
which rely on perimeter defense,

11
00:00:27.000 --> 00:00:28.890
no longer effectively address

12
00:00:28.890 --> 00:00:31.290
today's complex threat landscape

13
00:00:31.290 --> 00:00:33.510
and diverse network environments.

14
00:00:33.510 --> 00:00:36.510
Zero trust ensures that every user and device,

15
00:00:36.510 --> 00:00:40.230
regardless of their location, is continuously validated

16
00:00:40.230 --> 00:00:42.180
and granted network access

17
00:00:42.180 --> 00:00:45.330
based on strict context-aware policies.

18
00:00:45.330 --> 00:00:47.790
Furthermore, zero trust emphasizes

19
00:00:47.790 --> 00:00:50.730
the need to carefully manage interactions,

20
00:00:50.730 --> 00:00:52.890
control resources, and integrate

21
00:00:52.890 --> 00:00:54.990
various security technologies

22
00:00:54.990 --> 00:00:56.790
to reduce vulnerabilities.

23
00:00:56.790 --> 00:00:58.500
As we go through this section,

24
00:00:58.500 --> 00:01:01.860
we will cover many topics related to Zero Trust Design,

25
00:01:01.860 --> 00:01:04.230
including Security Boundaries,

26
00:01:04.230 --> 00:01:06.840
Virtual Private Network Architecture,

27
00:01:06.840 --> 00:01:11.190
Segmentation, Deperimeterization, Access Management,

28
00:01:11.190 --> 00:01:14.160
Application Programming Interface Integration

29
00:01:14.160 --> 00:01:17.520
and Validation, and Asset Control.

30
00:01:17.520 --> 00:01:20.550
First, we will look at Security Boundaries.

31
00:01:20.550 --> 00:01:22.320
Security boundaries are defined

32
00:01:22.320 --> 00:01:26.640
by strict access controls and continuous verification,

33
00:01:26.640 --> 00:01:29.670
rather than physical or network perimeters.

34
00:01:29.670 --> 00:01:32.130
The implementation of security boundaries

35
00:01:32.130 --> 00:01:34.740
enables the monitoring and validation

36
00:01:34.740 --> 00:01:37.440
of every cross network interaction.

37
00:01:37.440 --> 00:01:41.160
Security boundary concepts include system components,

38
00:01:41.160 --> 00:01:44.160
data perimeters, and secure zones.

39
00:01:44.160 --> 00:01:46.830
System components are individual elements,

40
00:01:46.830 --> 00:01:51.000
such as servers, workstations, and applications

41
00:01:51.000 --> 00:01:53.910
that make up the information technology infrastructure

42
00:01:53.910 --> 00:01:56.100
and must be secured individually

43
00:01:56.100 --> 00:01:58.200
within a zero trust framework.

44
00:01:58.200 --> 00:02:00.630
Data perimeters refer to the boundaries

45
00:02:00.630 --> 00:02:02.490
around sensitive information

46
00:02:02.490 --> 00:02:05.070
where access is controlled and monitored

47
00:02:05.070 --> 00:02:07.260
to prevent unauthorized access,

48
00:02:07.260 --> 00:02:09.660
regardless of where the data resides.

49
00:02:09.660 --> 00:02:12.030
Secure zones are segmented areas

50
00:02:12.030 --> 00:02:15.390
within the network where access is tightly controlled

51
00:02:15.390 --> 00:02:17.250
and continuously verified.

52
00:02:17.250 --> 00:02:20.190
Secure zones provide a higher level of protection

53
00:02:20.190 --> 00:02:22.170
for critical assets and data.

54
00:02:22.170 --> 00:02:24.540
For example, in a zero trust model,

55
00:02:24.540 --> 00:02:26.670
a company might create secure zones

56
00:02:26.670 --> 00:02:29.910
within their network for sensitive financial systems,

57
00:02:29.910 --> 00:02:31.830
applying strict access controls

58
00:02:31.830 --> 00:02:34.920
and continuous monitoring to each system component

59
00:02:34.920 --> 00:02:36.840
and data perimeter to ensure that

60
00:02:36.840 --> 00:02:40.380
only authorized users are able to access critical

61
00:02:40.380 --> 00:02:42.090
and sensitive resources.

62
00:02:42.090 --> 00:02:46.560
Next, we will explore Virtual Private Network Architecture.

63
00:02:46.560 --> 00:02:48.420
Virtual private network architecture

64
00:02:48.420 --> 00:02:50.160
extends access controls

65
00:02:50.160 --> 00:02:52.470
beyond traditional network boundaries.

66
00:02:52.470 --> 00:02:55.890
There are a variety of virtual private network models,

67
00:02:55.890 --> 00:03:00.030
such as a client-to-server or a site-to-site,

68
00:03:00.030 --> 00:03:03.180
and an always-on virtual private network.

69
00:03:03.180 --> 00:03:05.520
A client-server virtual private network

70
00:03:05.520 --> 00:03:07.680
establishes a secure tunnel

71
00:03:07.680 --> 00:03:09.660
between an individual device,

72
00:03:09.660 --> 00:03:12.540
known as a client, and a central server.

73
00:03:12.540 --> 00:03:14.610
This ensures encrypted communication

74
00:03:14.610 --> 00:03:17.220
and network access for remote users.

75
00:03:17.220 --> 00:03:19.590
A site-to-site virtual private network

76
00:03:19.590 --> 00:03:21.810
connects entire networks securely,

77
00:03:21.810 --> 00:03:23.790
which allows branch offices

78
00:03:23.790 --> 00:03:27.240
or remote sites to communicate with a central network

79
00:03:27.240 --> 00:03:30.150
as part of the same logical network.

80
00:03:30.150 --> 00:03:32.400
An always-on virtual private network

81
00:03:32.400 --> 00:03:34.680
is a virtual private network connection

82
00:03:34.680 --> 00:03:36.330
that is always active,

83
00:03:36.330 --> 00:03:39.360
so it provides continuous secure access

84
00:03:39.360 --> 00:03:42.360
and enforces access policies consistently,

85
00:03:42.360 --> 00:03:44.940
regardless of the user's location.

86
00:03:44.940 --> 00:03:47.880
For example, in a zero trust architecture,

87
00:03:47.880 --> 00:03:50.400
an organization may use a client server

88
00:03:50.400 --> 00:03:51.900
virtual private network

89
00:03:51.900 --> 00:03:54.210
to secure remote employees' connections

90
00:03:54.210 --> 00:03:55.770
to internal applications,

91
00:03:55.770 --> 00:03:58.950
while utilizing a site-to-site virtual private network

92
00:03:58.950 --> 00:04:00.720
to maintain secure connections

93
00:04:00.720 --> 00:04:03.300
between different branch office locations.

94
00:04:03.300 --> 00:04:06.210
After that, we will look at Segmentation.

95
00:04:06.210 --> 00:04:08.160
Segmentation is dividing a network

96
00:04:08.160 --> 00:04:11.580
into distinct zones or segments to control

97
00:04:11.580 --> 00:04:14.520
and limit access between different areas.

98
00:04:14.520 --> 00:04:16.500
This enhances security

99
00:04:16.500 --> 00:04:19.410
and reduces the network attack surface.

100
00:04:19.410 --> 00:04:21.870
A specific type of segmentation

101
00:04:21.870 --> 00:04:25.920
known as microsegmentation takes this approach further

102
00:04:25.920 --> 00:04:27.780
by creating even smaller,

103
00:04:27.780 --> 00:04:32.190
more granular segments within each larger network segment.

104
00:04:32.190 --> 00:04:34.770
Microsegmentation can then provide

105
00:04:34.770 --> 00:04:37.620
detailed control over network traffic

106
00:04:37.620 --> 00:04:41.160
and access at the individual workload level.

107
00:04:41.160 --> 00:04:44.130
For example, in a zero trust model,

108
00:04:44.130 --> 00:04:46.920
an organization might use segmentation

109
00:04:46.920 --> 00:04:49.890
to isolate sensitive financial systems

110
00:04:49.890 --> 00:04:54.000
from general user areas and apply microsegmentation

111
00:04:54.000 --> 00:04:55.710
within the financial segment

112
00:04:55.710 --> 00:04:58.650
to control access to specific applications

113
00:04:58.650 --> 00:05:02.160
and data based on user roles and attributes.

114
00:05:02.160 --> 00:05:05.310
Next, we will explore Deperimeterization.

115
00:05:05.310 --> 00:05:08.160
Deperimeterization refers to the shift away

116
00:05:08.160 --> 00:05:11.850
from relying solely on traditional flat-network perimeters

117
00:05:11.850 --> 00:05:14.490
and instead focusing on verifying

118
00:05:14.490 --> 00:05:16.950
and securing every user and device,

119
00:05:16.950 --> 00:05:20.520
regardless of their location within the network.

120
00:05:20.520 --> 00:05:23.790
The concept of deperimeterization acknowledges

121
00:05:23.790 --> 00:05:26.460
that a network boundary is no longer defined

122
00:05:26.460 --> 00:05:28.380
by a geographic location,

123
00:05:28.380 --> 00:05:31.680
since users, clients and vendors often need access

124
00:05:31.680 --> 00:05:35.130
to the network infrastructure from remote location.

125
00:05:35.130 --> 00:05:36.870
Deperimeterization concepts

126
00:05:36.870 --> 00:05:39.600
include Software-Defined Networking,

127
00:05:39.600 --> 00:05:41.940
Software-Defined Wide Area Network,

128
00:05:41.940 --> 00:05:44.970
and a Secure Access Service Edge.

129
00:05:44.970 --> 00:05:48.210
Let's take a moment to discuss each of these concepts.

130
00:05:48.210 --> 00:05:50.490
Software-Defined Networking allows

131
00:05:50.490 --> 00:05:52.800
for centralized control and management

132
00:05:52.800 --> 00:05:54.750
of network traffic implemented

133
00:05:54.750 --> 00:05:57.360
across a large enterprise network.

134
00:05:57.360 --> 00:05:58.920
Software-Defined Networking

135
00:05:58.920 --> 00:06:00.600
also allows the enforcement

136
00:06:00.600 --> 00:06:03.480
of security policies across the entire network,

137
00:06:03.480 --> 00:06:06.450
regardless of physical boundaries.

138
00:06:06.450 --> 00:06:08.670
Software-Defined Wide Area Network

139
00:06:08.670 --> 00:06:12.090
extends the Software-Defined Networking Concept

140
00:06:12.090 --> 00:06:15.000
by optimizing and securing connectivity

141
00:06:15.000 --> 00:06:17.610
across large geographical areas,

142
00:06:17.610 --> 00:06:21.360
such as between branch offices and remote sites.

143
00:06:21.360 --> 00:06:24.660
Secure Access Service Edge integrates security

144
00:06:24.660 --> 00:06:29.160
and networking functions into a unified cloud-based service.

145
00:06:29.160 --> 00:06:32.910
This ensures access and continuous monitoring of users

146
00:06:32.910 --> 00:06:36.360
and data as they move across cloud-based

147
00:06:36.360 --> 00:06:38.940
and on-premise network boundaries.

148
00:06:38.940 --> 00:06:41.880
For example, an organization might use

149
00:06:41.880 --> 00:06:45.150
Software-Defined Wide Area Network to connect remote

150
00:06:45.150 --> 00:06:48.270
and geographically dispersed branch offices,

151
00:06:48.270 --> 00:06:50.790
while using Software Defined Networking

152
00:06:50.790 --> 00:06:53.280
to manage and enforced access controls

153
00:06:53.280 --> 00:06:55.140
across the logical network,

154
00:06:55.140 --> 00:06:59.430
and they might concurrently use Secure Access Service Edge

155
00:06:59.430 --> 00:07:02.370
to provide comprehensive security and monitoring

156
00:07:02.370 --> 00:07:04.470
for users accessing resources

157
00:07:04.470 --> 00:07:09.470
from any location via cloud and non-cloud based connection.

158
00:07:09.510 --> 00:07:12.510
Following that, we will look at Access Management.

159
00:07:12.510 --> 00:07:15.450
Access management is used to continuously verify

160
00:07:15.450 --> 00:07:18.600
and control user and device access

161
00:07:18.600 --> 00:07:20.910
to resources based on policies

162
00:07:20.910 --> 00:07:22.890
and contextual factors.

163
00:07:22.890 --> 00:07:24.630
This is more secure than systems

164
00:07:24.630 --> 00:07:28.110
that assume trust based on a network location.

165
00:07:28.110 --> 00:07:29.490
Access management concepts

166
00:07:29.490 --> 00:07:32.250
include subject-object relationships,

167
00:07:32.250 --> 00:07:34.050
continuous authentication,

168
00:07:34.050 --> 00:07:37.080
and context-based reauthentication.

169
00:07:37.080 --> 00:07:40.230
Let's take a moment to talk about each of these concepts.

170
00:07:40.230 --> 00:07:42.660
Defining Subject-object Relationships

171
00:07:42.660 --> 00:07:44.520
requires clearly specifying

172
00:07:44.520 --> 00:07:46.800
permitted interactions between users

173
00:07:46.800 --> 00:07:50.370
known as subjects, and resources known as objects.

174
00:07:50.370 --> 00:07:53.010
This ensures that only authorized entities

175
00:07:53.010 --> 00:07:55.170
can access specific resources

176
00:07:55.170 --> 00:07:57.450
based on their established permissions.

177
00:07:57.450 --> 00:08:00.450
Next, Continuous Authorization is used

178
00:08:00.450 --> 00:08:03.690
to continuously evaluate access permissions

179
00:08:03.690 --> 00:08:05.520
throughout a user session.

180
00:08:05.520 --> 00:08:07.440
It adapts to changes in context

181
00:08:07.440 --> 00:08:11.550
or security posture to dynamically enforce policies.

182
00:08:11.550 --> 00:08:15.870
Finally, Context-Based Reauthentication requires users

183
00:08:15.870 --> 00:08:19.860
to re-authenticate when certain monitored conditions change,

184
00:08:19.860 --> 00:08:23.340
such as accessing sensitive data from a new location,

185
00:08:23.340 --> 00:08:25.410
or shifting from a secure

186
00:08:25.410 --> 00:08:27.960
to an insecure communication protocol.

187
00:08:27.960 --> 00:08:30.660
For example, in a zero trust model,

188
00:08:30.660 --> 00:08:33.330
an organization might define a relationship

189
00:08:33.330 --> 00:08:36.120
by specifying that only finance team members

190
00:08:36.120 --> 00:08:38.160
can access financial reports.

191
00:08:38.160 --> 00:08:41.010
The organization can then continuously monitor

192
00:08:41.010 --> 00:08:44.790
which members are accessing reports through the session,

193
00:08:44.790 --> 00:08:48.210
and if a monitored member moves to a different network

194
00:08:48.210 --> 00:08:51.630
or attempts to access particularly sensitive data,

195
00:08:51.630 --> 00:08:54.150
reauthentication may be prompted.

196
00:08:54.150 --> 00:08:56.550
This type of access management ensures

197
00:08:56.550 --> 00:09:00.930
that access remains secure and contextually appropriate.

198
00:09:00.930 --> 00:09:04.260
Then, we will explore Application Programming

199
00:09:04.260 --> 00:09:06.930
Interface Integration and Validation.

200
00:09:06.930 --> 00:09:09.060
Application Programming Interface

201
00:09:09.060 --> 00:09:11.610
Integration and Validation ensures

202
00:09:11.610 --> 00:09:15.060
that all interactions between applications and services

203
00:09:15.060 --> 00:09:17.430
through application programming interfaces

204
00:09:17.430 --> 00:09:21.780
are authorized, authenticated, and continuously monitored.

205
00:09:21.780 --> 00:09:25.890
For example, application programming interface integration

206
00:09:25.890 --> 00:09:28.650
can connect different applications and services,

207
00:09:28.650 --> 00:09:32.130
enabling them to communicate and share data securely.

208
00:09:32.130 --> 00:09:36.030
Application Programming Interface Validation may then verify

209
00:09:36.030 --> 00:09:38.730
Application Programming Interface Interactions,

210
00:09:38.730 --> 00:09:40.680
comply with security policies

211
00:09:40.680 --> 00:09:42.840
by checking credentials, permissions,

212
00:09:42.840 --> 00:09:47.220
and data integrity before allowing any data exchange.

213
00:09:47.220 --> 00:09:49.800
Finally, we will look at Asset Control.

214
00:09:49.800 --> 00:09:53.340
Asset control is maintaining a detailed inventory

215
00:09:53.340 --> 00:09:56.790
and continuously validating the security status

216
00:09:56.790 --> 00:09:58.950
of all assets within the network

217
00:09:58.950 --> 00:10:01.950
to ensure they comply with security policies

218
00:10:01.950 --> 00:10:04.170
and are protected against threats.

219
00:10:04.170 --> 00:10:08.010
Asset control concepts include asset identification,

220
00:10:08.010 --> 00:10:11.130
asset management, and attestation.

221
00:10:11.130 --> 00:10:14.520
Let's explore each of these concepts in more detail.

222
00:10:14.520 --> 00:10:18.480
Asset identification requires cataloging all devices,

223
00:10:18.480 --> 00:10:21.570
applications, and data within the network

224
00:10:21.570 --> 00:10:24.150
to create a comprehensive inventory.

225
00:10:24.150 --> 00:10:26.850
Next, asset management is implemented

226
00:10:26.850 --> 00:10:29.400
as the ongoing process of monitoring

227
00:10:29.400 --> 00:10:31.680
and maintaining identified assets

228
00:10:31.680 --> 00:10:34.770
to ensure they're updated, configured correctly,

229
00:10:34.770 --> 00:10:37.200
and compliant with security policies.

230
00:10:37.200 --> 00:10:39.570
Finally, asset attestation

231
00:10:39.570 --> 00:10:43.350
verifies the security posture and compliance of assets,

232
00:10:43.350 --> 00:10:47.490
often through periodic assessments or real-time checks.

233
00:10:47.490 --> 00:10:49.980
To finish things off, we'll take a short quiz

234
00:10:49.980 --> 00:10:52.890
to see what you learned during this section of the course,

235
00:10:52.890 --> 00:10:56.340
and we will review each of those quiz questions fully

236
00:10:56.340 --> 00:10:57.690
to ensure you can explain

237
00:10:57.690 --> 00:10:59.280
why the right answers were right

238
00:10:59.280 --> 00:11:01.170
and the wrong answers were wrong.

239
00:11:01.170 --> 00:11:05.040
So, let's get ready to dive into Zero Trust Design

240
00:11:05.040 --> 00:11:07.521
in this section of the course!