To successfully implement ZT security, two crucial processes must
be planned and aligned with existing access procedures that the ZT
implementation might impact. What are these two processes?
Which of the following is a required concept of single packet
authorizations (SPAs)?
Which element of ZT focuses on the governance rules that define
the "who, what, when, how, and why" aspects of accessing target
resources?
Policy is the element of ZT that focuses on the governance rules that define the ''who, what, when, how, and why'' aspects of accessing target resources. Policy is the core component of a ZTA that determines the access decisions and controls for each request based on various attributes and factors, such as user identity, device posture, network location, resource sensitivity, and environmental context. Policy is also the element that enables the ZT principles of ''never trust, always verify'' and ''scrutinize explicitly'' by enforcing granular, dynamic, and data-driven rules for each access request.
Reference=
Certificate of Competence in Zero Trust (CCZT) prepkit, page 14, section 2.2.2
What Is Zero Trust Architecture (ZTA)? - F5, section ''Policy Engine''
Zero Trust Architecture Project - NIST Computer Security Resource Center, slide 9
[Zero Trust Frameworks Architecture Guide - Cisco], page 4, section ''Policy Decision Point''
ZT project implementation requires prioritization as part of the
overall ZT project planning activities. One area to consider is______
Select the best answer.
ZT project implementation requires prioritization as part of the overall ZT project planning activities. One area to consider is prioritization based on risks, which means that the organization should identify and assess the potential threats, vulnerabilities, and impacts that could affect its assets, operations, and reputation, and prioritize the ZT initiatives that address the most critical and urgent risks. Prioritization based on risks helps to align the ZT project with the business objectives and needs, and optimize the use of resources and time.
Reference=
Zero Trust Planning - Cloud Security Alliance, section ''Scope, Priority, & Business Case''
The Zero Trust Journey: 4 Phases of Implementation - SEI Blog, section ''Second Phase: Assess''
Planning for a Zero Trust Architecture: A Planning Guide for Federal ..., section ''Gap Analysis''
According to NIST, what are the key mechanisms for defining,
managing, and enforcing policies in a ZTA?
According to NIST, the key mechanisms for defining, managing, and enforcing policies in a ZTA are the policy decision point (PDP), the policy enforcement point (PEP), and the policy information point (PIP). The PDP is the component that evaluates the policies and the contextual data collected from various sources and generates an access decision. The PEP is the component that enforces the access decision on the resource. The PIP is the component that provides the contextual data to the PDP, such as the user identity, the device posture, the network location, the resource attributes, and the environmental factors.
Reference=
Zero Trust Architecture Project - NIST Computer Security Resource Center, slide 9
What Is Zero Trust Architecture (ZTA)? - F5, section ''Policy Engine''
Zero Trust Frameworks Architecture Guide - Cisco, page 4, section ''Policy Decision Point''
Theola
8 days agoBette
19 days agoBrandon
24 days agoRoxane
1 months agoLeota
2 months agoMeghann
2 months agoEmile
2 months agoErinn
2 months agoDiane
3 months agoKaycee
4 months agoTayna
4 months agoCatarina
4 months agoBrandon
5 months agoLawana
6 months agoAlecia
6 months agoLuther
6 months agoAyesha
7 months agoJuliya
8 months ago