A Zero Trust approach should extend throughout the entire digital estate and serve as an integrated security philosophy and end to end strategy.  Identities. Identities whether they represent people, services, or IOT devices define the Zero Trust control plane. When an identity attempts to access a resource, we need to verify that identity with strong authentication, ensure access is compliant and typical for that identity, and follows least privilege access principles. Devices. Once an identity has been granted access to a resource, data can flow to a variety of different devices From IoT devices to smartphones, BYOD to partner managed devices, and on premises workloads to cloud hosted servers. This diversity creates a massive attack surface area, requiring we monitor and enforce device health and compliance for secure access. Applications. Applications and APIs provide the interface by which data is consumed. They may be legacy on premises, lift and shifted to cloud workloads, or modern SaaS applications. Controls and technologies should be applied to discover Shadow IT, ensure appropriate in-app permissions, gate access based on real-time analytics, monitor for abnormal behavior, control of user actions, and validate secure configuration options. Data. Ultimately, security teams are focused on protecting data. Where possible, data should remain safe even if it leaves the devices, apps, infrastructure, and networks the organization controls. Data should be classified, labeled, and encrypted, and access restricted based on those attributes. Infrastructure. Infrastructure (whether on premises servers, cloud based VMs, containers, or micro services) represents a critical threat vector. Assess for version, configuration, and JIT access to harden defense, use telemetry to detect attacks and anomalies, and automatically block and flag risky behavior and take protective actions. Networks. All data is ultimately accessed over network infrastructure. Networking controls can provide critical “in pipe” controls to enhance visibility and help prevent attackers from moving laterally across the network. Networks should be segmented (including deeper in network micro segmentation) and real time threat protection, end to end encryption, monitoring, and analytics should be employed. Each of these six foundational elements serves as a source of the signal, a control plane for enforcement, and a critical resource to defend. You should appropriately spread your investments across each of these elements for maximum protection. 

2. Traditional Model

3. Identity perimeter complements network perimeter
Today’s Model

4. mobile business apps
accessed daily by
employees3
5.2
of organizations
using cloud2
94%
of organizations
currently have a formal
BYOD program in place3
60%
internet-
connected devices
in use worldwide1
7B
How the world changed

5. Bring your own devices and IoT
Explosion of cloud apps
Expanding Perimeters
Explosion of signal
Composite apps & public restful APIs
Employees, partners, customers, bots
Old World vs. New World

6. A new reality needs new principles
Verify explicitly

7. Microsoft Zero Trust

8. Identity Data
Networking
Devices Apps Infrastructure
Zero Trust across the digital estate

9. Microsoft Zero Trust architecture
Visibility and Analytics
Automation

10. Zero Trust Objective:

11. Connect all of your
users and applications
Verify identities with
Multi-factor
authentication (MFA)
Control access with
smart policies and
risk assessments
Enforce least privilege
access with strong
governance
Verify and secure every identity
with strong authentication

12. HR systems
Apps and data
Cloud apps
On-premises perimeter-based networks
Azure AD
Networking and
delivery controllers
Azure AD
App Proxy
Connect all your users and apps
Active Directory
single sign-on

13. Verify identities with Multi-Factor Authentication (MFA)

14. Block access
Require MFA
Allow access
Limit access
Control access with smart policies and
risk assessments

15. Enforce least privilege access with strong governance

16. Zero Trust Objective:

17. Visibility into device health
and compliance
Restrict access from
vulnerable and compromised
devices
Enforce security policies
on mobile devices and
applications
Allow only compliant and trusted
apps and devices to access data

18. Device information detection:
Malicious Apps
Device manipulation
Network exploits
Data privacy violations
Device health
Encryption
OS version
Email profile
Microsoft Defender ATP
Mobile threat defense partners
Visibility into device
health and
compliance

19. Users on unmanaged and insecure
devices can be blocked or managed
Access decision:
→ Endpoint Manager provides
device compliance status
→ Azure AD enforces Conditional
Access
→ Block access
→ Remediate Device
→ Wipe device
→ Allow
→ Enforce MFA
→ Enroll device
Microsoft Azure
Restrict access from vulnerable and
compromised devices

20. Enroll devices for
management
Provision settings,
certs, profiles
Report & measure
device compliance
Remove corporate
data from devices
Publish mobile
apps to users
Configure and
update apps
Report app
inventory & usage
Secure & remove
corporate data within
mobile apps
Mobile Application
Management (MAM)
Conditional Access:
Restrict which apps can be
used to access email or files
Mobile Device
Management (MDM)
Conditional Access:
Restrict access to managed
and compliant devices
Managed apps
(Corporate
data)
Personal apps
(Personal data)
Multi-identity
policy
Zero Trust compliance for
mobile devices and apps

21. Zero Trust Objective:

22. Discover and control
apps in your
environment
Extend policy
enforcement into the
session
Protect sensitive data
in cloud apps
Protect apps from risks
and threats across multi-
cloud environments
Ensure applications are
available, visible and secured

23. Discover and control apps
in your environment
Block unsanctioned
apps and guide usage
to approved apps
Approve apps and
apply policy
Discover cloud apps
and services
Assess risk levels
X

24. Continuous policy
assessment and
enforcement
Update user’s session risk through
additional evaluation
In-session monitoring and policy enforcement
Edit files
View files online Open in Word/
print blocked
Extend policy enforcement into the session
Risky user behavior
logged for future
analysis and
Investigation
User behavior
analyzed against
session policy

25. Classify, label and protect
data across cloud apps
Monitor, investigate and
remediate data risks
• Visibility into application-based file
sharing, collaborators and
classification labels
• Report out on data exposure and
compliance risks of applications
• Govern data in the cloud with
granular DLP policies for
applications
• Classify and label data to
automatically protect,
encrypt and restrict access to
sensitive files across applications
• Generate alerts on policy
violations and trigger automatic
governance actions across
applications
• Investigate incident, quarantine
files, remove permissions and
notify users across applications
Protect sensitive data in cloud apps

26. Sample of supported apps
Protect apps from risks and threats across the clouds
Threat delivery
and persistence
Indicators of a
compromised session
Malicious use of an
end-user account
Malicious use of a
privileged user

27. Zero Trust Objective:

28. Align segmentation
strategy and role-based
access control
Rapidly find and fix
configuration (and other)
vulnerabilities
Use real-time threat
monitoring to detect
attacks and anomalies
Harden defenses and detect and
respond to threats in real time

29. A strong enterprise
segmentation strategy:
Align segmentation
strategy and role-based
access control → Enables operations
→ Contains risk
→ Monitors for violations

30. Rapidly find and fix configuration
(and other) vulnerabilities

32. Zero Trust Objective:

33. Segment networks and
implement context-driven
access controls
Use real-time threat
protection to detect and
respond to threats
Protect data with end-to-
end encryption
Move beyond traditional
network security approaches
!

34. Subscriptions Virtual
Network
Azure
Firewall
Network security
Group
Kubernetes
Services
Container
Networking
Interface

35. Partner solutions
X
X
X
Azure network
security
Threat protection at the network layer

36. Encryption built into Azure

37. Data
Zero Trust Objective:

38. 101010 0101
Discover and classify your
data based on sensitivity
Apply real-time protection
to your sensitive data
Gain visibility into sensitive
data activity, policy
violations, and risky sharing
Protect your sensitive data—
wherever it lives or travels

39. Discover and classify your data

40. Apply comprehensive protection to data and files

41. Monitor and remediate

42. Visibility and
Analytics

43. Gain insights across your enterprise

44. Available resources
aka.ms/Zero-Trust

45. © 2021 Razor Technology, LLC www.razor-tech.com
@DavidJRosenthal
Slideshare
www.razor-tech.com
5 Tower Bridge
300 Barr Harbor Dr., Suite 705
West Conshohocken, PA 19428
www.razor-tech.com
David.Rosenthal@razor-tech.com
Office: 866.RZR.DATA
LETS KEEP IN TOUCH