While you can read the playbook series any way you want, we recommend one of two approaches:

• Method 1 – Focus only on my role

  The most efficient way to get actionable guidance is to read the playbook for your role (or the role you aspire to). This will quickly get you relevant information for your current role immediately that you can act on without delay.

  How do I focus only on my role? Read this first book and then proceed to the playbook for your role. Ensure to read the introductory chapters in your playbook before reading the chapter dedicated to your role.

  Who should focus only on their role? People with an urgent need to learn and execute on Zero Trust will often read the playbooks this way to get to their role guidance fastest. This includes people assigned to support an existing Zero Trust project and is particularly useful when you have to meet deadlines for an executive-sponsored project. Senior organizational leaders often have extremely limited time for reading and may also use this method.

Notes on this method

You may need to read about multiple roles: Some roles interact very closely with other roles as part of their core job. Roles whose success depends on closely working with other roles will be instructed to read about those roles in the introduction chapter(s) of their playbook. For example, technical and security managers should read about the roles of team members they manage to help them plan daily processes, career development, learning/training activities, and performance measurement.

Skipping context has risks: While it’s possible (and tempting ☺) to jump ahead to read only the chapter for your role, we don’t recommend this for most readers unless you have an extremely urgent need to execute immediately.

It is faster to jump ahead, but skipping the context could cause confusion or misinterpretation of the guidance. Each role chapter assumes people have read and understand the context of this book and the playbook introductory chapter(s). For example, the chapters for security operations (SecOps) roles such as triage analyst (Tier 1), investigation analyst (Tier 2), threat hunter, and threat intelligence (TI) analyst all assume you understand the terminology and concepts in the introductory chapters of the playbook. If you must jump ahead, we recommend going back to read the common context as soon as you can. As with many things in life, context matters!

• Method 2 – Read all the playbooks in the series

  Reading each playbook will give you a full end-to-end perspective on the Zero Trust journey from all relevant perspectives. The series covers the organizational vision, continues through strategy and plans, and then looks at how those translate to a practitioner’s hands-on view.

  Reading about all of the roles will allow you to understand Zero Trust completely from a business/organizational leadership perspective, how that translates to technical leaders, and how practitioners experience this and get the job done on the ground. This full context helps you understand each role in the organization and its individual Zero Trust transformation experiences. This will help you be more effective and successful in your current role, plan your career path, and prepare you for your next career steps.

  Who should read the whole series? Roles who interact with most or all other roles in the playbook will need to understand the full journey for all of them (even if just reading playbook introduction chapters and skimming the role chapters). This is particularly valuable for external consultants and internal architect roles who interact with and advise many roles in an organization. This is also a valuable method for people new to cybersecurity and trying to identify which role best fits their skills and interests.

  Anyone who wants to learn more about cybersecurity can read all the playbooks to broaden their understanding of cybersecurity, grow their skills and knowledge, and prepare for a role that they aspire to. This method of looking at other roles can be especially useful if you are puzzled or frustrated with why and how other roles make decisions in your organization. ☺

Note

Zero Trust will look slightly different depending on an organization’s size, industry, culture, past investments into security, and other factors.

Zero Trust applies to all organizations, from large well-established global organizations to smaller digital-native “born in the cloud” agile organizations, and everything in between.

The guidance in the playbooks is both prescriptive and flexible to meet the needs of any organization. See Chapter 6, How to Scope, Size, and Start Zero Trust, for details on how to use the playbook guidance for large global organizations, digital-native agile organizations, and more. Each playbook also includes many Acme examples that span industries and sizes to show how to apply the playbook guidance in different situations.

Because the Zero Trust experience is different for each type of role (business leaders, technology leaders, IT and security managers, and practitioners), we broke the series into different books focusing on groupings of related roles. Each playbook uses examples to illustrate how to apply Zero Trust to different scenarios.

Figure 2.1 shows how different roles can quickly find the information relevant to them:

Figure 2.1 – Playbook series structure

Each book focuses on the needs of specific roles, as outlined here:

• The Zero Trust Overview and Playbook Introduction provides all roles with the shared context you need to understand and navigate Zero Trust.
• The Business and Technical Leadership Playbook provides role-by-role guidance for business, technical, and security leadership roles to successfully integrate security and align security with business priorities and risk management. This also guides the integration of security and technology teams, processes, and tooling.
• The Topic Playbooks provide role-by-role guidance for practitioners and managers across security, technology, and business teams to navigate, lead, and execute the Zero Trust transformation.
• The Zero Trust Futures provides all roles with insight into what changes are coming around the corner that will continue to disrupt and shape Zero Trust so that you can anticipate and manage the next stage of continuous changes.

The playbooks follow a three-pillar structure frequently used in business strategy and planning (strategic, operational, and operating models). This is described in detail in Chapter 8, Adoption with the Three-Pillar Model.

Now, let’s take a look at the approach and content of each type of book in the series.

Zero Trust Overview and Playbook Introduction

Everyone—all roles need the critical common context on Zero Trust in this book, Zero Trust Overview and Playbook Introduction. This book defines what Zero Trust is and puts it into the context of digital transformation, information security, business risk and impact, and security strategy. It also provides an overview of the Zero Trust reference model and architecture, busts some common myths and misconceptions, and introduces the six-stage playbook, three-pillar model, role-based approach, Acme corporation examples, and more.

Business and Technical Leadership Playbook

Business, technical, and security leadership roles each have a part in leading the Zero Trust transformation or integrating it with the organization’s business and risk management. This book describes in detail how leaders ensure Zero Trust delivers the full benefits of business agility and reduced organizational risk (while integrating it smoothly with digital business and cloud technology transformations). The book enables these leaders to quickly overcome common challenges and points of confusion (and conflict) that naturally arise during this process.

The Business and Technical Leadership Playbook provides role-by-role guidance for each of these leaders to drive success and avoid common challenges in this integration process.

This playbook includes guidance for these roles:

• Business executives, including CEOs, CFOs, COOs, CLOs, CPOs, CROs, and line-of-business (LOB) leaders, have relatively small but critical parts in the success of Zero Trust. These roles ensure Zero Trust is aligned with the priorities and risks of the organization and provide executive sponsorship to overcome common obstacles. This playbook guides these executives on how to best sponsor, support, guide, and measure Zero Trust to ensure it delivers on promised outcomes.
• Technology leaders, such as CIOs, CTOs, CDOs, and senior directors within those teams, typically support the Zero Trust strategy and initiatives within it. These roles ensure that the technical strategy aligns with the business goals, risk framework, and security strategy. This alignment helps build productive relationships with business and security leaders, driving the measurable success of the Zero Trust implementation.
• Security leaders, such as CISOs and senior directors within those teams, typically lead the Zero Trust strategy and sponsor initiatives within it. These roles ensure that the security strategy aligns with the business goals, risk framework, and technical strategy. This alignment helps build productive relationships with business and technology leaders, driving the measurable success of the Zero Trust implementation.

This playbook helps leaders build and execute a modern Zero Trust security strategy that minimizes business, technical, and security friction while aligning it to the organization’s goals, culture, and unique business model. The playbook includes guidance on prioritization, success criteria, common pitfalls and antipatterns, technology strategy/direction, and how to measvure progress and ongoing success in a quantifiable manner.

Technical Topic Playbooks

The Topic Playbooks focus on groups of roles with related goals, skills, or responsibilities in the organization. These provide a common context for related roles and role-by-role guidance for practitioner and manager roles to enable them to lead and execute their specific part of Zero Trust.

Note

Small organizations may not have dedicated roles for all of these functions, but someone should perform these functions at a basic level in every organization, whether a part of a job for an existing role, by an outsourced provider, or by another means.

These playbooks focus on topics including the following:

• SecOps/SOC: These roles reduce risk to the organization by rapidly finding attackers with access to your business assets and removing them quickly and completely (analogous to firefighters who put out active fires). This playbook provides guidance for SecOps roles that triage inbound detections (Tier 1), investigate and remediate them (Tier 2), hunt for hidden threats, inform others of learnings (TI), manage incidents, manage SecOps teams, and more. The playbook guides these critically important roles through how to do this in today’s world. This playbook enables SecOps roles to successfully reduce organizational risk using asset-centric Zero Trust approaches, tools, processes, and more (which supplement or replace existing approaches of detecting and blocking attacks at a network perimeter).
• Architecture, posture, and compliance: These roles work across teams to ensure that the strategy is executed and operated consistently across teams and over time. Architecture roles provide critical support for directors and managers who translate strategy into specific plans, priorities, and requirements for their individual teams. Security posture and compliance roles ensure that the organization is consistently satisfying regulatory requirements while also keeping up with attackers who are continuously changing attack techniques. This playbook enables these roles to keep all the specialized teams working together toward a common Zero Trust vision.

Architects are critical to the successful integration of silos

It is strongly recommended to assign architect role(s) with an explicit goal of building an end-to-end vision to help identify and resolve gaps in cross-team processes and cross-cutting capabilities. Integrating teams is critical as these transformations disrupt the norms of past responsibilities and team structures. Whether using an architect title or not, having a role focused on this end-to-end view is a key enabler for the success of digital, cloud, and Zero Trust transformations.

Without role(s) focused on finding and solving these problems, transformations can slow down or fail with different teams blaming each other—an outcome that benefits nobody. The playbook’s design, including a six-stage execution plan, includes mitigations for these challenges. See Chapter 9, The Zero Trust Six-Stage Plan, for more details.

Architects also work in many other roles across the organization and often need to familiarize themselves with those roles (and how Zero Trust is changing those roles) by reading their playbooks. The guidance for each role in the playbooks includes more detail on these interactions between architects and other teams.

• Technical engineering and operations: These roles put Zero Trust into action by integrating security into the design, implementation, and operation of technology that the organization relies on every day. Technical managers translate strategic goals into specific technical plans and priorities for their teams, engineers design it for scale across the technical estate, and operations professionals implement, configure, and sustain it. The playbook provides role-by-role guidance for technical practitioners and managers to guide you through how Zero Trust affects each aspect of daily practices and processes. The playbook includes guidance on solution and technology selection, design patterns to embrace and avoid, technical process design, technical configurations, operational best practices, how to integrate with security teams and DevOps/DevSecOps teams on security, how to plan to rapidly recover from attacks, and more.
• Product and application security: These roles integrate security into the design, implementation, and operation of custom applications, websites, services, and APIs. These workloads are required to digitally transform the organization, spanning internal business processes as well as the products and services used by the organization’s customers. Integrating security into these teams is critical to reduce organizational risk from compromise of these systems, the data in them, and the access they have to other systems and data.

  In the modern agile delivery model that most digital enterprises operate in, product managers are responsible for integrating security into the product strategy they build to support business goals and steward business and customer data. These roles also work with product owners to translate the product strategy into product business requirements that meet security, business risk, and regulatory obligations. Solution and enterprise architects will often work with product managers to keep the product strategy and product requirements aligned with the organization’s over-arching strategy, methods, and compliance requirements. Security architects provide security oversight and governance, helping establish or update security architectures for these solutions. Application architects design technical solutions that meet the requirements and plan how to build applications and components, while developers implement these applications and components using security best practices and standards. DevOps/DevSecOps teams or technical operations teams enable this process by instrumenting and automating the development and operations, ensuring that security governance checks and best practices are automated, built in, and as frictionless as possible. Software security engineers provide security expertise for all roles along all the phases. The playbook guides these teams through the process of blending security expertise with product and application expertise as these roles build custom capabilities for the application and product portfolio(s).

Notes about the content in the playbooks

Security-focused: The playbooks focus on the security aspects of each role and only cover non-security aspects of the roles when that context is required for security.

Outcome-focused: The playbooks focus on the security outcomes that may be performed by technology teams, DevOps/DevSecOps teams, security teams, or outsourced providers. The playbooks also describe who performs the tasks when the specialization doesn’t exist so that you can quickly adapt the guidance to smaller organizations; see Chapter 10, Zero Trust Playbook Roles, for more details.

Durability-focused: The playbooks do not include step-by-step technical configuration instructions. Product technical details change too fast today for any written guidance to stay current for more than a few months. The playbooks include clear technical guidance and criteria that are immediately actionable and can drive decisions, but will also endure for years as technical roles and the technical estate transform with Zero Trust.

Real-world examples: These playbooks include many examples of how to apply this guidance in a real-world setting using Acme examples from multiple industries.

Futures

Everyone—all roles need clarity on the future trends that will shape and influence their role and Zero Trust so that they can anticipate changes coming around the corner.

This Zero Trust Futures book is for everyone and describes how to apply the Zero Trust approach to emerging technologies that are rapidly evolving and growing. This includes a discussion on the Internet of Things (IoT), artificial intelligence (AI), affective computing, the metaverse(s), and more.

The Zero Trust Playbook Series cuts through noise, connects people together, reduces conflict, and accelerates the benefits of Zero Trust. This format and structure set you and your organization up for success by providing a complete set of implications and perspectives, enabling teams to coordinate effectively, transform successfully, and execute rapidly.

In this chapter, we reviewed how the series is structured and the best strategies for getting to the information you need.

Next up, in Chapter 3, Zero Trust Is Security for Today’s World, we will take a deeper look at the importance and implications of Zero Trust, including dispelling common myths and misconceptions.