How we structured the playbooks

Because the Zero Trust experience is different for each type of role (business leaders, technology leaders, IT and security managers, and practitioners), we broke the series into different books focusing on groupings of related roles. Each playbook uses examples to illustrate how to apply Zero Trust to different scenarios.

Figure 2.1 shows how different roles can quickly find the information relevant to them:

Figure 2.1 – Playbook series structure

Each book focuses on the needs of specific roles, as outlined here:

• The Zero Trust Overview and Playbook Introduction provides all roles with the shared context you need to understand and navigate Zero Trust.
• The Business and Technical Leadership Playbook provides role-by-role guidance for business, technical, and security leadership roles to successfully integrate security and align security with business priorities and risk management. This also guides the integration of security and technology teams, processes, and tooling.
• The Topic Playbooks provide role-by-role guidance for practitioners and managers across security, technology, and business teams to navigate, lead, and execute the Zero Trust transformation.
• The Zero Trust Futures provides all roles with insight into what changes are coming around the corner that will continue to disrupt and shape Zero Trust so that you can anticipate and manage the next stage of continuous changes.

The playbooks follow a three-pillar structure frequently used in business strategy and planning (strategic, operational, and operating models). This is described in detail in Chapter 8, Adoption with the Three-Pillar Model.

Now, let’s take a look at the approach and content of each type of book in the series.

Zero Trust Overview and Playbook Introduction

Everyone—all roles need the critical common context on Zero Trust in this book, Zero Trust Overview and Playbook Introduction. This book defines what Zero Trust is and puts it into the context of digital transformation, information security, business risk and impact, and security strategy. It also provides an overview of the Zero Trust reference model and architecture, busts some common myths and misconceptions, and introduces the six-stage playbook, three-pillar model, role-based approach, Acme corporation examples, and more.

Business and Technical Leadership Playbook

Business, technical, and security leadership roles each have a part in leading the Zero Trust transformation or integrating it with the organization’s business and risk management. This book describes in detail how leaders ensure Zero Trust delivers the full benefits of business agility and reduced organizational risk (while integrating it smoothly with digital business and cloud technology transformations). The book enables these leaders to quickly overcome common challenges and points of confusion (and conflict) that naturally arise during this process.

The Business and Technical Leadership Playbook provides role-by-role guidance for each of these leaders to drive success and avoid common challenges in this integration process.

This playbook includes guidance for these roles:

• Business executives, including CEOs, CFOs, COOs, CLOs, CPOs, CROs, and line-of-business (LOB) leaders, have relatively small but critical parts in the success of Zero Trust. These roles ensure Zero Trust is aligned with the priorities and risks of the organization and provide executive sponsorship to overcome common obstacles. This playbook guides these executives on how to best sponsor, support, guide, and measure Zero Trust to ensure it delivers on promised outcomes.
• Technology leaders, such as CIOs, CTOs, CDOs, and senior directors within those teams, typically support the Zero Trust strategy and initiatives within it. These roles ensure that the technical strategy aligns with the business goals, risk framework, and security strategy. This alignment helps build productive relationships with business and security leaders, driving the measurable success of the Zero Trust implementation.
• Security leaders, such as CISOs and senior directors within those teams, typically lead the Zero Trust strategy and sponsor initiatives within it. These roles ensure that the security strategy aligns with the business goals, risk framework, and technical strategy. This alignment helps build productive relationships with business and technology leaders, driving the measurable success of the Zero Trust implementation.

This playbook helps leaders build and execute a modern Zero Trust security strategy that minimizes business, technical, and security friction while aligning it to the organization’s goals, culture, and unique business model. The playbook includes guidance on prioritization, success criteria, common pitfalls and antipatterns, technology strategy/direction, and how to measvure progress and ongoing success in a quantifiable manner.

Technical Topic Playbooks

The Topic Playbooks focus on groups of roles with related goals, skills, or responsibilities in the organization. These provide a common context for related roles and role-by-role guidance for practitioner and manager roles to enable them to lead and execute their specific part of Zero Trust.

Note

Small organizations may not have dedicated roles for all of these functions, but someone should perform these functions at a basic level in every organization, whether a part of a job for an existing role, by an outsourced provider, or by another means.

These playbooks focus on topics including the following:

• SecOps/SOC: These roles reduce risk to the organization by rapidly finding attackers with access to your business assets and removing them quickly and completely (analogous to firefighters who put out active fires). This playbook provides guidance for SecOps roles that triage inbound detections (Tier 1), investigate and remediate them (Tier 2), hunt for hidden threats, inform others of learnings (TI), manage incidents, manage SecOps teams, and more. The playbook guides these critically important roles through how to do this in today’s world. This playbook enables SecOps roles to successfully reduce organizational risk using asset-centric Zero Trust approaches, tools, processes, and more (which supplement or replace existing approaches of detecting and blocking attacks at a network perimeter).
• Architecture, posture, and compliance: These roles work across teams to ensure that the strategy is executed and operated consistently across teams and over time. Architecture roles provide critical support for directors and managers who translate strategy into specific plans, priorities, and requirements for their individual teams. Security posture and compliance roles ensure that the organization is consistently satisfying regulatory requirements while also keeping up with attackers who are continuously changing attack techniques. This playbook enables these roles to keep all the specialized teams working together toward a common Zero Trust vision.

Architects are critical to the successful integration of silos

It is strongly recommended to assign architect role(s) with an explicit goal of building an end-to-end vision to help identify and resolve gaps in cross-team processes and cross-cutting capabilities. Integrating teams is critical as these transformations disrupt the norms of past responsibilities and team structures. Whether using an architect title or not, having a role focused on this end-to-end view is a key enabler for the success of digital, cloud, and Zero Trust transformations.

Without role(s) focused on finding and solving these problems, transformations can slow down or fail with different teams blaming each other—an outcome that benefits nobody. The playbook’s design, including a six-stage execution plan, includes mitigations for these challenges. See Chapter 9, The Zero Trust Six-Stage Plan, for more details.

Architects also work in many other roles across the organization and often need to familiarize themselves with those roles (and how Zero Trust is changing those roles) by reading their playbooks. The guidance for each role in the playbooks includes more detail on these interactions between architects and other teams.

• Technical engineering and operations: These roles put Zero Trust into action by integrating security into the design, implementation, and operation of technology that the organization relies on every day. Technical managers translate strategic goals into specific technical plans and priorities for their teams, engineers design it for scale across the technical estate, and operations professionals implement, configure, and sustain it. The playbook provides role-by-role guidance for technical practitioners and managers to guide you through how Zero Trust affects each aspect of daily practices and processes. The playbook includes guidance on solution and technology selection, design patterns to embrace and avoid, technical process design, technical configurations, operational best practices, how to integrate with security teams and DevOps/DevSecOps teams on security, how to plan to rapidly recover from attacks, and more.
• Product and application security: These roles integrate security into the design, implementation, and operation of custom applications, websites, services, and APIs. These workloads are required to digitally transform the organization, spanning internal business processes as well as the products and services used by the organization’s customers. Integrating security into these teams is critical to reduce organizational risk from compromise of these systems, the data in them, and the access they have to other systems and data.

  In the modern agile delivery model that most digital enterprises operate in, product managers are responsible for integrating security into the product strategy they build to support business goals and steward business and customer data. These roles also work with product owners to translate the product strategy into product business requirements that meet security, business risk, and regulatory obligations. Solution and enterprise architects will often work with product managers to keep the product strategy and product requirements aligned with the organization’s over-arching strategy, methods, and compliance requirements. Security architects provide security oversight and governance, helping establish or update security architectures for these solutions. Application architects design technical solutions that meet the requirements and plan how to build applications and components, while developers implement these applications and components using security best practices and standards. DevOps/DevSecOps teams or technical operations teams enable this process by instrumenting and automating the development and operations, ensuring that security governance checks and best practices are automated, built in, and as frictionless as possible. Software security engineers provide security expertise for all roles along all the phases. The playbook guides these teams through the process of blending security expertise with product and application expertise as these roles build custom capabilities for the application and product portfolio(s).

Notes about the content in the playbooks

Security-focused: The playbooks focus on the security aspects of each role and only cover non-security aspects of the roles when that context is required for security.

Outcome-focused: The playbooks focus on the security outcomes that may be performed by technology teams, DevOps/DevSecOps teams, security teams, or outsourced providers. The playbooks also describe who performs the tasks when the specialization doesn’t exist so that you can quickly adapt the guidance to smaller organizations; see Chapter 10, Zero Trust Playbook Roles, for more details.

Durability-focused: The playbooks do not include step-by-step technical configuration instructions. Product technical details change too fast today for any written guidance to stay current for more than a few months. The playbooks include clear technical guidance and criteria that are immediately actionable and can drive decisions, but will also endure for years as technical roles and the technical estate transform with Zero Trust.

Real-world examples: These playbooks include many examples of how to apply this guidance in a real-world setting using Acme examples from multiple industries.

Futures

Everyone—all roles need clarity on the future trends that will shape and influence their role and Zero Trust so that they can anticipate changes coming around the corner.

This Zero Trust Futures book is for everyone and describes how to apply the Zero Trust approach to emerging technologies that are rapidly evolving and growing. This includes a discussion on the Internet of Things (IoT), artificial intelligence (AI), affective computing, the metaverse(s), and more.

The Zero Trust Playbook Series cuts through noise, connects people together, reduces conflict, and accelerates the benefits of Zero Trust. This format and structure set you and your organization up for success by providing a complete set of implications and perspectives, enabling teams to coordinate effectively, transform successfully, and execute rapidly.