Zero Trust Workshop!

Key Concepts

• Zero Trust: A security framework based on "never trust, always verify."
• NIST Zero Trust Architecture: A framework outlining the key areas of zero trust implementation.
• Microsoft Graph: An API that allows interaction with various Microsoft services like Entra ID and SharePoint.
• Zero Trust Workshop: A free, open-source roadmap for organizations to implement zero trust principles.
• Swim Lanes: Threads of effort within the workshop that represent specific tasks or projects.
• Conditional Access: Policies that grant access to resources based on certain conditions.
• Workload Identities: Identities assigned to applications and services.
• Identity Assessment: Evaluation of an organization's identity security posture.
• Device Assessment: Evaluation of an organization's device security posture.
• Key Pillars of Zero Trust: Identity, Devices, Network, Infrastructure, Apps, and Data.

1. Introduction to Zero Trust and the Workshop

• Zero trust is presented as a highly sought-after security model.
• The core principles of zero trust are: "always verify," "least privilege access," and "assume breach."
• The NIST framework for zero trust is comprehensive but can be overwhelming.
• The Microsoft ecosystem offers various tools to address different aspects of zero trust.
• The Zero Trust Workshop is introduced as a free resource to guide organizations in their zero trust journey.
• The workshop has been developed over a year and a half through a collaboration of multiple Microsoft teams (Intune, Purview, Sentinel, Azure, Entra, etc.).
• The workshop is open-sourced, with scripts available on GitHub for customization.

2. The Two-Part Approach: Assessment and Planning

• The workshop consists of two main parts: an assessment and a planning phase.
• Step One: Running the Assessment Tool:
  • Involves running a PowerShell script against the Microsoft Graph.
  • The script acts as a retroactive tool, identifying existing configurations and potential gaps.
  • It helps to level-set the current state of identity and device security.
• Step Two: Downloading the Workshop Tool (Excel Spreadsheet):
  • The Excel spreadsheet is the core of the planning phase.
  • It focuses on the key pillars of zero trust: identity, devices, network, infrastructure, apps, and data.

3. The Assessment Report

• The PowerShell script generates an assessment report covering identity and device security.
• The report highlights areas that have been configured, those that are in progress, and those that have not yet been started.
• Example: The identity assessment might indicate whether conditional access policies for workload identities have been configured.
• Each item in the report includes details and links to learn more about the specific activity.

4. The Workshop Tool (Excel Spreadsheet) and Swim Lanes

• The Excel spreadsheet is organized around the key pillars of zero trust, not specific products.
• Within each pillar, there are "swim lanes" representing threads of effort or tasks.
• Example: Under the "Identity" pillar, there are swim lanes for "Design conditional access posture," "Roll out conditional access authentication strength and control," and "Roll out conditional access with device state and app management."
• Each task has associated "implementation effort" and "user impact" levels.
• Users can track their progress for each task (Not Started, In Planning, Planned, etc.).
• The spreadsheet allows for tracking the use of third-party solutions.
• Clicking on a task links to a page with detailed documentation, including reasons for the effort and impact levels, and reference information.

5. Workshop Delivery Guidance and Timelines

• The workshop delivery guidance provides rough estimates for timelines.
• Timelines may vary depending on the organization's expertise and the availability of responsible parties.
• The workshop requires involvement from various individuals within the organization.

6. Workshop Videos (For Partners/Consultants)

• Workshop videos are available but are primarily intended for partners or consultants who will be running the workshop for customers.
• The videos cover how to interact with customers and break down the various activities.
• Customers running the workshop themselves do not necessarily need to watch the videos.

7. Continuous Evolution and Benefits

• The Zero Trust Workshop is an evolving resource that Microsoft is heavily invested in.
• The assessment script and plans are expected to be updated as capabilities and guidance evolve.
• Even partial implementation of zero trust principles can benefit an organization.
• Individuals responsible for specific areas (e.g., identity) can use the workshop to improve their organization's security posture.

8. Notable Quotes

• "Zero trust has become this holy grail that every organization seeks to achieve."
• "Remember the Microsoft Graph is that API and interaction that lets us talk to things about Entra and SharePoint and many other Microsoft services."
• "These videos were designed for a partner. So, if you're a partner, if you're a consultant and you want to run the workshop for customers, you would want to watch these videos cuz they will talk about how you're going to interact with the customer, how you're going to break down the various activities."

9. Conclusion

• The Zero Trust Workshop is a valuable, free resource for organizations looking to implement zero trust principles.
• It provides a structured approach with an initial assessment and a detailed planning phase using an Excel spreadsheet with swim lanes.
• The workshop is designed to be customizable and adaptable to different organizational needs.
• Even partial implementation of the workshop's recommendations can significantly improve an organization's security posture.