The Certificate of Competence in Zero Trust (CCZT) (CCZT)

Data sources are the ZT element that provide information that providers can use to keep policies dynamically updated. Data sources are the inputs that feed the policy engine and the policy administrator with the relevant data and context about the entities, resources, transactions, and environment in the ZTA. Data sources help to inform the policy decisions and actions based on the current state and conditions of the ZTA. Data sources can include identity providers, device management systems, threat intelligence feeds, network monitoring tools, etc.

References  =  Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance ,  Zero Trust Training (ZTT) - Module 3: ZTA Architecture and Components

SPA is a security protocol that prevents device impersonation attacks in a ZTA by hiding the network infrastructure from unauthorized and unauthenticated users. SPA uses a single encrypted packet to convey the user’s identity and request access to a resource. The SPA packet must be digitally signed and authenticated by the SPA server before granting access.  This ensures that only authorized devices can send valid SPA packets and prevents spoofing, replay, or brute-force attacks 1 2 .

References  =

Zero Trust: Single Packet Authorization | Passive authorization

Single Packet Authorization | Linux Journal

During the gap analysis phase of Zero Trust (ZT) planning, risk appetite is typically defined when determining the target state. This step involves setting the desired security goals and objectives, taking into account the organization ' s tolerance for risk. Defining the risk appetite helps in aligning the ZT initiatives with the organization ' s broader risk management strategy, ensuring that the security measures are both effective and aligned with business objectives​​.

Business continuity and disaster recovery are the activities of the ZT implementation preparation phase that ensure the resiliency of the organization’s operations in the event of disruption. Business continuity refers to the process of maintaining or restoring the essential functions of the organization during and after a crisis, such as a natural disaster, a cyberattack, or a pandemic. Disaster recovery refers to the process of recovering the IT systems, data, and infrastructure that support the business continuity. ZT implementation requires planning and testing the business continuity and disaster recovery strategies and procedures, as well as aligning them with the ZT policies and controls.

References  =

Zero Trust Planning - Cloud Security Alliance , section “Monitor & Measure”

Zero Trust architecture: a paradigm shift in cybersecurity - PwC , section “Continuous monitoring and improvement”

Zero Trust Implementation , section “Outline Zero Trust Architecture (ZTA) implementation steps”

Multifactor authentication is a method of validating the identity of an entity by requiring two or more factors, such as something the entity knows (e.g., password, PIN), something the entity has (e.g., token, smart card), or something the entity is (e.g., biometric, behavioral). Multifactor authentication enhances the security of Zero Trust Architecture (ZTA) by reducing the risk of identity compromise and unauthorized access.

References  =  Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance ,  Zero Trust Training (ZTT) - Module 4: Identity and Access Management

Single Packet Authorization (SPA) is a method used in Zero Trust networks to securely request access to a service. A key concept of SPA is that the SPA packet must be self-contained, carrying all necessary information for the authorization decision within a single, encrypted packet. This ensures that the packet alone can provide enough context for the receiving server to authenticate the request and make an authorization decision, without needing additional information exchanges. This self-contained nature of SPA packets aligns with the principle of minimizing the movement and exposure of sensitive credentials, thus enhancing the security of the authentication process​​.

The third step in the SDP onboarding process is to onboard and authenticate the initiating hosts, which are the clients that request access to the protected resources. The initiating hosts connect to and authenticate with the SDP gateway, which acts as an accepting host and a proxy for the protected resources. The SDP gateway verifies the identity and posture of the initiating hosts and grants them access to the resources based on the policies defined by the SDP controller.

References  =

Certificate of Competence in Zero Trust (CCZT) prepkit , page 21, section 3.1.2

6 SDP Deployment Models to Achieve Zero Trust | CSA , section “Deployment Models Explained”

Software-Defined Perimeter (SDP) and Zero Trust | CSA , page 7, section 3.1

ZTA planning can improve the developer experience by streamlining access provisioning to deployment environments. This means that developers can access the resources and services they need to deploy their applications in a fast and secure manner, without having to go through complex and manual processes. ZTA planning can also help to automate and orchestrate the access provisioning using dynamic and granular policies based on the context and attributes of the developers, devices, and applications.

References  =  Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance ,  Zero Trust Training (ZTT) - Module 10: ZTA Planning and Implementation

The first step that organizations should take to strengthen access requirements and protect their resources from unauthorized access by potential cyber threats is to understand and identify the data and assets that need to be protected. This step involves conducting a data and asset inventory and classification, which helps to determine the value, sensitivity, ownership, and location of the data and assets. By understanding and identifying the data and assets that need to be protected, organizations can define the appropriate access policies and controls based on the Zero Trust principles of never trust, always verify, and assume breach.

References  =  Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance ,  Zero Trust Training (ZTT) - Module 2: Data and Asset Classification