Zero Trust Pillar 2
Device
Device Capabilities
Device Inventory
Organizations establish and maintain an approved inventory list of all devices authorized to access the network and enroll all devices on the network prior to network connection. Device attributes will include technical details such as the PKI (802.1x) machine certificate, device object, patch/vulnerability status and others to enable successor activities
Device Detection and Compliance
Organizations employ asset management systems for user devices to maintain and report on IT and Cybersecurity compliance. Managed devices (enterprise and mobile) attempting to connect to a network or access a DAAS resource is detected and has its compliance status confirmed via Comply-to-Connect (C2C)
Device Authorization w/ Real Time Inspection
Organizations conduct foundational and extended device tooling (NextGen AV, AppControl, File Integrity Monitoring (FIM), etc.) integration to better understand the risk posture. Organizational PKI systems are integrated to expand the existing Enterprise PKI to devices as well. Lastly, Entity Activity Monitoring is also integrated to identify anomalous activities
Remote Access
Organizations audit existing device access processes and tooling to set a least privilege baseline. In phase 2 this access is expanded to cover basic BYOD and IOT support using the Enterprise IDP for approved applications. The final phases expand coverage to include all BYOD and IOT devices for services using the approved set of device attributes
Partial & Full Automated Asset, Vulnerability and Patch Management
Organizations establish processes to automatically test and deploy vendor patches for connected devices; hybrid patch management (both human and automated) is employed
Unified Endpoint Management (UEM) & Mobile Device Management (MDM)
Organizations establish a centralized UEM solution that provides the choices of agent and/or agentless management of computer and mobile devices to a single console regardless of device location. Organization issued devices can be remotely managed and security policies are enforced
Endpoint & Extended Detection & Response (EDR & XDR)
Organizations use endpoint detection and response (EDR) tooling to monitor, detect, and remediate malicious activity on endpoints. Expanding the capability to include XDR tooling allows organizations to account for activity beyond the endpoints such as cloud and network as well