Panel Discussion - Zero Trust: From Digital Identity to Managing Supply Chain Risks

Defining Zero Trust

Panelists trace "zero trust" to Stephen Marsh's 1994 thesis, later popularized by Forrester and NIST as perimeterless security where every user, device, and service is untrusted by default—summarized as "never trust, always verify."

Real-World Flexibility

Speakers reject one-size-fits-all zero trust. Startups on uniform Microsoft stacks differ from heterogeneous enterprises with OT, manufacturing, and legacy apps. Controls must map to asset criticality or risk blocking legitimate work.

Graduated Assurance

Trust should scale like physical badges: lobby access differs from server-room biometrics. MFA is necessary but insufficient—users habitually approve prompts, machine integrations skip MFA entirely, and pilots carrying sensitive cargo need location and device pairing without crushing privacy.

Supply Chain and Identity

Discussion extends to digital identity, pilot device pairing at ASL, and supply-chain risk inside zero-trust programs, emphasizing visibility into users, data, devices, and applications before enforcing universal policies.