Zero Trust in the era of cloud by: Vandana Verma Sehgal aka InfosecVandana

### Overview In this presentation, Vandana Verma Sehgal explores the shift from legacy boundary-based security models to Zero Trust architectures, specifically within the context of cloud adoption and distributed remote work. She explains that traditional network security operated under the assumption that internal users and traffic were inherently trustworthy. However, the rise of insider threats, credential theft, advanced persistent threats (APTs), and perimeter-less cloud deployments invalidates perimeter defenses. The presentation highlights that Zero Trust is not a single product or bolt-on tool, but a fundamental security strategy that flips the old mantra of "trust, but verify" into "never trust, always verify."

### Key Topics - **Deficiencies of Traditional Perimeters:** Relying on physical office walls, firewalls, and broad network zones fails when remote work expands and malicious actors obtain legitimate administrative credentials or exploit insider access. - **Cost and Frequency of Breaches:** Citing statistics from Cyber Security Ventures and Ponemon/IBM, the talk notes rising cybersecurity costs ($6 trillion by 2021) and breach costs ($3.62 million average), highlighting that roughly 80% of data breaches involve privileged access abuse. - **Core Tenets of Zero Trust:** The model assumes environments are hostile, emphasizing the continuous verification of users and devices, strict access governance, and establishing micro-perimeters. - **Architectural Planes and Protect Surfaces:** Zero Trust differentiates between the control plane (management and configuration) and the data plane. It focuses on identifying and securing a specific "protect surface" consisting of critical data, applications, and services. - **Modern Identity and Access Management (IAM):** Identity acts as the new perimeter. Organizations must move beyond static Role-Based Access Control (RBAC) to context-aware, adaptive access controls, Multi-Factor Authentication (MFA), and Just-In-Time (JIT) least-privilege models.

### Technical Details - **Network Segmentation & Gateways:** Enterprises should create micro-perimeters using segmentation gateways (such as Next-Generation Firewalls) to gain granular application-layer visibility and block lateral movement or data exfiltration. - **Traffic Encryption & Telemetry:** All network traffic must be encrypted regardless of origin. Continuous zone-wise logging and monitoring are required to preserve audit trails for post-incident analysis. - **Data Categorization:** Security teams must classify information (e.g., confidential, internal, restricted, or public) to avoid wasting defensive resources on non-critical data while ensuring sensitive data (such as PII or payment card data) is strictly governed. - **Identity Best Practices:** Avoid using root or master cloud accounts for everyday development; instead, use delegated administrator roles and separate permissions across production environments. To bridge legacy software into modern authentication flows (such as SAML, OAuth, or OIDC), organizations can place reverse proxies or web seals in front of legacy systems. - **Cloud Shared Responsibility & Contracts:** Addressing an audience question regarding SOC 2 reports and cloud contracts, Sehgal stresses that while third-party audits must sometimes be relied upon when providers forbid direct penetration testing, organizations remain accountable for securing their own assets, configurations, and cloud storage (such as AWS S3 buckets).

### Takeaways Zero Trust implementation requires incremental adoption across the entire organization rather than isolated deployments. Security teams should prioritize identifying sensitive data, mapping data flows, establishing micro-perimeters, enforcing least privilege, and automating detection and response workflows.