Implementing Zero Trust in Government Settings: Strategies, Challenges, and Best Pra...
summary
Argues that government Zero Trust requires concrete engineering: a CI/CD pipeline with ephemeral runners, SBOMs signed and attested into OCI layers using cosign and Trivy, and a Lambda that daily verifies running containers; reports ~150 CVEs/day and ~267,000 tracked CVEs, remediation often >100 days while exploits can appear in <12 hours; recommends NIST SSDF 800-218 as a task list, incremental implementation, least-privilege roles, and examples of a successful govcloud/commercial account separation funded by NNSA.
AI-written summary · about
chapters (9)
- 0:00Zero trust in government
- 5:43Executive orders and threats
- 13:19Zero trust principles
- 20:13NIST secure software guidelines
- 25:34Zero trust adoption steps
- 33:56Why zero trust projects fail
- 36:05Zero trust tools and monitoring
- 40:07Handling critical vulnerabilities
- 41:30Q&A
related talks
34mZero Trust Best Practices in Government and Federal Industries
47mThwarting the Adversary: Bending the Zero Trust Curve to Defense
28mZero Trust Architecture - Now We Must, But What It Means?
45mZero Trust: Getting to Step One..and What to Do When You Get There
25mBuilding a DevOps Supply Chain on Zero Trust Principles
24mExploring Zero Trust, Threat Intelligence, and Secure SDLC
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
01h 02mIntroduction to Zero Trust Security