Executive Order 14028 & Zero Trust Architecture - Now We Must, But What It Means?

The talk looks at Executive Order 14028, issued in May 2021, and the federal strategy that followed in January 2022 to move US government agencies toward Zero Trust Architecture. The speaker argues that the term is overused and misunderstood, and that vendors often sell it as a product. He recalls asking booth staff at a major security conference what they meant by Zero Trust and getting mostly inconsistent answers. He frames it as a long journey and a change in mindset rather than a checkbox.

The middle section traces the idea from early work by the Jericho Forum and the BeyondCorp model to NIST SP 800-207. The speaker argues that cloud services, remote work and personal devices have made network-based trust obsolete, so every request should be verified against context, with privileges granted narrowly and removed afterward. Identity becomes the foundation, covering users, devices, services and data. He warns that tokens can be copied or replayed and need their own protections, and that usability and privacy must be designed in rather than traded away. Open standards and interoperability are presented as part of the answer, with one open-source identity project offered as an example of building blocks, while the speaker notes it does not solve every problem.

In the closing question round, the discussion turned to legacy industrial control systems that cannot be replaced quickly. The speaker suggested stopgaps such as reverse proxies and microsegmentation. The practical takeaway is to identify your crown jewels and weakest points, prioritize the highest-impact steps, and expect the model to keep evolving.