What I Learned About Zero Trust from John Kindervag

Me with John Kindervag at Cyber Huntsville event

I attended a Cyber Huntsville presentation by John Kindervag, the creator of Zero Trust Architecture (ZTA). Going into the presentation, I thought Zero Trust was mostly about identity, multi-factor authentication, and verifying users before granting access.

I quickly learned that many of the things people believe about Zero Trust are actually misconceptions.

One statement that stood out immediately was:

"Zero Trust is the world's only cybersecurity strategy."

That sounds like a bold claim, but as the presentation continued, I started to understand what he meant.

Trust Is the Problem

Kindervag defines Zero Trust as:

A strategy designed to stop data breaches and prevent cyber attacks from being successful by eliminating trust from digital systems.

He repeatedly emphasized that trust itself is the vulnerability.

As he put it:

"Trust, in general, is a bad thing."

Traditional cybersecurity assumes certain things can be trusted. If a user is inside the network, they're trusted. If a device is connected to the LAN, it's trusted. If traffic comes from an approved location, it's trusted.

Zero Trust challenges those assumptions.

The goal isn't to create trusted systems.

The goal is to eliminate unnecessary trust wherever possible.

Zero Trust Is Not What Most People Think

One of the most interesting parts of the presentation was a list of common misconceptions.

According to Kindervag, all of the following statements are false:

• Zero Trust means making a system trusted
• Zero Trust is all about identity
• There are Zero Trust products
• Zero Trust is complicated

This was particularly interesting because many vendors market "Zero Trust solutions."

Zero Trust isn't a product.

It's a strategy.

No appliance, software package, or cloud service automatically makes an organization Zero Trust.

The Protect Surface

The concept that resonated with me the most was the Protect Surface.

Most security professionals are familiar with the idea of an attack surface. We spend a lot of time trying to understand everything that could potentially be attacked.

Kindervag proposes the opposite approach.

Instead of focusing on the attack surface, focus on the protect surface.

A protect surface consists of:

DAAS

• Data
• Applications
• Assets
• Services

These are the things that actually matter.

These are the resources we are trying to protect.

Instead of attempting to secure everything at once, Zero Trust starts by identifying a single protect surface and building controls around it.

This creates what Kindervag calls a microperimeter.

The controls should be placed as close as possible to the protect surface itself.

The smaller and more well-defined the protect surface becomes, the easier it is to understand, secure, and monitor.

Dwell Time Shouldn't Matter

One idea that challenged my thinking was Kindervag's discussion of dwell time.

In traditional cybersecurity, dwell time measures how long an attacker remains in the network before being detected.

In a properly designed Zero Trust architecture, he argues that dwell time effectively stops mattering.

The question changes from:

"How long was the attacker in our network?"

to

"What were they actually able to access?"

Someone may successfully gain entry into a network.

The critical question is whether they can reach the protect surface or remove sensitive data.

If proper segmentation and policy enforcement exist, the attacker's blast radius becomes extremely limited.

Segmentation Is the Foundation

Another statement I wrote down word-for-word was:

"Segmentation is the foundation of Zero Trust."

This aligns closely with my own experiences working in IT and networking.

Many organizations believe VLANs provide segmentation.

Kindervag challenged that assumption directly.

As he explained:

"VLANs break up broadcast domains. They do not segment networks."

Real segmentation requires enforcement.

A policy enforcement point must exist between systems.

If traffic can move freely between network segments, meaningful security boundaries do not exist.

Flat networks remain one of the most dangerous architectures because they allow attackers to move laterally after initial compromise.

The goal of segmentation is containment.

Malware should be trapped inside a limited blast radius rather than spreading throughout the environment.

The Five-Step Method

One of the most practical parts of the presentation was Kindervag's Five-Step Method for deploying Zero Trust.

1. Define the Protect Surface

What are we trying to protect?

Start with a single DAAS element.

Do not try to secure everything simultaneously.

As Kindervag explained:

"You have to go one room at a time."

Zero Trust is incremental and non-destructive.

2. Map the Transaction Flows

Understand how systems actually communicate.

Before creating security policies, you must understand how the environment functions.

3. Architect the Zero Trust Environment

Build the architecture around protecting the specific protect surface.

There is no universal reference architecture.

Every environment is different.

4. Create a Zero Trust Policy

Start with deny-all.

Then add only the permissions that are necessary.

This follows the principle:

"Don't give access to people that don't need it to do their job."

5. Monitor and Maintain

Security is never finished.

The environment must be continuously monitored and refined.

Anti-Fragile Networks

Another concept I found interesting was anti-fragility.

Kindervag recommended reading Antifragile by Nassim Nicholas Taleb.

An anti-fragile system doesn't simply survive stress.

It improves because of stress.

The human body is an example.

Exercise damages muscles temporarily, but they become stronger during recovery.

The same principle can apply to networks.

A Zero Trust environment should continuously learn, adapt, and improve as threats evolve.

This creates a feedback loop that strengthens security over time.

Policy Is Everything

One recurring theme throughout the presentation was policy.

Everything in Zero Trust is instantiated through policy.

Kindervag referenced the Kipling Method of rule writing:

• Who
• What
• When
• Where
• Why
• How

Every access decision should be answerable through policy.

Not assumptions.

Not trust.

Policy.

Final Thoughts

The biggest takeaway from the presentation was that Zero Trust is not a technology.

It is not a product.

It is not a software package.

It is a strategy.

A strategy centered around protecting what matters most, enforcing segmentation, reducing blast radius, and preventing attackers from extracting valuable data.

As someone working in healthcare IT while studying Cybersecurity Engineering, I found the Protect Surface concept especially valuable.

Most organizations cannot secure everything equally.

But they can identify their most important data, applications, assets, and services and build meaningful protections around them.

That is where Zero Trust begins.

And according to John Kindervag, that is where modern cybersecurity should begin as well.