(PDF Download) Zero Trust Access For Dummies, Fortinet Special Edition Lawrence Miller Fulll Chapter

Full download test bank at ebook ebookmass.
com
Zero Trust Access For Dummies,

Fortinet Special Edition Lawrence
Miller
CLICK LINK TO DOWLOAD
https://ebookmass.com/product/zero-trust-
access-for-dummies-fortinet-special-edition-
lawrence-miller/
ebookmass.com
More products digital (pdf, epub, mobi) instant
download maybe you interests ...
Oracle Autonomous Database For Dummies®, 3rd Special

Edition Lawrence Miller
https://ebookmass.com/product/oracle-autonomous-database-for-
dummies-3rd-special-edition-lawrence-miller/
CISSP For Dummies, 7th Edition Lawrence C. Miller
https://ebookmass.com/product/cissp-for-dummies-7th-edition-
lawrence-c-miller/
Privileged Access Management For Dummies®, Delinea

Special Edition Joseph Carson
https://ebookmass.com/product/privileged-access-management-for-
dummies-delinea-special-edition-joseph-carson/
Zero-trust – An Introduction 1st Edition Tom Madsen
https://ebookmass.com/product/zero-trust-an-introduction-1st-
edition-tom-madsen/
Water Treatment For Dummies®, 2nd WQA Special Edition
Dummies
https://ebookmass.com/product/water-treatment-for-dummies-2nd-
wqa-special-edition-dummies/
Zero Waste Cooking For Dummies 1st Edition Rosanne Rust
https://ebookmass.com/product/zero-waste-cooking-for-dummies-1st-
edition-rosanne-rust/
Access For Dummies Laurie A. Ulrich
https://ebookmass.com/product/access-for-dummies-laurie-a-ulrich/
5G & Beyond For Dummies Larry Miller
https://ebookmass.com/product/5g-beyond-for-dummies-larry-miller/
Investing In Dividends For Dummies, 2nd Edition

Lawrence Carrel
https://ebookmass.com/product/investing-in-dividends-for-
dummies-2nd-edition-lawrence-carrel/
These materials are © 2022 John Wiley & Sons, Inc. Any dissemination, distribution, or unauthorized use is strictly prohibited.
Zero Trust
Access
Fortinet Special Edition
by Lawrence Miller
Zero Trust Access For Dummies®, Fortinet Special Edition
Published by
John Wiley & Sons, Inc.
111 River St.
Hoboken, NJ 07030-5774
www.wiley.com
Copyright © 2022 by John Wiley & Sons, Inc., Hoboken, New Jersey
No part of this publication may be reproduced, stored in a retrieval system or transmitted in any
form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise,
except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without
the prior written permission of the Publisher. Requests to the Publisher for permission should be
addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ
07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.
Trademarks: Wiley, For Dummies, the Dummies Man logo, The Dummies Way, Dummies.com,
Making Everything Easier, and related trade dress are trademarks or registered trademarks of
John Wiley & Sons, Inc. and/or its affiliates in the United States and other countries, and may not
be used without written permission. Fortinet is a registered trademark of Fortinet, Inc. All other
trademarks are the property of their respective owners. John Wiley & Sons, Inc., is not associated
with any product or vendor mentioned in this book.
LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: WHILE THE PUBLISHER AND AUTHORS HAVE

USED THEIR BEST EFFORTS IN PREPARING THIS WORK, THEY MAKE NO REPRESENTATIONS
OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS OF
THIS WORK AND SPECIFICALLY DISCLAIM ALL WARRANTIES, INCLUDING WITHOUT LIMITATION
ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
NO WARRANTY MAY BE CREATED OR EXTENDED BY SALES REPRESENTATIVES, WRITTEN
SALES MATERIALS OR PROMOTIONAL STATEMENTS FOR THIS WORK. THE FACT THAT AN
ORGANIZATION, WEBSITE, OR PRODUCT IS REFERRED TO IN THIS WORK AS A CITATION AND/
OR POTENTIAL SOURCE OF FURTHER INFORMATION DOES NOT MEAN THAT THE PUBLISHER
AND AUTHORS ENDORSE THE INFORMATION OR SERVICES THE ORGANIZATION, WEBSITE, OR
PRODUCT MAY PROVIDE OR RECOMMENDATIONS IT MAY MAKE. THIS WORK IS SOLD WITH
THE UNDERSTANDING THAT THE PUBLISHER IS NOT ENGAGED IN RENDERING PROFESSIONAL
SERVICES. THE ADVICE AND STRATEGIES CONTAINED HEREIN MAY NOT BE SUITABLE FOR
YOUR SITUATION. YOU SHOULD CONSULT WITH A SPECIALIST WHERE APPROPRIATE. FURTHER,
READERS SHOULD BE AWARE THAT WEBSITES LISTED IN THIS WORK MAY HAVE CHANGED
OR DISAPPEARED BETWEEN WHEN THIS WORK WAS WRITTEN AND WHEN IT IS READ.
NEITHER THE PUBLISHER NOR AUTHORS SHALL BE LIABLE FOR ANY LOSS OF PROFIT OR ANY
OTHER COMMERCIAL DAMAGES, INCLUDING BUT NOT LIMITED TO SPECIAL, INCIDENTAL,
CONSEQUENTIAL, OR OTHER DAMAGES.
For general information on our other products and services, or how to create a custom For
Dummies book for your business or organization, please contact our Business Development
Department in the U.S. at 877-409-4177, contact [email protected], or visit www.wiley.com/
go/custompub. For information about licensing the For Dummies brand for products or services,
contact BrandedRights&[email protected].
ISBN 978-1-119- 85984-0 (pbk); ISBN 978-1-119- 85985-7 (ebk)
Publisher’s Acknowledgments
Some of the people who helped bring this book to market include the
following:
Project Manager: Jen Bingham Editorial Manager: Rev Mengle
Acquisitions Editor: Ashley Coffey Content Refinement Specialist:
Mohammed Zafar
Introduction
A
s businesses continue to embrace digital innovation, cloud
applications, and the new work-from-anywhere normal,
enterprise networks have become far more complicated
and dispersed with an ever growing number of edges. As a result,
the network perimeter has all but disappeared. As more people
and devices connect to the network from more places, the tradi-
tional perimeter-based approach to security — protecting the
trusted corporate network from the untrusted internet — has
become increasingly ineffective.
To protect this greatly expanded attack surface from modern

threats, organizations must implement a “never trust, always
verify” zero-trust model that incorporates rigorous access con-
trols across the distributed network so that users, devices, end-
points, clouds, and infrastructure are all protected.
To successfully implement a zero trust access strategy, organiza-

tions must implement tightly integrated security solutions that
deliver robust identity and access management, endpoint access
control, network access control, and application access control to
users and endpoints working from anywhere.
Foolish Assumptions
It’s been said that most assumptions have outlived their useless-
ness, but this book assumes a few things nonetheless! Mainly,
that you’re a chief information officer (CIO), chief information
security officer (CISO), vice president, architect, engineer, or
administrator working on an enterprise security, networking, or
infrastructure team. As such, this book is written primarily for
technical readers with at least a basic understanding of security
and networking technologies and challenges.
If any of these assumptions describe you, then this is the book

for you! If none of these assumptions describe you, keep reading
anyway! It’s a great book and when you finish reading it, you’ll
have complete trust in your knowledge of zero trust!
Introduction 1
Icons Used in This Book
Throughout this book, you will see special icons that call attention
to important information. Here’s what to expect.
The case studies provide best practices from organizations that

have successfully used modern data sharing methods.
This icon points out important information you should commit

to your nonvolatile memory, your gray matter, or your noggin —
along with birthdays and anniversaries!
This icon explains the jargon beneath the jargon and is the stuff
legends — well, legendary nerds — are made of.
Tips are appreciated, but never expected — you’ll appreciate these

useful nuggets of information and helpful advice.
These alerts point out the stuff your mother warned you about
(well, probably not, but they do offer practical advice to help you
avoid potentially costly or frustrating mistakes.)
Beyond the Book

There’s only so much space in this short book, so if you find your-
self at the end of this book wondering, “Where can I learn more?”
go to https://fortinet.com.
2 Zero Trust Access For Dummies, Fortinet Special Edition
IN THIS CHAPTER
»» Recognizing modern threats
»» Going beyond traditional access control
»» Defining zero-trust concepts
»» Reaping the benefits of zero trust
Chapter 1
Understanding the Need
for Zero Trust
I
n this chapter, you learn how threat actors take advantage of
the disappearing network perimeter and expanding attack sur-
face to bypass traditional access controls, and how zero trust
overcomes these challenges.
Surveying the Modern Threat Landscape

In today’s digital enterprise, business applications and data are
dispersed far and wide, away from corporate data centers, so
that users now have greater access to corporate resources using
more endpoints from many locations. The rapid growth of Inter-
net of Things (IoT) devices and corporate bring-your-own-device
(BYOD) initiatives have led to a proliferation of access points
and endpoint devices on the network. As a result, the traditional
network perimeter is disappearing — and the attack surface is
expanding. At the same time, cyberthreats are growing more
prolific, and attackers’ tactics and techniques are evolving and
becoming more sophisticated.
CHAPTER 1 Understanding the Need for Zero Trust 3
IDC predicts that by 2025 there will be 55.7 billion IoT-connected
modified devices worldwide.
Traditional security models work under the assumption that

anything inside an organization’s network should be trusted.
But automatically extending trust to any device or user puts the
organization at risk if either is compromised, whether intention-
ally or unintentionally. Attackers, malware, and compromised
devices that bypass edge security checkpoints often have unre-
stricted access to the network because of this inherent trust model.
Exploits such as credential theft and malware enable attackers to
gain access to legitimate accounts. Once inside the network, they
can move laterally and take advantage of the trusted internal net-
work to target an organization’s resources.
According to the Verizon 2021 Data Breach Investigations Report

(DBIR), 70 percent of breaches in the previous year were caused
by outsiders, 45 percent involved hacking, 86 percent were finan-
cially motivated, 17 percent involved some form of malware
(including ransomware), and 22 percent featured phishing or
social engineering.
As companies modernize their networks to accommodate remote

workers, multicloud architectures, and digital innovation, their
approaches to security need to change as well.
Recognizing the Limitations of

Traditional Access Control
Traditional access control strategies inherently trust a user or
device on the network. This notion of trust is often based on
the user or device’s location: If they’re on the network, they’re
trusted. But as the network perimeter continues to disappear, it
becomes increasingly impossible to secure network resources.
Users are now accessing the corporate network from home offices
and mobile devices. Corporate resources are also increasingly
located in multiple locations, beyond the traditional network,
such as private and public clouds.
To overcome the limitations of traditional access control, organi-
zations need a solution that provides:
»» Ongoing verification of users and devices.

»» Granular segmentation of the network to create zones of
control, which helps limit the impact of a breach and
establishes more control points.
»» Least-privilege access for users and devices, so users are
only granted the access they need to perform their roles,
which helps to limit the impact of a compromised identity or
device.
Today’s networks have vast, dynamic, and in some cases, even

temporary edges. The fact that many devices are often offline
makes continuously assessing risk and trust even more difficult.
Because there’s no way to verify that users or devices on or off the
network can be trusted, you should assume that every device on
the network is potentially infected.
Looking at Zero-Trust Basics

The zero-trust model is a concept that was introduced by John
Kindervag while working at Forrester Research in 2009. The
fundamental principle underpinning zero trust is “never trust,
always verify.” Zero trust challenges the traditional perimeter-
based security model in which a firewall protects the trusted cor-
porate network from the untrusted internet.
To be fair, the perimeter-based model isn’t as black and white

as labeling things either trusted or untrusted. Over the years,
the perimeter-based approach has been tweaked here and there.
For example, demilitarized zones (DMZs) are typically created
for public-facing websites and applications that are “somewhat
trusted” — shades of gray, if you will. Virtual private networks
(VPNs) are used to extend (or punch holes in, depending on your
perspective) the corporate network to remote and mobile users.
And virtual local area networks (VLANs) and access controls are
used to segment sensitive departments, such as human resources
and finance, from the rest of the network.
But the perimeter-based approach to security has an inherent
drawback: It grants excessive implicit trust. Once you’re con-
nected, whether directly or using a VPN, you are then trusted
alongside the rest of the internal network.
The zero-trust model moves security away from implied trust

that is based on the network location of a user or device. Instead,
trust is evaluated on a per-transaction basis. With zero trust, your
network location or IP address no longer conveys an implication
of trust. Instead, the zero-trust model requires trust to be explic-
itly derived from a combination of identity and context-based
controls at a very granular level that grants access based on the
security principles of least privilege and need to know.
Zero trust starts with a default deny posture for everyone and
everything — that is, zero trust. In a zero-trust model, whenever
a user or device requests access to a resource, their identity must
be verified before access is granted. Verification is based not only
on the identity of the user and/or device, but other attributes as
well, including context (such as date and time), geolocation, and
device security posture.
However, access is not a “one and done” deal. Just because a user
or device has been granted access to a resource doesn’t mean they
can roam about freely on the network. Access is granted at a very
granular level. It’s only given to the resource that is needed to
perform a specific function for a limited time — not the entire
network. A key element of the zero-trust model is that trust must
be continually re-evaluated. If important attributes of the user
or device change, the trust may be revoked and access to the
resource removed.
Zero-trust access (ZTA) builds on the zero-trust model and

focuses on knowing and controlling who and what is accessing
the network. Role-based access control (RBAC) is a critical com-
ponent of ZTA. Only by knowing definitively who a user is can the
appropriate level of access be granted based on their role. ZTA
covers user endpoints where management control and visibility
are required. Aligning to the zero-trust model means implement-
ing a least-access policy that grants the user the minimum level
of network access required for their role and removes any ability
to access or see other parts of the network.
In addition to knowing who and what is on the network, ZTA
incorporates security for what is on the network. The ever-
growing number of network-connected devices now includes
IoT devices. These “headless” devices don’t have usernames and
passwords to identify themselves and their role on the network.
Instead, network access control (NAC) solutions can be used to
discover and control access for these devices. Using NAC policies,
the zero-trust principle of least access can be applied to these IoT
devices, granting sufficient network access to perform their role
and nothing more.
Zero-trust network access (ZTNA) is an element of ZTA that

controls access to applications regardless of where the user or
application is located. The user may be on a corporate network,
working from home, or someplace else. The application may be
hosted in a corporate data center, or in a private or public cloud.
ZTNA is the natural evolution of the VPN. Given the complexity

of today’s networks, ZTNA offers better security, more granular
control, and a better user experience than a traditional VPN. You
can learn more about ZTNA in Chapter 5.
Realizing the Benefits of Zero Trust

For effective security in the modern threat landscape, organiza-
tions must shift from trying to protect dynamic network perim-
eters to instead protecting applications and data spread across
potentially billions of edges, users, systems, devices, and other
critical resources. A zero-trust strategy provides comprehensive
visibility and protection across devices, users, endpoint, cloud,
and infrastructure with a “never trust, always verify” approach
to security.
Zero trust delivers the following benefits for organizations:
»» Reduces risk: When you automatically extend trust to any

device or user in your network, you put your organization at
risk when either becomes compromised, whether intention-
ally or unintentionally. Zero trust eliminates points of
vulnerability by limiting network access for users, as well as
by adopting extensive identity verification so that they only
have access to the data and systems relevant to their role or
position in the organization.
»» Increases visibility: You know who and what is connected
to the network at all times.
»» Extends security: Security can be extended beyond the
network with ZTNA. Unlike a VPN, which focuses exclusively
on the network layer, ZTNA goes up a layer, effectively
providing application security independent of the network.
IN THIS CHAPTER
»» Trusting your users with strong
authentication
»» Using role-based access control (RBAC) to

enforce least privilege
»» Keeping privileged access secure
Chapter 2
Establishing IAM as a
Foundation for Zero
Trust
T
he first step in securing your network resources with zero
trust access (ZTA) is to trust your users with verification
before granting access. In this chapter, you learn why iden-
tity and access management (IAM) is the cornerstone of ZTA, how
to manage privileged access on the network, and the role of role-
based access control (RBAC) in enforcing the principal of least
privilege.
Knowing Who Connects to Your Network

Security teams need to know who is on the network at all times.
It’s critical for organizations to know every user and what role
that user plays in the company so IT can securely grant access to
only those resources necessary for each role or job when needed.
CHAPTER 2 Establishing IAM as a Foundation for Zero Trust 9
However, organizations are at an increased risk from users that
connect to their networks with weak passwords. Because so many
online accounts today require user credentials, passwords are
often too simple or are reused across multiple accounts, making
them easy for attackers to compromise using exploits like phish-
ing and social engineering. Even when organizations require com-
plex passwords for their users, passwords alone aren’t enough.
Strong authentication, or multi-factor authentication (MFA),

refers to using multiple factors to verify that a user is who they
say they are through a combination of factors, such as:
»» Something you know (for example, a user ID and password)

»» Something you have (for example, a hardware or software
token, or a digital certificate installed on a device)
»» Something you are (for example, a biometric indicator such
as a fingerprint or iris pattern)
Adaptive or contextual authentication evaluates additional user

attributes during a login attempt, such as time of day, geographic
location, and/or network (trusted or untrusted) to assess the risk
before allowing access. This technique can be used to either:
»» Allow user access when the risk is deemed to be low

»» Require two-factor authentication (2FA) when the risk is
deemed to be high
For example, using the network attribute of the adaptive authen-

tication, the system won’t prompt an onsite user for 2FA because
they’re on the corporate network. However, the same user log-
ging in from a public or home network and attempting to access
corporate resources would be prompted for 2FA to further verify
the user’s identity.
Fast Identity Online (FIDO) provides the most secure and fast-
est login experiences for online applications and services. FIDO
supports both Universal Authentication Frameworks (UAF, that is
passwordless authentication) and Universal 2nd Factor (U2F, that is
universal two-factor authentication).
Another challenge facing organizations today is the geographi-

cally dispersed workforce. Employees work from various loca-
tions such as the main office, branch offices, and home offices.
To support the evolving nature of work — including work-
from-home and work-from-anywhere in the wake of the global
pandemic — and the ongoing move to the cloud, organizations
need a better way to securely connect their employees to critical
business applications.
Attacks against endpoint devices are increasing. According to a

recent Ponemon Sullivan Privacy Report, 68 percent of respon-
dents say the frequency of attacks against endpoints has increased
over the past 12 months and the Verizon Data Breach Investiga-
tions Report found that 30 percent of breaches involved malware
installed on endpoints.
Today, there is practically no standardization of device configu-

rations for personal mobile devices permitted in bring your own
device (BYOD) environments. Network risks associated with BYOD
mobile devices include:
»» Data leakage
»» Unsecured Wi-Fi
»» Network spoofing
»» Unpatched vulnerabilities on rooted or jailbroken devices
»» Malware and spyware
»» Broken cryptography
»» Improper session handling
Finally, organizations are at risk when access permissions
are based on assumed trust of previously vetted devices. Many
organizations have been breached by former employees and con-
tractors. A lost or stolen device can reveal passwords that enable
a breach on the network. This is why a zero-trust approach to
security is so critical. As cybercriminals focus on compromising
the broad array of network devices, security teams need better
visibility and detection of every device connecting to the network.
Today’s enterprise identity environments are made up of vari-

ous systems that may include networking devices, servers, direc-
tory services, and cloud applications. Managing an identity that
resides in these various systems can quickly grow into such a
large administrative challenge that it negatively affects users,
administrators, and application developers. Federated identity is
a solution that enables users from a group of linked organizations
to share the same user verification method to various applications
and resources. It does this by connecting users’ online identities
across multiple domains and networks. Federated identity solves
several common access and security issues for organizations.
Organizations can manage user access and provide easy access to
applications by using security tools like MFA and single sign-on
(SSO). An example of federated access is an organization enabling
users to access partner websites, Active Directory, and web appli-
cations without having to log in every time.
A robust IAM solution should have the following capabilities:
»» Establish identity through login, MFA, and digital certificates,

which may evolve to add contextual authentication.
»» Support both hardware and software token options for MFA,
as well as FIDO, UAF, and U2F.
»» Provide role-based information from an authentication
source for use in privileged access.
»» Establish and enforce role-based least privilege access
policies.
»» Provide added security with support for SSO to help improve
user compliance and adoption.
»» Leverage Security Assertion Markup Language (SAML) to
authenticate users for access to cloud-based software-
as-a-service (SaaS) applications.
»» Verify zero trust network access (ZTNA) connections for
devices and users on a per-session basis to individual
applications.
Enforcing Role-Based Least

Privilege Access
Managing individual user account permissions for just a few
hundred users can be a daunting challenge. In an enterprise with
thousands of users it can be impossible to manage. Role-based
access control (RBAC) enables IT administrators to manage the
permissions assigned to users more efficiently by assigning sets
of permissions to groups or roles. In this way, users in an entire
department, for example, can quickly be assigned access to a sen-
sitive financial application or network file share. Additionally,
as users rotate through different job roles (for example, due to
promotions or transfers), administrators can easily revoke the
permissions associated with the old role and assign permissions
associated with the new role. Active Directory frequently plays a
key role in RBAC administration.
However, RBAC can be a double-edged sword. Roles must be clearly

defined and assigned only the minimum permissions necessary to
perform the required functions for that role. This is the principle of
least privilege. If roles are too broadly defined, large groups of users
may be assigned excessive permissions in an effort to address
everyone’s needs with a broad brushstroke. Roles that are poorly
defined may be easily misunderstood, resulting in users being
improperly assigned to roles. Finally, roles must be actively man-
aged to ensure they’re revoked and assigned appropriately, and
to ensure the permissions associated with roles reflect changes in
the organization and/or IT infrastructure. Failure to revoke roles
or permissions can cause “permission creep” within the organiza-
tion, resulting in excessive permissions for large groups of users.
Managing Privileged Access

Accounts that have privileged access permissions associated with
them are particularly valuable targets for attackers. These accounts
typically have access to critical systems and resources on the net-
work, as well as confidential or sensitive data. Privileged access
allows the user to make administrative changes to systems, appli-
cations, and network and security infrastructure such as installing
software (or malware), altering (or deleting) critical system files
or data, creating new accounts, and resetting user passwords.
Privileged access permissions may be assigned to accounts or

roles used by humans such as domain administrators, local
administrators, emergency “break glass” accounts, superuser,
and privileged business users. Privileged access permissions may
also be assigned to accounts that are not used by humans such as
application and service accounts.
Privileged access management (PAM) is a subset of IAM. Whereas

IAM is used to authenticate and authorize all of an organization’s
users, PAM is specifically focused on managing and securing
administrator and user accounts with elevated privileges (that is,
privileged access).
UTILITY CO. ENHANCES SECURITY
ACROSS IT AND OT
INFRASTRUCTURE
Falu Energi & Vatten (Energy & Water) is a municipally owned utility
company with products and services spanning electricity, heating and
cooling, water, sewage, and recycling across the Swedish municipality
of Falun.
Challenges
Back in 2009, earlier than many other utility companies, Falu Energi &
Vatten realized both the potential and the necessity of digital transfor-
mation, embarking on a long-term project of modernization and digi-
tization of the myriad processes and tools underpinning its
operations.
For Falu Energi & Vatten, the first step in preparing for these changes
was the realization that its IT network and security infrastructure
would need a level of end-to-end visibility, control, and integration
that its previous firewall architecture was unable to provide.
Solutions
After a careful evaluation of potential solutions, Falu Energi & Vatten

chose Fortinet.
The resulting network included FortiGate next-generation firewalls

(NGFWs), FortiSwitch, and FortiAP wireless access points. FortiClient,
FortiAuthenticator, and FortiToken were added to ensure that every
connected user and device would be strongly authenticated and
would meet its zero trust access requirements.
With its integrated software inventory module, FortiClient provided

Falu Energi & Vatten with increased visibility into software installed on
the endpoint. In addition to managing licenses, software inventory
can improve security hygiene. When installed software isn’t required
for business purposes, it unnecessarily introduces potential vulnera-
bilities, and thereby increases the likelihood of compromise.
Business Impact
• Improved the safety, reliability, and efficiency of essential services

through centralized security policy monitoring and control
• Laid the foundations for ongoing IT and operational technology
(OT) integration
• Provided the central visibility, control, and automation needed for
the company’s digital transformation
Through the resulting network infrastructure, Falu Energi & Vatten

now has a solid foundation on which to build a safer, more reliable,
and more efficient future for its business and the community of
Falun.
IN THIS CHAPTER
»» Exploring the evolving capabilities of EDR
»» Making EDR part of a zero-trust strategy
Chapter 3
Leveraging EDR for
Zero Trust
E
ndpoints — including desktop and laptop computers, serv-
ers, Internet of Things (IoT) devices, and more — comprise
the single largest attack vector in an enterprise IT environ-
ment. Attackers target endpoints because endpoint security is
generally less robust than security in the datacenter and day-to-
day security decisions on the endpoint — such as whether or not
to download and install an unknown file, open a potentially mali-
cious email attachment, or click on a suspicious link — are left to
the end user.
In this chapter, you learn how endpoint detection and response

(EDR) has evolved from a rudimentary tool for manually inves-
tigating incidents to a highly automated detection and remedia-
tion endpoint solution, and why EDR is critical to an effective zero
trust strategy.
CHAPTER 3 Leveraging EDR for Zero Trust 17
Looking at the Evolution of Endpoint
Detection and Response
Endpoint protection has traditionally been focused on prevent-
ing malware and other known threats from infecting a desktop
or laptop PC. For practically as long as these devices have been
around, users have been admonished to run antivirus software
and keep it up to date. Over the years, antivirus software evolved
into anti-malware software or Endpoint Protection Platforms
(EPP) to broadly encompass other forms of malware including
worms, trojans, spyware, rootkits, exploits, malicious scripts,
and more. While anti-malware tools have improved greatly since
their introduction, increasingly leveraging machine learning and
behavioral analytics to prevent both known and unknown threats
from infecting a PC, the unfortunate reality is that prevention
isn’t always possible.
When prevention fails, endpoint detection and response (EDR)

provides the tools for security teams to detect and respond to
threats on endpoints and the network. Unfortunately, early EDR
solutions are too slow and complex to operate in a fast-paced and
dynamic threat environment. These first-generation EDR solu-
tions require highly skilled security teams to run manual queries
to search for specific indicators of compromise (IoCs) in endpoint
telemetry, then manually triage and respond to any threats that
are detected. Most organizations today simply don’t have the
skilled resources necessary to effectively operate these EDR tools.
Over the years, first-generation EDR solutions have evolved with

the addition of some key bolt-on functionality including:
»» Threat intelligence: Automated correlation of endpoint

telemetry to IoCs from threat intelligence feeds reduces the
need for manual queries to detect threats.
»» Attack visualization: Threats can be mapped to help
security analysts get a more complete picture of an attack in
progress or an attack that has already happened.
»» Automated remediation: Basic response capabilities
typically include the capability to block specific IP addresses
and processes, isolate endpoints from the network, and
query the endpoint for additional data.
»» Threat hunting: Advanced search capabilities and access to
forensic data enables proactive threat hunting in the
network environment.
Second-generation EDR solutions offer organizations greater

visibility of their endpoints and network environment, tight
integration with prevention tools (such as anti-malware), and
policy-based automated risk mitigation using customizable play-
books. An example of a playbook action could be to block spe-
cific outbound attack communications, automatically rollback
any system damage from ransomware, or prevent malicious file
system access. These capabilities enable rapid detection and auto-
mated remediation of threats and attacks in real-time, and com-
plete forensic investigative analysis.
EDR and Zero Trust

EDR is an essential component in a zero-trust strategy, enabling
organizations to extend the “never trust, always verify” security
posture of zero trust to their endpoints.
EDR provides an organization with a central tool for collecting,

organizing, and analyzing data from the endpoints connected to
its network. EDR can coordinate alerts and automate responses
to imminent threats. This involves the incorporation of three
elements:
»» Endpoint data collection agents monitor endpoints and

collect data. This includes data about processes, activity that
occurs on the endpoint, connections to the endpoint, and
data transferred to and from the endpoint.
»» Automated incident response uses custom policy-based
rules to identify threats and then trigger an automatic
response. The automated response can both recognize the
threat and determine what kind of threat it is. It can then
perform a response, such as sending an alert that the
endpoint’s user will be logged out, doing so, and isolating the
endpoint.
»» Analysis of endpoint data in real time enables EDR to
diagnose threats quickly — even if they do not necessarily
match preconfigured threat parameters. Analysis also uses
forensic tools to examine the nature of the threat and
determine how the attack was executed after it has been
contained and eradicated.
These three elements of EDR work together as part of an effec-

tive zero trust strategy to enable detection, containment, inves-
tigation, and eradication of threats in your endpoint and network
environment.
Detection
When a threat evades the preventive controls on your endpoints
and breaches your network environment, rapid detection is criti-
cal to minimize damage. However, detection can be extremely
challenging, particularly when you are dealing with an advanced
threat that has already evaded your endpoint protection tools. EDR
uses continuous file analysis and cyberthreat intelligence to rap-
idly detect threats. EDR examines each file that interacts with the
endpoint and can flag any files that may present a threat. Cyber-
threat intelligence leverages a combination of artificial intelli-
gence (AI) and large repositories of past and currently evolving
threat data to detect threats that are targeting your endpoints.
Containment
Once a threat has been detected, EDR contains it using segmenta-
tion to prevent the threat from spreading across the network. This
involves isolating specific areas of the network so that a threat
can’t infiltrate adjacent network elements. However, this may not
be enough. Therefore, in addition to segmentation, an effective
EDR solution also contains the threat itself. Containment is par-
ticularly important when it comes to ransomware. Because ran-
somware can effectively hold an endpoint hostage, it needs to be
contained to prevent other endpoints from getting infected.
File testing
Sandboxing allows EDR to contain a threat within an environment
that is designed to simulate the conditions within a section of
your network for the purpose of understanding the nature of the
threat. Once the threat is confined to this safe and isolated area,
EDR closely monitors and analyzes the threat’s behavior. This
information can produce helpful, actionable insights that can be
used to improve the organization’s overall security posture and
can be conveyed to the cyberthreat intelligence system to help it
evolve to address future threats.
Elimination
While the other facets of EDR provide critical knowledge about the
threat, that information is useless if it isn’t employed to elimi-
nate it and similar threats in the future. The elimination process
depends on gathering critical information about the threat and
then using it to execute an action plan. For example, the system
has to figure out where the threat came from and where it went.
Information about the threat’s origin can be used to enhance future
security measures. The system also needs to pinpoint the applica-
tions and data the malicious file affected or tried to attack, as well
as whether the file has replicated itself to continue its attack.
IN THIS CHAPTER
»» Knowing what is connected to the
network
»» Gaining visibility and control of devices
»» Implementing automated response and

network orchestration
Chapter 4
Bringing Zero Trust to
Device Security
I
f cybercriminals were to write a book titled The Seven Habits of
Highly Effective Hackers, there would definitely be a chapter
called “Begin with the Endpoint in Mind.” Endpoints are a pre-
ferred initial attack vector for cybercriminals to gain access to
more valuable network resources. In this chapter, you learn how
to apply a zero-trust strategy to your device security.
Discovering and Identifying Devices

In addition to knowing who is on the network (discussed in
Chapter 2), organizations need to know what devices are on the
network. These devices include:
»» Networked office equipment (such as printers)

»» Retail systems (for example, point-of-sale systems)
»» Operational technology (OT)
»» Internet of Things (IoT) sensors and devices
CHAPTER 4 Bringing Zero Trust to Device Security 23
The challenge in managing all these devices lies in their wide
deployment, the varying levels of device management, inconsis-
tent configuration controls, and the lack of support for standard
communication protocols in many legacy devices.
The traditional network perimeter has all but disappeared as the

proliferation of devices connecting to the network has created an
exponentially larger attack surface for organizations to protect,
with every endpoint device essentially constituting a micrope-
rimeter. The result of this explosion of devices and the expanding
attack surface is that many organizations are losing visibility and
control because they’re no longer certain what devices are con-
necting to their networks. And because each microperimeter is
associated with an individual device, these endpoints have become
a prime target for malware infections and sophisticated exploits.
Attacks against IoT devices are increasing, and the scale and
impact of a successful IoT attack can be devastating. For exam-
ple, the Cybersecurity Infrastructure and Security Agency (CISA),
working with several industry security firms, recently discovered
a vulnerability in millions of IoT smart camera devices that allows
an attacker to gain access to the cameras, watch live video feeds,
and create botnets.
The greatest area of growth in the endpoint attack surface is from

the IoT device explosion. Cyberattacks on IoT devices are booming
as organizations connect more and more smart devices to their
networks. Attackers exploit these devices to conduct distributed
denial-of-service (DDoS) attacks and other malicious activities.
To secure endpoints, enterprises must have full visibility into

where each device is, what it does, and how it connects to other
devices across the network topology. Lack of visibility leaves an
organization vulnerable to unseen risks, and many organizations
don’t have a strategy in place to deal with attacks on IoT devices.
Security teams must be able to discover and identify all devices at
the edges of the network.
Traditional network segmentation is used by some organiza-

tions, but it is difficult to define secure network-based segments
that can be simultaneously accessible to all authorized users and
applications and completely inaccessible to all others. Policy-
based segmentation enables a more dynamic — and granular —
network segmentation strategy that can automatically adapt to
ensure least privilege in a zero-trust network.
Ensuring Endpoint Visibility and Control
Network access control (NAC) solutions help organizations keep
up with the ever-expanding attack surface associated with the
proliferation of endpoints and devices on the network. NAC solu-
tions provide visibility into the network environment for enforce-
ment and dynamic policy control. Whether devices are connecting
from inside or outside the network, NAC solutions can automati-
cally respond to compromised devices or anomalous activity. With
NAC solutions, organizations can:
»» Discover, identify, profile, and scan all devices for

vulnerabilities
»» Establish and ensure ongoing network control
»» Establish and enforce policies that limit network access to
only what is needed for that device
»» Maintain automated response and network orchestration
(discussed later in this chapter)
A NAC solution can automatically identify and profile every device

as it requests network access and scan the device for vulnerabili-
ties. The NAC processes should be completed within a few seconds
to minimize the risk of device compromise. NAC solutions that
rely on traffic scanning allow devices to connect to the network
during identification. However, the traffic-scanning process can
take up to half an hour, during which time the network may be
breached by a compromised device or endpoint.
A NAC solution should be easy to deploy from a central location

and offer consistent operation across wired and wireless networks.
Providing Automated Response

and Network Orchestration
To accelerate and expand the reach and scale of their attacks,
cybercriminals leverage extensive automation. Although visibility
into the network can help detect potential threats, the response
to these threats can be fragmented and ineffective because of
slow manual workflows. Without the benefit of advanced security
processes, security teams are often operating at a disadvantage,
which increases an organization’s risk.
Attacks are more sophisticated and security analysts face increas-
ingly complex and fragmented security infrastructures with too
many point products from different vendors.
Fundamental to the security of a constantly changing network is

understanding its makeup — you can’t protect what you can’t
see. An effective NAC platform provides policy-based security
automation and orchestration that enables discovery of every
endpoint and network infrastructure device, provides contex-
tual awareness for implementing dynamic network access con-
trol, and delivers the capability to contain a cyberbreach through
automated threat response.
GRUPO UNIVERSAL GAINS

VISIBILITY AND CONTROL WITH
FORTINAC
Grupo Universal is one of the main conglomerates in the Dominican
Republic, made up of 10 subsidiaries offering solutions for insurance,
financial, and other services organizations.
Challenges
IT security and IT infrastructure availability are essential to Grupo

Universal. In 2017, the company launched one of its most important
projects since its foundation in 1964: its technological and digital
transformation.
Given the technological demands of today’s digital economy, storing

data in centralized architectures limits employee access and user
response. Grupo Universal’s IT teams recognized the risks of a central-
ized database and decided to evolve into a wireless connection
model, which in spite of also presenting some challenges, allowed the
company to meet customer and internal users’ network security
demands.
To help with the decentralized infrastructure project, Grupo Universal

chose to partner with Fortinet.
Solutions
In order to reduce the administrative complexity for operational

teams, Grupo Universal proposed having centralized management
that would reduce risks and maintain an updated communications
infrastructure.
Through the integration of Fortinet Secure SD-WAN with other

Security Fabric solutions, Grupo Universal was able to deploy a high-
performance communications infrastructure and end-to-end security.
Management and analytics solutions such as FortiManager and
FortiAnalyzer delivered complete visibility with a single pane of glass
and centralized policy management.
FortiNAC network access control provides full visibility of all devices

on the network, allowing for complete control of the level of access
given per device, and FortiClient delivers advanced, proactive end-
point protection from zero-day threats. It seamlessly integrates with
FortiSandbox for advanced threat detection.
Secure email gateway FortiMail protects cloud-based email services

from advanced email threats to keep users and data secure. With the
FortiWeb web application firewall, Grupo Universal was able to safely
access cloud-based, business-critical applications. Adding FortiAP
across the organization tied everything together, and ensured secure
wireless access for devices for branch offices.
Business Impact
• Improved performance and communications speeds with redun-

dant links across all locations
• Cost savings of $30,000 per year in communication links and
$70,000 per year in WAN optimization
• Faster cloud access and cloud-hosted applications with local
breakouts
Through this project, Grupo Universal not only appropriately scaled

their communications and IT infrastructure, centralized administra-
tion, and improved control management and risk response, but they
also managed to reduce costs and increase network availability to
99.9 percent. With Fortinet’s support, Grupo Universal was able to
effectively integrate its communications and security in its technologi-
cal and digital transformation process.
IN THIS CHAPTER
»» Recognizing the limitations of virtual
private networks
»» Introducing zero-trust network access
»» Improving remote access security and

user experience with zero-trust network
access
Chapter 5
Reimagining the VPN
with Zero Trust
A
lthough virtual private networks (VPNs) have become
commonplace, many organizations are now looking for
better solutions to securely connect their increasingly
remote and mobile workforces. In this chapter, you learn how
zero-trust network access (ZTNA) improves security, enables
more granular control, and delivers a better user experience than
traditional VPNs.
Saying Goodbye to the VPN

VPNs have long been the de facto method for remotely access-
ing corporate networks, but they have some serious issues, par-
ticularly in terms of security. The recent proliferation of remote
working — necessitated by the global pandemic — has put
renewed focus on the limitations of traditional VPNs.
CHAPTER 5 Reimagining the VPN with Zero Trust 29
For organizations that rely on a traditional VPN to secure their
remote workers and home offices, there are many drawbacks
including:
»» VPNs use the outdated and ineffective perimeter-based

approach to security. Once users connect to the corporate
network with a VPN client, they often have broad access to
all the resources on the network. This largely unrestricted
access exposes the rest of the corporate network to threats
that use the endpoint as an attack vector. If split tunneling is
enabled, a user can surf the internet — without going
through a corporate firewall — while still connected to the
corporate network. The risk of a data breach, ransomware
attack, or malware infection on the corporate network
increases exponentially if users are permitted to install a
VPN client on personally owned devices that may already be
compromised.
»» VPNs have no visibility into the traffic they deliver. VPNs
are used to connect to the corporate network over an
encrypted tunnel when working from hotels, coffee shops, or
home. This tunnel prevents cybercriminals from snooping in
on the session, but also prevents security controls from
inspecting the traffic. Because most home offices and public
hotspots are connected to largely unsecured networks,
they’re a relatively easy target for cybercriminals to exploit
using social engineering tactics and malware.
»» VPNs aren’t designed for today’s highly distributed
network resources. Applications and data are now spread
across corporate data centers, multicloud environments, and
distributed branch and home offices. Most VPN solutions
weren’t designed to manage this level of complexity. A VPN
connection backhauls all traffic across the corporate network
for inspection, which is bandwidth-intensive and causes
latency. Split tunneling can address this inefficiency but
creates its own set of challenges (discussed previously).
Building a Secure Remote Connection
for Today’s Business
ZTNA offers a better remote access solution than traditional VPNs
and also addresses application access issues. ZTNA starts with the
premise that location doesn’t confer trust: Where a user or device
is physically located is irrelevant. Any user is capable of malicious
behavior and any device can be compromised. ZTNA is based on
this reality.
ZTNA grants access to individual applications and workflows

on a per-session basis only after a user and/or device has been
authenticated. Users are verified and authenticated to ensure
they’re allowed to access an application before they’re granted
access. Every device is also checked each time an application is
accessed to ensure the device meets the application access policy.
Authorization uses a variety of contextual information, including
user role, device type, device compliance, location, time, and how
a device or user is connecting to the network or resource.
With ZTNA, once a user and device are properly authenticated — for
example, using a combination of multifactor authentication (MFA)
and endpoint validation — they can securely connect to the net-
work and be granted least privilege access to requested resources.
The principle of least privilege means the user and device can only
access those applications or resources that are needed to perform
an authorized task or function — and nothing else.
Access control doesn’t end at the access point. ZTNA operates

in terms of identity rather than securing a place in the network,
which allows policies to follow applications and other transac-
tions end to end. By establishing greater levels of access control,
ZTNA is a more efficient solution for end-users and provides pol-
icy enforcement wherever it’s needed.
Although the ZTNA authentication process provides points of

authentication, unlike a traditional VPN, it doesn’t specify how
that authentication takes place. As new or different authentica-
tion solutions are implemented, they can be seamlessly added to
the ZTNA strategy.
Today, there are two primary approaches to implementing ZTNA:
»» Client-initiated ZTNA: Sometimes called endpoint-initiated

ZTNA, the client-initiated ZTNA model was initially known as
a software-defined perimeter and is based on the Cloud
Security Alliance (CSA) architecture. This approach uses an
agent that is installed on a device to create a secure tunnel.
When a user wants to access an application, the agent
gathers information like the user’s identity, device location,
network, and the application being used, and it builds a risk
profile to assess the overall security posture. It then con-
nects back to the application over a proxy connection, and if
the risk profile meets the organization’s policy requirements,
the user and device are granted access to the application
for the session. Applications can be on premises or cloud-
based apps. Using the client-initiated model can be challeng-
ing because managing the agents on devices can become a
headache for IT unless a central management solution can
coordinate deployment and configuration. Additionally,
unmanaged devices need to be handled by other means,
such as a network access controller (NAC).
»» Service-initiated ZTNA: The service-initiated ZTNA model
uses a reverse-proxy architecture, which is also sometimes
referred to as application-initiated ZTNA. Based on the
BeyondCorp model, the biggest difference from client-
initiated ZTNA is that it doesn’t require an endpoint agent. It
uses a browser plug-in to create a secure tunnel and
perform the device assessment and posture check. A key
disadvantage is that it’s limited to cloud-based applications.
Because the application’s protocols must be based on
Hypertext Transfer Protocol (HTTP)/Hypertext Transfer
Protocol Secure (HTTPS), it limits the approach to web
applications and protocols, such as Secure Shell (SSH) or
Remote Desktop Protocol (RDP) over HTTP. Although a few
newer vendors are offering additional protocol support, the
model isn’t suited to companies that have a hybrid combina-
tion of cloud and on-premises applications.
Organizations should be careful to select ZTNA solutions that

integrate with their existing infrastructure. Building a complete
ZTNA solution requires a variety of components: a client, a proxy,
authentication, and security. Often these solutions are provided
by different vendors and the components may run on different
operating systems and use different consoles for management
and configuration, so establishing a zero-trust model across ven-
dors can be difficult or impossible.
Seeing the Advantages of Zero-Trust

Network Access
Adopting a zero-trust approach to security is a process that
touches many systems and may take years for some organizations
to fully implement. But addressing remote access is a good first
step toward implementing the zero-trust security model. ZTNA
solutions offer many advantages over traditional VPNs, including:
»» Organizations can extend the zero-trust model beyond

the network. Unlike a VPN, which operates at the network
layer, ZTNA focuses on the transport layer, effectively
providing application security independent of the network.
»» ZTNA works transparently in the background, which
improves the user experience. For users, ZTNA is easier to
manage than a VPN. Users no longer have to remember
when to use the VPN or go through the process of connect-
ing. There’s also no risk of tunnels accidentally being left
open because someone forgot to disconnect the VPN client.
With ZTNA, a user simply launches the application and
immediately gets a secure connection whether the applica-
tion is on premises or in a cloud. This encrypted tunnel is
created on demand and in the background — completely
transparent to the user. Because the corporate network is
no longer an implicit zone of trust, the same tunnel is
created whether the user is on the network or off the
network.
»» Users and devices are verified and validated before
access to an application or resource is granted. This
process includes a security posture check that verifies that
the endpoint is running the right firmware and endpoint
protection software to verify it is safe to connect to the
application. The verification is granular, per session, using
the same access policy whether a user is accessing resources
that are on premises or in the cloud. The same policy also
controls who can access that app based on the profile of the
authenticating user and device.
»» Because ZTNA focuses on application access, it doesn’t
matter what network the user is on. ZTNA automatically
creates secure connections to applications, no matter where
the user is located. For every application session, ZTNA
verifies the security posture of both the user and device —
even when users are in the office.
»» ZTNA reduces the attack surface by hiding business-
critical applications from the internet. On the application
side, because the user is connecting back to the enforce-
ment point and then proxying that connection to the
application, the application can exist on premises or in a
cloud, all while hidden from the internet. The application
only needs to establish a connection with the enforcement
points, keeping them safe from cybercriminals.
More organizations are recognizing the need to transition away

from traditional VPNs. ZTNA is proving to be a better solution that
is easier to use and provides better application security.
IN THIS CHAPTER
»» Adjusting to the new work reality
»» Implementing zero trust for application

access
»» Keeping endpoints, networks, and clouds

secure
Chapter 6
Extending Zero-Trust
Control Off-Net
I
n today’s networks, a user, device, or application could be con-
necting from anywhere, which changes the security paradigm.
The old, perimeter-based security model focused on location:
Where is the user connecting from? Where is the application
hosted? Where is the server installed? In this chapter, you learn
why security must evolve to protect users, devices, and applica-
tions wherever they’re located.
Securing the New Hybrid Workforce

Although businesses have been increasingly enabling mobile
and remote work scenarios for years, the global pandemic forced
many companies to transition to remote work for much of their
workforce practically overnight. Even as organizations begin to
bring their employees back to the office, they’re having to rethink
the office environment and plan for a new reality — one that
includes permanently supporting remote or hybrid work from
home (WFH) or work from anywhere (WFA) models.
CHAPTER 6 Extending Zero-Trust Control Off-Net 35
According to the Pew Research Center, 54 percent of employed
adults in a recent survey say that they want to work from home all
or most of the time when the COVID19 outbreak is over.
This accelerated adoption of remote and hybrid work models has

caused a proliferation in the number of devices and locations
that must be protected as the digital attack surface has expanded
and more applications, devices, data, and users are now exposed.
Understanding and controlling the flow of traffic across these
widely dispersed environments is critical.
WFH/WFA requires both connectivity and security. The appli-

cations that your employees need to perform their work func-
tions may be hosted in an on-premises data center, in a private
cloud, or in a public cloud, so user identification, authentication,
authorization, and access permissions are critical.
In the public cloud, applications can be hosted as a software as

a service (SaaS) offering, or they may be running as a platform
as a service (PaaS), and/or an infrastructure as a service (IaaS)
workload.
To securely implement WFH/WFA, more organizations are look-

ing at zero-trust access (ZTA). ZTA limits user and device access
to networks, which provides identity assurance. Zero-trust net-
work access (ZTNA) then limits user and device access to only the
applications that users need to do their jobs. Combining ZTA and
ZTNA strengthens the company’s security posture.
Looking at WFH/WFA from an outbound perspective, secure

access service edge (SASE) solutions provide secure access for
employees, customers, and partners across operating environ-
ments by securing any user, on any device, anywhere on the
network. A cloud access security broker (CASB) — which is a key
component of SASE — sits between your users (remote workers)
and cloud applications and can be used to monitor activity and
enforce security policies.
SASE (pronounced “sassy”) is a cloud-delivered service that

combines network and security functions with software-defined
wide-area network (SD-WAN) capabilities to support the dynamic,
secure access needs of today’s hybrid organizations. Conceptu-
ally, SASE extends networking and security capabilities beyond
where they’re typically available, which allows users, regardless
of location, to take advantage of ZTNA, CASB, firewall as a ser-
vice (FWaaS), secure web gateway (SWG), and a variety of threat
detection functions.
BANK MIGRATES ITS WORKFORCE

TO A SECURE REMOTE
ENVIRONMENT
Founded in 1988, Banco Fibra is a wholesale bank that guarantees
precision, transparency, and speed to businesses in Brazil. Its busi-
ness strategy is focused on serving medium and large companies in
the most diverse segments and agribusiness. Fibra is built by people,
but strongly reliant on technology. This combination guarantees agile,
flexible, and customized business solutions to customers.
Information security is a top priority at Banco Fibra. As a financial

institution and potential target for cyberattacks, the company has
always diligently preserved its customers’ trust by protecting their
data’s integrity and confidentiality. This concern prompted the bank’s
transformation journey several years ago — one that would be key in
strategically positioning the company within the business world’s new
digital environment.
Challenges
Banco Fibra was already a Fortinet customer, using FortiGate and

FortiClient solutions before the COVID quarantine. The bank initially
intended to use these solutions to provide network and endpoint
security and improve operational efficiency. Now, faced with an
unprecedented scenario, there was an opportunity to take advantage
of these solutions’ functionalities and quickly migrate the workforce to
a remote model.
After the initial setup of the new remote-work model, many adaptations
were necessary to meet the employees’ technology demands, particu-
larly to define the user profiles and to ensure the secure access and the
proper application performance. Another challenge was operating their
softphone solution over the VPNs. Ensuring the performance of the
softphone solution was important because it integrated with the
customer relationship management (CRM) application the bank uses to
provide customer service and monitor customer experience.
(continued)
(continued)
Solutions
In a matter of days, Banco Fibra deployed the required virtual private

networks (VPNs) using the existing security solutions. In less than
10 days, Banco Fibra was able to set up its remote-work environment
with appropriate policies, access rules, and user authentications,
among other features.
Business Impact
• Quickly transitioned teams to a remote-work model, keeping the

bank’s operations running throughout the COVID-19 pandemic
• Maintained the high quality of its customer service in a
remote-work environment
• Extended the bank office’s high level of security to its
350 employees´ homes
• Created the foundations to escalate bank’s digital transformation
The bank is currently considering expanding its VPN solution to

achieve even more redundancy and availability. Another project
involves expanding the security perimeter to the data center, provid-
ing even more scalability and better use of cloud resources in a
natively secure format.
Improving Application Access

and Security
In the zero-trust model, application access is controlled on a
per-session basis and each user and device must be verified, whether
they’re connecting remotely or from the corporate network.
Application access should be mapped to the individual’s role so

that only those applications that are necessary for the user to
perform their assigned job functions are available. Regardless of
whether an application runs in an on-premises data center or a
cloud environment, zero trust is enforced.
Zero trust access (ZTA), discussed in Chapter 2, focuses on role-
based access control (RBAC) to the network. Zero-trust network
access (ZTNA), discussed in Chapter 5, brokers user access to
applications.
Zero-trust application access and security solutions:
»» Verify users and devices for each application session

»» Control user access to applications based on policy
»» Enforce application access policy no matter where the user is
located
»» Create a secure, automatic connection between the user and
ZTNA proxy point
»» Work with physical firewalls, virtual appliances, and Secure
Access Service Edge (SASE) platforms
Delivering Security Services to Endpoints,

Networks, and the Cloud
Digital transformation initiatives and workforce mobility trends
(including WFH/WFA) have changed and expanded the enter-
prise attack surface, opening up new attack vectors that can be
exploited by threat actors both inside and outside the network. A
comprehensive zero-trust security strategy must extend robust
enterprise security services to endpoints, corporate networks, and
private and public clouds.
One of the main reasons for the growing attack surface is the
proliferation of IoT and smart devices that are accessing the
network. Security teams often lack visibility into the deluge of
devices accessing their networks. A zero-trust approach empow-
ers organizations to identify and secure unknown IoT endpoints
and devices that access the network. Integrated endpoint vis-
ibility, granular control, advanced protection, and policy- and
context-based endpoint assessment capabilities work together
in a ZTA solution to ensure organizations are protected against
compromised devices.
Another random document with
no related content on Scribd:
“Your reverend love should know that the lord Ep. 58. a.d. 796.
King Charles has often spoken to me of you in a
loving and trusting manner. You have in him an entirely most faithful
friend. Thus he sent messengers to Rome for the judgement of the
lord apostolic and Ethelhard the archbishop. To your love he sent
gifts worthy. To the several episcopal sees he sent gifts in alms for
himself and the lord apostolic, that you might order prayers to be
offered for them. Do you act faithfully, as you are wont to do with all
your friends.
“In like manner he sent gifts to King Æthelred and his episcopal
sees. But, alas for the grief! when the gifts and the letters were in the
hands of the messengers, the sad news came from those who had
returned from Scotia[111] by way of you, that the nation had revolted
and the king [Æthelred] was killed. King Charles withdrew his gifts,
so greatly was he enraged against the nation—‘that perfidious and
perverse nation,’ as he called them, ‘murderers of their own lords,’
holding them to be worse than pagans. Indeed, if I had not
interceded for them, whatever good thing he could have taken away
from them, whatever bad thing he could have contrived for them, he
would have done it.
“I was prepared to come to you with the king’s gifts, and to go
back to my fatherland.” This was from three to four years later than
his latest visit to our shores. “But it seemed to me better, for the sake
of peace for my nation, to remain abroad. I did not know what I could
do among them, where no one is safe, and no wholesome counsel is
of any avail. Look at the very holiest places devastated by pagans,
the altars fouled by perjuries, the monasteries violated by adulteries,
the earth stained with the blood of lords and princes. What else
could I do but groan with the prophet,[112] ‘Woe to the sinful nation, a
people laden with iniquity, a seed of evildoers; they have forsaken
the Lord, and blasphemed the holy Saviour of the world in their
wickedness.’ And if it be true, as we read in the letter of your dignity,
that the iniquity had its rise among the eldermen, where is safety and
fidelity to be hoped for if the turbid torrent of unfaithfulness flowed
forth from the very place where the purest fount of truth and faith
was wont to spring?
“But do thou, O most wise ruler of the people of God, most
diligently bring thy nation away from perverse habits, and make them
learned in the precepts of God, lest by reason of the sins of the
people the land which God has given us be destroyed. Be to the
Church of Christ as a father, to the priests of God as a brother, to all
the people pious and fair; in conversation and in word moderate and
peaceable; in the praise of God always devout; that the divine
clemency may keep thee in long prosperity, and may of the grace of
its goodness deign to exalt, dilate, and crown to all eternity, with the
benefaction of perpetual pity, thy kingdom—nay, all the English.
“I pray you direct the several Churches of your reverence to
intercede for me. Into my unworthy hands the government of the
Church of St. Martin has come. I have taken it not voluntarily but
under pressure, by the advice of many.”
Offa died in the year in which this letter was written, and his death
brought great changes in Mercia. Excellent as Offa had in most ways
been, we have evidence that the Mercian people were by no means
worthy of the fine old Mercian king. In reading the letter which
contains this evidence, we shall see that Offa had a murderous side
of his character. In those rude days, chaos could not be dealt with
under its worse conditions by men who could not at a crisis strike
with unmitigated severity.
CHAPTER VI
Grant to Malmesbury by Ecgfrith of Mercia.—Alcuin’s letters to Mercia.—Kenulf
and Leo III restore Canterbury to its primatial position.—Gifts of money to the
Pope.—Alcuin’s letters to the restored archbishop.—His letter to Karl on the
archbishop’s proposed visit. Letters of Karl to Offa (on a question of discipline) and
Athelhard (in favour of Mercian exiles).
Before proceeding to examine Alcuin’s letter to a Mercian

nobleman on the death of Offa and his son Ecgfrith, it should be
remarked that we of the diocese of Bristol must not allow the
mention of this poor young king Ecgfrith to pass without our
acknowledgement for a deed of justice done. When Offa defeated
the West Saxon king at Bensington, he took possession of a good
deal of the border land, including two tracts of land which King
Cadwalla of Wessex had given to Malmesbury, namely Tetbury in
Gloucestershire and Purton in Wilts. William of Malmesbury naturally
reports the iniquity of Offa in thus pillaging the abbey which was the
home of William’s life and studies. Offa gave Tetbury to the Bishop of
Worcester. Purton was the subject of a deed by Ecgfrith during his
reign of a few months. The deed has remarkable interest for us in
this diocese, in that it is doubly dated; first as in the seven hundred
and ninety-sixth year from the Incarnation, and next, with a very
interesting recognition of our own Aldhelm, due to the fact that the
theft had been from Aldhelm’s own Malmesbury, “in the eighty-
seventh year from the passing of father Aldhelm.” The deed restores
land of thirty-five families at Piritune, on the east side of Braden
Wood, to the abbat and brethren of Malmesbury, for the repose of
the soul of his father Offa who had taken it from them, and in order
that the memory of Ecgfrith might always be preserved in their
prayers. As a sort of unimportant afterthought he adds that the abbat
and brethren have given him two thousand shillings of pure silver,
probably as many pounds of our money. The deed was signed by
Athelhard of Canterbury, not by Lichfield. The reason no doubt is that
Tetbury and Purton are south of the Thames, and so outside the
Province of Lichfield and within the diminished Province of
Canterbury.
When the death of Offa’s son, the youthful Ecgfrith, king of Mercia,
occurred in this same year 796 in which year his father Offa had
died,[113] and a distant cousin Kenulf succeeded, Alcuin, as has
been said, wrote a very serious letter to one of the chief officers of
Mercia.
“These are times of tribulation everywhere in the Ep. 79. a.d. 797.
land; faith is failing; truth is dumb; malice
increases; and arrogance adds to your miseries. Men are not content
to follow in the steps of our early fathers, in dress, or food, or honest
ways. Some most foolish man thinks out something unsuited to
human nature, and hateful to God; and straightway almost the whole
of the people set themselves busily to follow this above all.
“That most noble youth [Ecgfrith] is dead; not, as I think, because
of his own sins alone, but also because the vengeance of his father’s
bloodshedding has reached the son. For you know best of all how
much blood the father shed that the kingdom might be safe for the
son. It proved to be the destruction, not the confirmation, of his reign.
“Admonish the more diligently your new king [Kenulf], yes, and the
king of Northumbria [Ardwulf] too, that they keep in touch with the
divine piety, avoiding adulteries; that they do not neglect their early
wives[114] for the sake of adulteries with women of the nobility, but
under the fear of God have their own wives, or by consent live in
chastity. I fear that Ardwulf, the king of my part of the country, will
soon[115] have to lose the kingdom because of the insult which he
has offered to God in sending away his own wife, and, it is said,
living openly with a concubine. It seems that the prosperity of the
English is nearly at an end; unless indeed by assiduous prayers, and
honest ways, and humble life, and chaste conversation, and keeping
the faith, they win from God to keep the land which God of His free
gift gave to our forefathers.”
With this letter we may fitly compare the letter which Alcuin wrote
to the king himself, Kenulf, who had thus unexpectedly succeeded. It
begins in a complimentary manner, but it is a very faithful letter. It
carefully recognizes the inconsistencies of Offa’s life, inconsistencies
which appear to have characterized the best rulers in those times,
very rude and violent times, when one occasion and another seemed
to demand ruthless treatment.
“To the most excellent Coenulf, King of the Ep. 80. a.d. 797.
Mercians, the humble levite Albinus wishes health.
“Your goodness, moderation, and nobility of conduct, are a great
joy to me. They are befitting to the royal dignity, which excels all
others in honour, and ought to excel also in perfectness of conduct,
in fairness of justice, in holiness of piety. The royal clemency should
go beyond that of ordinary men, as we read in ancient histories, and
in holy Scripture where it is said[116]—Mercy and truth exalt a throne;
and in the Psalms it is said[117] of Almighty God—All the paths of the
Lord are mercy and truth. The more a man shines forth in works of
truth and mercy, the more has he in him of the image of the divine.
“Have always in mind Him who raised thee from a poor position
and set thee as a ruler over the princes of His people. Know that
thou art rather a shepherd, and a dispenser of the gifts of God, than
a lord and an exactor.
“Have always in mind the very best features of the reign of your
most noble predecessor Offa; his modest conversation; his zeal in
correcting the life of a Christian people. Whatever good
arrangements he made in the kingdom to thee by God given, let your
devotion most diligently carry out; but if in any respect he acted with
greed, or cruelty, know that this you must by all means avoid. For it
is not without cause that that most noble son of his survived his
father for so short a time. The deserts of a father are often visited on
a son.
“Have prudent counsellors who fear God; love justice; seek peace
with friends; show faith and holiness in pious manner of life.
“For the English race is vexed with tribulations by reason of its
many sins. The goodness of kings, the preaching of the priests of
Christ, the religious life of the people, can raise it to the height of its
ancient honour; so that a blessed progeny of our fathers may
deserve to possess perpetual happiness, stability of the kingdom,
and fortitude against any foe; that the Church of Christ, as ordained
by holy fathers, may grow and prosper. Always have in honour, most
illustrious ruler, the priests of Christ; for the more reverently you are
disposed to the servants of Christ, and the preachers of the word of
God, the more will Christ, the King pious and true, exalt and confirm
your honour, on the intercession of His saints.”
When Kenulf, this distant cousin of Ecgfrith, came to the throne,
he looked into the matter of the archbishopric of Lichfield, and he
took a view adverse to Offa’s action. He wrote to Pope Leo III a
letter,[118] in which he put the points very clearly. His bishops and
learned men had told him that the division of the Province of
Canterbury into two provinces was contrary to the canons and
apostolical statutes of the most blessed Gregory, who had ordered
that there should be twelve bishops under the archbishop of the
southern province, seated at London. On the death of Augustine of
Canterbury, it had seemed good to all the wise men of the race, the
Witangemote, that not London but Canterbury should be the seat of
the Primacy, where Augustine’s body lay. King Offa, by reason of his
enmity with the venerable archbishop Jaenbert and the people of
Kent, set to work to divide the province into two. The most pious
Adrian, at the request of the said king, had done what no one before
had presumed to do, had raised the Mercian prelate to the dignity of
the pallium. Kenulf did not blame either of them; but he hoped that
the Pope would look into the matter and make a benign and just
response. He had sent an embassy on the part of himself and the
bishops in the previous year by Wada the Abbat; but Wada, after
accepting the charge, had indolently—nay foolishly—withdrawn. He
now sent by the hands of a presbyter, Birine, and two of his officers,
Fildas and Cheolberth, a small present, out of his love for the Pope,
namely, 120 mancuses,[119] some forty to fifty pounds, say not far off
£1000 of our time.
Pope Leo addressed his reply to king Kenulf, his most loved
bishops, and most glorious dukes. It was a difficult letter to write, for
Kenulf had been very frank about the uncanonical action of Hadrian
the Pope. Leo answered this part of Kenulf’s letter by stating that his
predecessor had acted as he had done (1) because Offa had
declared it to be the universal wish, the petition of all, that the
archbishopric should be divided into two; (2) because of the great
extension of the Mercian kingdom; (3) for very many causes and
advantages. He, Leo, now authorized the departure from Pope
Gregory’s order in so far as this, that he recognized Canterbury, not
London, as the chief seat of archiepiscopal authority. He declared
that Canterbury was the primatial see, and must continue and be
viewed as such. I cannot find in his letter a definite declaration that
he annuls the act of his predecessor, but that is the effect of the
letter; nor does he declare that Lichfield is no longer an
archbishopric. Kenulf, as we have seen, had sent him, out of his
affection for him, a gift of 120 mancuses. But he reminded the king
that Offa had bound his successors to maintain the gift to the Pope,
in each year, of as many mancuses as there are days in the year,
namely, he says, 365, as alms to the poor, and as an endowment for
keeping in order the lamps [in the churches]. This is much more
likely than the shadowy gifts of Ina, king of Wessex, to have been
the origin of Peter’s Pence, a sum of money collected in England, at
first fitfully and eventually year by year, and sent out to the Pope.
The money was collected in the parishes of each diocese down to
the time of the Reformation. It is a regular item in the
churchwardens’ accounts of the earlier years of Henry VIII. Only a
fixed amount of the whole sum collected was sent to the Pope, the
balance being used for repairs in the several dioceses. We have a
list prepared by a representative of a late mediaeval Pope giving
£190 6s. 8d. as the amount received by him for the year,
corresponding roughly to a normal 300 marks a year.
Offa’s money for the Pope went of course from Mercia. When
Wessex became predominant, Ethelwulf, the son of Ecgbert and
father of Alfred, made large gifts to Rome, and left by will 300
mancuses, 100 in honour of St. Peter, specially for filling with oil all
the lamps of his apostolic church on Easter Eve and at cock crow,
100 in honour of St. Paul, in the same terms and for the same
purpose in respect of the basilica of St. Paul, and 100 for the Pope
himself. King Alfred also sent presents to Rome. From 883 to 890
there are four records of gifts from Wessex. After 890 we have no
such record in Alfred’s reign; and in Alfred’s will there is no mention
of the spiritual head of the Church of the West.
We learn from our own great historian, William of Malmesbury, that
Kenulf wrote two later letters to Leo on this subject, and he gives us
Leo’s reply.[120] Athelhard, the Pope says, has come to the holy
churches of the blessed apostles Peter and Paul, to fulfil his vow of
prayer and to inform the Pope of his ecclesiastical mission. He tells
the king that by the authority of St. Peter, the chief of the apostles,
whose office though unworthily he fills, he gives to Athelhard such
prelatical authority that if any in the province, whether kings, princes,
or people, transgress the commands of the Lord, he shall
excommunicate them till they repent. Concerning the jurisdiction
which the archbishops of Canterbury had held, as well over bishops
as over monasteries, of which they had been unjustly deprived, the
Pope had made full inquiry, and now placed all ordinations and
confirmations on their ancient footing, and restored them to him
entire. Thus did Pope Leo III condemn the injustice of Pope Hadrian
I. We had better have managed our own affairs, instead of paying to
foreigners infinite sums of money to mismanage them.
Before we leave this strange episode of the creation of an
archbishopric of Lichfield, it is of special local interest to us in Bristol,
and to the deanery of Stapleton, that the chief Mercian prelate,
Higbert of Lichfield, signed deeds relating to Westbury upon Trym
and Aust on Severn, above the archbishop of Canterbury. This was
in 794. Offa the king signed first, Ecgferth, the king’s young son,
second, and then Hygeberht; Ethelhard of Canterbury coming fifth in
one and fourth in the other. The first deed gave from the king to his
officer Ethelmund, in 794, four cassates of land at the place called
Westbury, in the province of the Huiccians, near the river called
Avon, free of all public charges except the three which were common
to all, namely, for the king’s military expeditions, for the building of
bridges, and for the fortification of strongholds.[121] The other deed
restores to the see of Worcester (Wegrin) the land of five families at
Aust, which the duke Bynna had taken without right, it being the
property of the see of Worcester. To make all safe, six dukes made
the sign of the cross at the foot of this deed, which is, as we all know,
the origin of the modern phrase ‘signing’ a deed or a letter. The
dukes included Bynna himself.
Alcuin wrote a very wise letter to Athelhard of Ep. 85. a.d. 797.
Canterbury on the occasion of the restoration of the
primacy. He advised that penance should be done. Athelhard and all
the people should keep a fast, he for having left his see, they for
having accepted error. There should be diligent prayers, and alms,
and solemn masses, everywhere, that God might wipe out what any
of them had done wrong. The archbishop was specially urged to
bring back study into the house of God, that is, the conventual home
of the monks and the archbishop, with its centre, the cathedral
church. There should be young men reading, and a chorus of
singers, and the study of books, in order that the dignity of that holy
see might be renewed, and they might deserve to have the privilege
of electing to the primacy.
“The unity of the Church, which has been in part cut asunder, not
as it seems for any reasonable cause but from grasping at power,
should, if it can be done, be restored in peaceful ways; the rent
should be stitched up again. You should take counsel with all your
bishops, and with your brother of York, on this principle, that the
pious father Higbert of Lichfield be not deprived of his pall during his
lifetime, but the consecration of bishops must come back to the holy
and primal see. Let your most holy wisdom see to it that loving
concord exist among the chief shepherds of the churches of Christ.”
With regard to the remark of Alcuin that Ep. 171. a.d. 801.
Athelhard should do penance for having left his
see, it may be explained that Alcuin had in vain advised Athelhard
not to leave England on the restoration of the primacy to Canterbury.
Athelhard persisted in visiting Rome, and informed Alcuin that he
had commenced the journey. Alcuin thereupon wrote this:—“Return,
return, holy father, as soon as your pious embassy is finished, to
your lost sheep. As there are two eyes in the body, so I believe and
desire that you two, Canterbury and York, give light throughout the
breadth of all Britain. Do not deprive your country of its right eye.”
Then Alcuin gives a very significant hint that the ways of the clergy
of England are not good enough for France, and they had better not
let Charlemagne see anything of that kind.
“If you come to the lord king, warn your companions, and
especially the clergy, that they acquit themselves in an honourable
manner, in all holy religion, in dress, and in ecclesiastical order; so
that wherever you go you leave always an example of all goodness.
Forbid them to wear in the presence of the lord king ornaments of
gold or robes of silk; let them go humbly clad, after the manner of
servants of God. And through every district you must pass with
peace and honest conversation, for you know the manner and
custom of this Frankish race.”
Nothing could make more clear the commanding position held by
Alcuin than this exceedingly free counsel from a deacon to the
Primate of England. We may quote portions of yet another letter
giving the same impression.
In a letter to Athelhard after his safe return to Ep. 190. a.d. 802.
England and a favourable reception which he had
reported to Alcuin, Alcuin congratulated the archbishop on the
restoration to its ancient dignity of the most holy see of the first
teacher of our race. By divine favour, the members now once more
cohered in unity with the proper head, and natural peace shone forth
between the two chief prelates of Britain, and one will of piety and
concord was vigorous under the two cities of metropolitans. “And
now,” he writes, “now that you have received the power to correct
and the liberty to preach, fear not, speak out! The silence of the
bishop is the ruin of the people.”
It is an interesting fact that we have a letter which Alcuin wrote to
Karl, introducing to him this same archbishop on the very journey of
which he so decidedly disapproved.
“To the most greatly desired lord David the king, Ep. 172. a.d. 801.
Flaccus his pensioner wishes eternal health in
Christ.
“The sweetness of your affection, and the assurance of your
approved piety, very often urge me to address letters to your
authority, and by the office of syllables to trace out that which bodily
frailty prevents my will from accomplishing. But novel circumstances
compel me now to write once more, that the paper may bring the
affection of the heart, and may pour into the ears of your piety the
prayers which never have been in vain in the presence of your pity.
Nor do I believe that my prayers for your stableness and safety are
vain in the sight of God, for the divine grace gladly receives the tears
which flow forth from the fount of love[122].
“I have been informed that certain of the friends of your Flaccus,
Edelard to wit, Metropolitan of the See of Dorobernia and Pontiff of
the primatial see in Britain, and Ceilmund[123] of the kingdom of the
Mercians, formerly minister of king Offa, and Torhcmund[124] the
faithful servant of king Edilred, a man approved in faith, strenuous in
arms, who has boldly avenged the blood of his lord, desire to
approach your piety[125]. All of these have been very faithful to me,
and have aided me on my journey; they have also aided my boys as
they went about hither and thither. I pray your best clemency to
receive them with your wonted kindness, for they have been close
friends to me. I have often known bishops religious and devoted in
Christ’s service, and men strong and faithful in secular dignity, to be
laudable to your equity; for there is no doubt that all the best men,
approved by their own conscience, love good men, being taught by
the example of the omnipotent God who is the highest good. And it is
most certain that every creature that has reason has by His
goodness whatever of good it has, the Very Truth saying, ‘I am the
light of the world. He that followeth me walketh not in darkness but
shall have the light of life.’ John viii. 12.”
Before we leave Mercian affairs and the relations between Karl
and Offa, it may be of interest to give a letter[126] from Karl to Offa
which will serve to show the extreme care he took in order to
maintain ecclesiastical discipline, and the severity of that discipline.
That a man with all the affairs of immense dominions on his hands
should have made time to produce such a letter on such a point
seems very worthy of note. Karl’s statement of his titles shows that
this is an early letter.
“Karl, by the grace of God king of the Franks and Defender of the
Holy Church of God, to his loved brother and friend Offa greeting.
“That priest who is a Scot[127] has been living among us for some
time, in the diocese of Hildebold, Bishop[128] of Cologne. He has
now been accused of eating meat in Lent. Our priests refuse to
judge him, because they have not received full evidence from the
accusers. They have, however, not allowed him to continue to reside
there, on account of this evil report, lest the honour in which the
priesthood is held should be diminished among ignorant folk, or
others should be tempted by this rumour to violate the holy fast. Our
priests are of opinion that he should be sent to the judgement of his
own bishop, where his oath was taken.
“We pray your providence to order that he transfer himself as soon
as conveniently may be to his own land, that he may be judged in
the place from which he came forth. For there also it must be that the
purity in manners and firmness in faith and honesty of conversation
of the Holy Church of God are diligently kept according to canonical
sanction, like a dove perfect and unspotted, whose wings are as of
silver and the hinder parts should shine as gold.
“Life, health, and prosperity be given to thee and thy faithful ones
by the God Christ for ever.”
A letter which Karl wrote to Athelhard of Canterbury begging him
to intercede for some exiles, sets forth his style and title very
differently[129], evidently at a later date.
It bears very directly upon one of the complaints which, as we
have seen, Offa had made in letters to Karl; namely, the shelter
afforded at Karl’s court to fugitives from Mercia.
“Karl, by the grace of God king of the Franks and Lombards and
Patrician of the Romans, to Athilhard the archbishop and Ceolwulf
his brother bishop, eternal beatitude.
“In reliance on that friendship which we formed in speech when we
met, we have sent to your piety these unhappy exiles from their
fatherland; praying that you would deign to intercede for them with
my dearest brother king Offa, that they may be allowed to live in their
own land in peace, without any unjust oppression. For their lord
Umhrinsgstan[130] is dead. It appeared to us that he would have
been faithful to his own lord if he had been allowed to remain in his
own land; but, as he used to say, he fled to us to escape the danger
of death, always ready to purge himself of any unfaithfulness. That
reconciliation might ensue we kept him with us for a while, not from
any unfriendliness.
“If you are able to obtain peace for these his fellow tribesmen, let
them remain in their fatherland. But if my brother gives a hard reply
about them, send them back to me uninjured. It is better to live
abroad than to perish, to serve in a foreign land than to die at home.
I have confidence in the goodness of my brother, if you plead
strenuously with him for them, that he will receive them benignantly
for the love that is between us, or rather for the love of Christ, who
said, Forgive and it shall be forgiven you.
“May the divine piety keep thy holiness, interceding for us, safe for
ever.”
It was a skilful stroke of business on Karl’s part to send the men
over to the charge of the archbishop, which amounted to putting
them in sanctuary. If he had kept them in France and written to beg
that they might be allowed to return, it would have been much easier
for Offa to say no. And if he had sent them direct to Offa in the first
instance, they would probably never have got out of his clutches at
all.
CHAPTER VII
List of the ten kings of Northumbria of Alcuin’s time.—Destruction of Lindisfarne,
Wearmouth, and Jarrow, by the Danes.—Letters of Alcuin on the subject to King
Ethelred, the Bishop and monks of Lindisfarne, and the monks of Wearmouth and
Jarrow.—His letter to the Bishop and monks of Hexham.
We must now turn to Alcuin’s native kingdom of Northumbria, over

whose evil fortunes he grieved so greatly in the home of his
adoption.
I do not know how better some idea can be formed of the political
chaos to which Northumbria was reduced in the time of Alcuin than
by reading a list of the kings of that time. It is a most bewildering list.
All went well so long as Eadbert, the brother of Archbishop
Ecgbert, reigned. He was the king of Alcuin’s infancy and boyhood
and earliest manhood. His reign lasted from 737 to 758, when he
retired into a monastery. He was the 21st king, beginning with Ida
who created the kingdom in 547. He was succeeded by (22) Oswulf
his son, who was within a year slain by his household officers, July
24, 759, and was succeeded on August 4 by (23) Ethelwald, of
whose parentage we do not know anything. In 765 he was deprived
by a national assembly, and (24) Alchred was placed on the throne,
a fifth cousin of the murdered Oswulf, and therefore of the royal line.
In 774 he was banished, and went in exile to the king of the Picts,
being succeeded by (25) Ethelred, the son of his deprived
predecessor Ethelwald. Ethelred reigned from 774 to 779, when in
consequence of cruel murders ordered by him he was driven out,
and (26) Alfwold, son of (22) Oswulf, and therefore of the old royal
line, succeeded. Alfwold was murdered in 788, and was succeeded
by (27) Osred, the son of (24) Alchred, sixth cousin of his
predecessor, and therefore of the royal line. After a year he was
deposed and tonsured, and was eventually put to death in 792 by
(25) Ethelred, who had recovered the throne lost by his expulsion in
779. He was killed in 796 in a faction fight, after he had put to death
the last two males, so far as we know, of the royal line of Eadbert,
Ælf and Ælfwine, sons of (26) Alfwold. Simeon of Durham tells us
(a.d. 791) that they were persuaded by false promises to leave
sanctuary in the Cathedral Church of York; were taken by violence
out of the city; and miserably put to death by Ethelred in
Wonwaldrenute. He was succeeded by (28) Osbald, of unknown
parentage, but a patrician of Northumbria; he only reigned twenty-
seven days, fled to the king of the Picts, and died an abbat three
years later, in 799. He was succeeded by (29) Eardulf, a patrician of
the blood royal,[131] who had been left for dead by (25) Ethelred, but
had recovered when laid out for burial by the monks of Ripon. He
had the fullest recognition as king; was consecrated at the great altar
of St. Paul in York Minster on May 26, 796, by Archbishop Eanbald.
In his reign Alcuin died. In 806 he was driven out by (30) Elfwald, of
unknown parentage, but by the help of the Emperor Charlemagne he
was restored in 808. He died in 810, and was succeeded by his son
(31) Eanred, who was the last king but one of the royal house, and
the last independent king of Northumbria, dying in 840, and being
succeeded by his son (32) Ethelred II, expelled in 844, restored in
the same year, and killed sine prole in 848.
This, as has been said, is a most bewildering list. It is, however,
convenient to have it stated at length, inasmuch as several of these
kings are named in a noteworthy manner in the letters of Alcuin. To
emphasize the view that Alcuin took of the state of Northumbria, the
list just given may be summarized thus, it being borne in mind that
every king who reigned in Alcuin’s time after Eadbert’s death in 758
is included in the summary. Oswulf, murdered 759; Ethelwald,
deprived 765; Alchred, banished 774; Ethelred, expelled 779;
Alfwold, murdered 788; Osred, deposed 789; Ethelred, killed by his
own people, 796; Osbald, expelled 797; Eardulf, expelled 806.
The Venerable Bede had said in his letter to Archbishop Ecgbert in
735 that unless some very great change for the better was made in
all walks of life in Northumbria, that country would find its men quite
unable to defend it successfully if an invasion took place. We have
seen that so far as the reigning persons were concerned, the change
was for the worse; we have now to see how bitterly true Bede’s
prophecy, or rather his calculation of the necessary consequences,
proved to be. We are taken in thought to the year 793, not quite sixty
years after Bede’s letter. One excellent reign had lasted twenty-one
years, the next eight reigns averaged four and a half years, and all
ended in violence.
Higbald, the eleventh Bishop of Lindisfarne, 780-803, takes us
back nearly to the best times of that specially Holy Isle. Ethelwold,
724-40, his next predecessor but one, was the bishop under whom
King Ceolwulf, to whom Bede dedicated his famous work the
Ecclesiastical History of the English Race, became a monk. It was
this king-monk that taught the monks of Lindisfarne to drink wine and
ale instead of the milk and water prescribed by their Scotic founder,
Aidan. His head was preserved in St. Cuthbert’s coffin. Ethelwold’s
immediate predecessor was Eadfrith, 698-721, who wrote that
glorious Evangeliarium which is a chief pride of England, the
Lindisfarne Gospels. To Bishop Eadfrith and his monks Bede
dedicated his Life of St. Cuthbert, between whom and Eadfrith only
one bishop had intervened. The entry at the end of the Lindisfarne
Gospels connects Ethelwold and Eadfrith with the production and
binding of that noble specimen of the earliest Anglian work. Put into
modern English it runs thus:—
“Eadfrith, bishop of the church of Lindisfarne, he wrote this book at
first, for God and St. Cuthbert and all the saints that are in the island,
and Ethelwald, the bishop of Lindisfarne island, he made it firm
outside and bound it as well as he could.”
The entry proceeds to tell that Billfrith, the anchorite, wrought in
smith’s work the ornaments that were on the outside with gold and
gems and silver overlaid, a treasure without deceit. And Aldred, the
presbyter, unworthy and most miserable, glossed it in English, and
made himself at home with the three parts, the Matthew part for God
and St. Cuthbert, the Mark part for the bishop—unfortunately it is not
said for which of the bishops, the Luke part for the brotherhood. Only
one bishop came between Ethelwold, who bound this priceless
treasure, and Higbald, to whom we now turn.
The Saxon Chronicle has under the year 787 this entry:—“In this
year King Beorhtric [of Wessex] took to wife Eadburg, daughter of
King Offa. In his days came three ships of the Northmen from
Haurthaland [on the west coast of Norway]. And the sheriff rode to
meet them there, and would force them to the king’s residence, for
he knew not what they were. And there they slew him. These were
the first ships of Danish men that sought the land of the English
race.”
They soon came again, this time not to the coast of Wessex, but to
the coast easiest of access from their own land. In 793 this is the
entry in the Saxon Chronicle:—
“In this year dire forewarnings came over the land of Northumbria
and pitifully frightened the people, violent whirlwinds and lightnings,
and fiery dragons were seen flying in the air. These tokens mickle
hunger soon followed, and a little after that, in this same year, on the
sixth of the ides of January [January 8] the harrying of heathen men
pitifully destroyed God’s church in Lindisfarne through rapine and
manslaughter.”
In the next year, 794, it is said:—
“The heathen ravaged among the Northumbrians, and plundered
Ecgferth’s minster at Donmouth [Wearmouth]; and there one of their
leaders was slain, and also some of their ships were wrecked by a
tempest, and many of them were there drowned, and some came to
shore alive and men soon slew them off at the river mouth.”
Wattenbach and Dümmler make the ruin of Lindisfarne take place
not on January 8 but on June 8. The Saxon Chronicle has Ianr. in
both of the MSS. which name the month. There is only one other
entry in the year 793, and it follows this,—“And Sicga [who had
murdered King Alfuold] died[132] on the 8th of the Kalends of March,”
that is, February 22. It is clear that these two events took place at the
end of 793, the years at that time ending with March, and January,
not June, was the month of ruin.
The twin monasteries of Wearmouth and Jarrow are described as
Ecgferth’s minster, because King Ecgfrith of Northumbria, 670-85,
gave land to Benet Biscop to found a monastery at the mouth of the
Don, now called the Wear, and some years later another portion of
land for the twin monastery of St. Paul, Jarrow. Later in Biscop’s life
he purchased two additional pieces of land from the next king,
Aldfrith, giving for the first two royal robes, or palls, made all of silk,
worked in an incomparable manner, which he had bought in Rome.
For the second, a much larger piece, he gave to the king a
manuscript collection of geographical writings, of beautiful
workmanship. We in the south-west must always remember that
Benedict Bishop first brought his vast ecclesiastical treasures to the
court of Wessex, but finding his royal patron dead went up north with
them. But for the death of the King of Wessex, we should have had
Wearmouth and Jarrow here as well as Malmesbury, Bede as well as
Aldhelm, and it may be Alcuin too.
We have letters of Alcuin to King Ethelred, to Higbald the Bishop
of Lindisfarne, and to the monks of the twin monastery of
Monkwearmouth and Jarrow, on this catastrophe. The letter to
Ethelred comes first:—
“To my most loved lord King Ethelred and all his Ep. 22. a.d. 793.
chief men the humble levite Alchuine sends
greeting.
“Mindful of your most sweet affection, my brothers and fathers and
lords honourable in Christ; deeply desiring that the divine mercy may
preserve to us in long-lived prosperity the fatherland which that
mercy long ago gave to us with gratuitous freedom; I therefore,
comrades most dear, whether present, if God allow it, by my words,
or absent by my writings under the guidance of the divine spirit, do
not cease from admonishing you, and by frequent repetition to
convey to your ears, you who are citizens of the same fatherland,
those things which are known to pertain to the safety of this earthly
realm and to the blessedness of the heavenly home; so that things
many times heard may grow into your minds with good result. For
what is love to a friend if it keeps silence on matters useful to the
friend? To what does a man owe fidelity if not to his country? To
whom does a man owe prosperity if not to its citizens? By a double
relationship we are fellow-citizens of one city in Christ, that is as
sons of Mother Church and of one native country. Let not therefore
your humanity shrink from accepting benignly what my devotion
seeks to offer for the safety of our land. Think not that I am charging
faults against you: take it that I aim at warding off penalties.”
We should here bear in mind that Ethelred had fourteen years
before this been expelled for cruel murders, and that he was now in
the first year of his restored reign and had already sent away his first
wife and taken another, a scandal so great in those days—bad as
they were—that the Saxon Chronicle with remarkable particularity
gives the month and the day of the gross offence, September 29. He
afterwards murdered the two surviving members of the royal house.
Alcuin’s letter to the king proceeds:—
“It is now nearly 350 years that we and our fathers have dwelt in
this most fair land, and never before has such a horror appeared in
Britain as we now have suffered at the hands of pagans. And it was
not supposed that such an attack from the sea was possible.[133]
Behold, the church of the holy Cuthbert is deluged with the blood of
the priests of God, is spoiled of all its ornaments; the place more
venerable than any other in Britain is given as a prey to pagan races.
From the spot where, after the departure of the holy Paulinus from
York, the Christian religion took its beginning amongst us, from that
spot misery and calamity have begun. Who does not fear? Who
does not mourn this as if his fatherland itself was captured?”
We should note Alcuin’s recognition of the fact that the restoration
of Christianity in Northumbria was due not to persons of the Anglo-
Saxon race and Church, but to Aidan and his monks of the Irish race
and Church.
“My brethren, give your most attentive consideration, your most
diligent investigation, to this question,—is this most unaccustomed,
most unheard-of evil, brought upon us by some unheard-of evil
custom? I do not say that there was not among the people of old the
sin of fornication. But since the days of King Alfwold[134] fornications,
adulteries, incests, have inundated the land to such an extent that
these sins are unblushingly perpetrated even among the handmaids
dedicated to God. What shall I say of avarice, rapine, and judicial
violence, when it is clearer than the light how these crimes have
increased, and a despoiled people are the evidence of it. He who
reads the Holy Scriptures, and revolves ancient history, and
considers the working of the world, will find that for sins of this nature
kings lose kingdoms, and peoples lose their father-land. He will find
that when men in power have unjustly seized the property of others,
they have justly lost their own....
“Consider the manner of dress, the manner of wearing the hair, the
luxurious habits of princes and of people. Look at the way in which
the pagan manner of trimming the beard and cutting the hair is
imitated. Do you not fear those whom you thus copy? Look at the
immoderate use of clothes, beyond any necessity of human nature.
This superfluity of the princes is the poverty of the people. Some are
loaded with garments, while others perish with cold. Some flow over
with luxuries and feasts like the rich man in purple, while Lazarus at
the gate dies of hunger. Where is brotherly love? Where is that pity
which we are bidden have for the wretched? The satiety of the rich
man is the hunger of the poor. That Scripture saying is to be
dreaded, ‘He shall have judgement without mercy that hath shewed
no mercy’[135]; and we have the words of the blessed Peter the
Apostle[136], ‘The time is come that judgement must begin at the
house of God.’ Judgement has begun, and with terrible force, at the
house of God where rest so many lights of the whole of Britain. What
is to be expected for other places, if the divine judgement has not
spared this most holy place? It is not for the sins of only those who
dwelled there that this has been sent.
“Would that the penalty that has come upon them could bring
others to amend their lives. Would that the many would fear what the
few have suffered, and each would say in his heart, groaning and
trembling, ‘if such men, if fathers so holy, did not save their own
habitation, the place of their own repose, who shall save mine?’
Save your country by assiduous prayers to God, by works of justice
and of mercy. Be moderate in dress and in food. There is no better
defence of a country than the equity and piety of princes, and the
prayers of the servants of God.”

(PDF Download) Zero Trust Access For Dummies, Fortinet Special Edition Lawrence Miller Fulll Chapter

Uploaded by

Copyright:

Available Formats

(PDF Download) Zero Trust Access For Dummies, Fortinet Special Edition Lawrence Miller Fulll Chapter

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

(PDF Download) Zero Trust Access For Dummies, Fortinet Special Edition Lawrence Miller Fulll Chapter

Uploaded by

Copyright:

Available Formats

Full download test bank at ebook ebookmass.

Zero Trust Access For Dummies,

CLICK LINK TO DOWLOAD

Oracle Autonomous Database For Dummies®, 3rd Special

CISSP For Dummies, 7th Edition Lawrence C. Miller

Privileged Access Management For Dummies®, Delinea

Zero-trust – An Introduction 1st Edition Tom Madsen

Zero Waste Cooking For Dummies 1st Edition Rosanne Rust

Access For Dummies Laurie A. Ulrich

5G & Beyond For Dummies Larry Miller

Investing In Dividends For Dummies, 2nd Edition

LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: WHILE THE PUBLISHER AND AUTHORS HAVE

To protect this greatly expanded attack surface from modern

To successfully implement a zero trust access strategy, organiza-

If any of these assumptions describe you, then this is the book

The case studies provide best practices from organizations that

This icon points out important information you should commit

Tips are appreciated, but never expected — you’ll appreciate these

Beyond the Book

2 Zero Trust Access For Dummies, Fortinet Special Edition

»» Going beyond traditional access control

»» Defining zero-trust concepts

»» Reaping the benefits of zero trust

Surveying the Modern Threat Landscape

CHAPTER 1 Understanding the Need for Zero Trust 3

Traditional security models work under the assumption that

According to the Verizon 2021 Data Breach Investigations Report

As companies modernize their networks to accommodate remote

Recognizing the Limitations of

4 Zero Trust Access For Dummies, Fortinet Special Edition

»» Ongoing verification of users and devices.

Today’s networks have vast, dynamic, and in some cases, even

Looking at Zero-Trust Basics

To be fair, the perimeter-based model isn’t as black and white

CHAPTER 1 Understanding the Need for Zero Trust 5

The zero-trust model moves security away from implied trust

Zero-trust access (ZTA) builds on the zero-trust model and

6 Zero Trust Access For Dummies, Fortinet Special Edition

Zero-trust network access (ZTNA) is an element of ZTA that

ZTNA is the natural evolution of the VPN. Given the complexity

Realizing the Benefits of Zero Trust

Zero trust delivers the following benefits for organizations:

»» Reduces risk: When you automatically extend trust to any

CHAPTER 1 Understanding the Need for Zero Trust 7

8 Zero Trust Access For Dummies, Fortinet Special Edition

»» Using role-based access control (RBAC) to

»» Keeping privileged access secure

Knowing Who Connects to Your Network

CHAPTER 2 Establishing IAM as a Foundation for Zero Trust 9

Strong authentication, or multi-factor authentication (MFA),

»» Something you know (for example, a user ID and password)

Adaptive or contextual authentication evaluates additional user

»» Allow user access when the risk is deemed to be low

For example, using the network attribute of the adaptive authen-

Another challenge facing organizations today is the geographi-

10 Zero Trust Access For Dummies, Fortinet Special Edition

Attacks against endpoint devices are increasing. According to a

Today, there is practically no standardization of device configu-

Today’s enterprise identity environments are made up of vari-