Episode Details

Zero-trust appears on every vendor slide, but most explanations stop at the network perimeter. This episode asks what the model means at the data layer, where a Chief Data Officer actually works, and argues that zero-trust is a posture you maintain rather than a product you buy. The position is blunt: classification comes before technology, and access rules written without honest data tiering create friction people route around.

Listeners come away able to separate network zero-trust from data zero-trust, apply the three checks at the moment of access (identity, context, data sensitivity), tier data as public, internal, confidential or regulated, and run a five-dataset access audit. Includes Microsoft Purview figures on unlocated sensitive data and an insurer rollout that failed.

Key takeaways

• Classify your data as public, internal, confidential or regulated before you write any access rules.
• Apply continuous verification and heavy authentication checks only to the top two sensitivity tiers.
• Check identity, device and location context, and data sensitivity at the moment of access, not once at login.
• Refuse rip and replace pitches: bolt continuous verification onto your existing identity system and data catalog.
• Pull your five most sensitive datasets and ask exactly who can access them right now and when anyone last checked.

Chapters
0:00 What zero-trust means before the marketing
1:03 Identity, context and data sensitivity at access
1:51 When authentication friction drives workarounds
2:21 Classifying data into four tiers first
3:05 Why rip and replace is unnecessary
3:52 The Monday morning access audit

Go deeper, free lessons

• Data classification & access control: the zero-trust data approach
• Data lineage & metadata management: knowing where your data was born
• GDPR in practice: the 10 mistakes CDOs make most often
• Insider threats and shadow IT: the risks no data strategy paper covers
• CDO in financial services: when regulation is your architecture

Full article and transcript: https://www.mba-training.com/blog/zero-trust-architecture-enterprise-data-access

MBA Training, mba-training.com