ukncsc/zero-trust-architecture

Suggestion for #5 know device health - differentiating health from hygiene

Closed this issue · 1 comments

Its great to see some clear guidance emerging in this area!! Some thoughts:

Currently the principle regarding measuring device health implies in the first section that a single signal is of importance here. Is there not the potential for multiple signals? With rewording along the following lines

"Determining if the device accessing your services is up-to-date, compliant with your device configuration policies and in a healthy state is important as these represent some of the most important signals used to control access to services and data."

Referring to a single signal risks conflating the assessment of hygiene (policy configuration, up to date patches etc) with health (whether a compromise changes device state irrespective of good hygiene).

stu-h commented

Agreed that makes more sense and is what I intended.