Protect Surface: Hold the Line on Your Zero Trust Strategy
Chief Evangelist
On the second day at Gettysburg during the American Civil War, Colonel Joshua Chamberlain and his men held the far-left end of the Union line. Low on ammunition and about to be overrun, Chamberlain ordered bayonets fixed and swung the left half of his line down the hill like a door slamming shut.
From one decisive action, near defeat turned into a stunning victory.
My friend Don Yeske tells that story in his chapter of Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era, the new book I put together with some of the sharpest minds in cybersecurity.
Don uses it to make a point about where a battle is fought. Chamberlain was guarding the very end of the Union line, and if that end broke, the whole line could fall. His decision was a brilliant tactic, and it counted because he and his commanders had already decided that hill was the ground they had to hold.
Cybersecurity needs the same kind of thinking. We have plenty of Zero Trust tactics, but if you don't have a clear idea of where to use those tactics, they're effectively worthless.
A Protect Surface is your ground worth holding. It tells you exactly where you need to use your tactics. And it’s how you build a Zero Trust strategy you can actually carry out.
Zero Trust guidance has a strategy gap
Don helped build the U.S. Department of War roadmap that defines 45 Zero Trust capabilities, then led Zero Trust work at Homeland Security, where his team defined 46 capabilities.
Add OMB M-22-09, CISA’s Zero Trust Maturity Model, and NIST SP 800-207, and you’ve got a deep library on what to do and how.
What that library mostly leaves out is where to start. Some guidance says nothing about sequence, and some says to do everything, everywhere, all at once. Neither is a plan anyone can carry out.
How a Protect Surface turns Zero Trust into a strategy
Early critics called Zero Trust too complex to build, and they had a point. So in 2014, I coined the term Protect Surface.
Your attack surface is everything you own, and it grows every year. A Protect Surface is one set of data, assets, applications, or services you've decided is worth protecting.
You draw a boundary around it, map how it talks, and build your Zero Trust architecture out from there. Microsegmentation enforces that boundary, with least-privilege access as the rule inside it.
Building your Protect Surface: start first with what matter most
Don’s analogy for this is one of my favorites. Picture a harbor full of yachts, battleships, and dinghies, all with holes in them. Patch every hole you can find as fast as you can, and you’ll still end up with a harbor full of sunken boats.
The smarter move is to pick the boats that matter most and can be saved, then patch every hole in those.
Don backs it up with real numbers. When M-22-09 came out, about 60% of federal systems already met its phishing-resistant MFA requirement. Two years later, that reached roughly 80%. Yet nobody can say for sure that a single resource at any agency was better protected.
That’s 80% of the holes patched in 100% of the boats. The same effort built around Protect Surfaces patches 100% of the holes in 80% of the boats, and those boats stay afloat.
How to build a Protect Surface roadmap? The Cloud Security Alliance and NIST both lay out the same process:
- List your key business processes and the resources each one depends on.
- Rank those resources by how important they are and how easy they are to protect.
- Start with the ones a single team uses and your current tools can already cover, then add new Protect Surfaces in a planned order.
Why a Protect Surface strategy can’t wait
In 2010, some people still believed you could stop every breach. Today, frontier AI has settled that argument.
Models now find and exploit flaws so fast that the U.S. government no longer even tries to keep a catalog of them. Every week your team spends patching dinghies at random gives AI-driven attackers another week to find your battleship.
A Protect Surface strategy tells you which assets have to survive an attack and puts your Zero Trust architecture to work around those first. When a breach comes, it lands somewhere it can’t do much harm.
My advice? Pick one Protect Surface this quarter and build out from there.
You’ll find Don’s full chapter, plus a chapter on every step of the Zero Trust model, in Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era.
