Blog

I updated the four dimension framework today. Section 4.2 introduces the TRUST posture model — the four components that make up a principal’s TRUST position: Human Identity Assurance, Traditional Non-Person Entity Assurance, Agent Identity Assurance, and System Integrity Assurance. It ends with a caveat I meant sincerely: no platform will surface all of these signals, so organizations should treat this as a governance architecture to work toward rather than a formula to compute precisely. ...

When I was at CISA, we organized identity governance around four capability areas: TRUST, CRED, PRIV, and BEHAVE. They were mapped to CDM program requirements, documented in federal reference architecture, and implemented across U.S. agencies. But I’ve always thought the word “capability areas” undersells what they actually are. They’re dimensions. A dimensional space in which every principal — every human, every device, every service account, every agent — exists at a specific coordinate, and where the enterprise’s security posture is a function of its ability to continuously characterize that position across all four axes simultaneously. ...

In November 2016, I gave a presentation at CISA that proposed something simple: every enterprise, regardless of size or sector, needs to be able to answer four questions about every principal operating on its networks. Not at onboarding. Not at audit time. Continuously. Those four questions became the foundation of the CDM program’s Identity and Access Management capability — a framework used across U.S. federal agencies to govern who has access to what, under what conditions, and whether they’re behaving accordingly. We called the four dimensions TRUST, CRED, PRIV, and BEHAVE and they were central to the CDM Program Phase 2. ...