--- title: Data is the Prize - The Pillars of Zero Trust from Another Perspective description: Where exactly does data fit in to the pillars of zero trust architecture? image: https://insights.comforte.com/hubfs/blog%20header%20image%20pillars.jpeg --- [![Hubspot_blog_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![pillars of zero trust](https://insights.comforte.com/hubfs/blog%20header%20image%20pillars.jpeg)](https://insights.comforte.com/data-is-the-prize-the-pillars-of-zero-trust-from-another-perspective) [Trevor J. Morgan](https://insights.comforte.com/author/trevor-j-morgan) l Oct 5, 2021 l [Data Protection](https://insights.comforte.com/tag/data-protection), [Zero Trust](https://insights.comforte.com/tag/zero-trust) # Data is the Prize - The Pillars of Zero Trust from Another Perspective In fascinating 2018 [testimony](https://www.rand.org/pubs/testimonies/CT490.html) before a US congressional subcommittee on terrorism and illicit finance, Lillian Ablon provides insights into what threat actors are really after when they carry out cyber-attacks against their enterprise and agency targets. Obviously, different threat actors and groups have different motivations, and the testimony lays all of that out very clearly. What is apparent in the testimony, though, is the fact that an organization’s data is by far the main prize. Whether they gain entry into a data environment through security holes or plain human error (like misconfigurations), or anything in between, threat actors want sensitive information so that they can leverage it, weaponize it, and ultimately monetize it for their own gain. Hopefully most people won’t be shocked by this statement: threat actors aren’t after network resources or application resources for any reason other than to intercept, collect, and exfiltrate information traversing them so that they can use stolen data for their own nefarious purposes. They want your company’s information, not your IT resources or assets! *This blog post is the second in a series focused on the increasingly popular Zero Trust cybersecurity framework and data-centric security.* If you recall from the [first post in this series](https://insights.comforte.com/zero-trust-series-part-1-why-data-protection-is-the-keystone-for-zt?hsLang=en), I summarized some of the principles of Zero Trust, which is a framework for preventing any bad actors from gaining access to an IT environment and doing what Lillian Ablon discusses in that testimony. Some of those ZT precepts include reducing reliance on perimeter-based network protection, granting no trust to any user, device, or application solely based on location within the network, and constantly challenging requests for data or services instead of simplistic “one-and-done” authentication methods. Look at the ways in which most vendors and even governmental agencies describe the principles of Zero Trust, and usually you will see a diagrammatic representation of the different focus areas in implementing ZT emphasizing different “pillars” of the infrastructure, such as the network, the device pool, and the user base. As a matter of fact, the US Department of Defense builds its [entire reference architecture](https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf) around these pillars and uses them to describe the different tools, methods, and best practices within each one that, if implemented correctly, can bring an organization closer to an effective Zero Trust model. These pillars must be the best way to represent a ZT framework, because who’s going to argue with the US DoD? OK, so while I wouldn’t dare argue with the clarity and utility of the reference architecture the DoD establishes, I might quibble about one important matter: data as a pillar. My argument may be a semantic one (or both), but in my opinion data is not a pillar. Bear with me here while I discuss architecture a bit (not IT architecture but, you know, buildings and structural architecture). I’ll even seed your imagination first by asking you to think of something like the Greek Parthenon. Go ahead, close your eyes and think about it (or just scroll back up to the header image if memory fails you). What’s there? Pillars. Lots of them. Big, heavy, stone pillars intended for a single purpose (okay, two if you include aesthetic quality): structurally supporting what’s above it. Now, I’m not going to get into classical architectural design with references to entablatures and triangular pediments, because that’s a conversation for people who actually know a lot about those things (which admittedly I don’t other than what my own favorite search engine can provide me), but without the pillars, those fantastic, ornate stone pediments, well, they don’t stay up for very long. In an incredible example of “things just don’t seem to change through the years,” my own porch has columns, with a triangular pediment and roof structure all intended to keep me dry as I sit on my rocking chair as it’s raining. The columns (pillars) are there to support that roof, which is arguably the more important part of any column’s or pillar’s raison d’etre (pardon my French). Get to the point, Morgan (something I’ve heard quite a bit in my life). My ultimate point is, data isn’t a supporting part of the IT infrastructure the way networks and devices and applications are. Data is the point, and those resources support data, from its creation through its evolution and storage all the way through to its final destruction. Now we’re back to the testimony given before Congress—those bad folks are after your data, trying to exploit those supporting pillars to get to it. Data is on top, king of the hill, the crowning glory of your IT infrastructure and your entire organization. We call it *information* technology for a reason. Which raises an important question. If we buy my argument that data is not a pillar but is instead the focus of it all, is it more important to guard and protect the supporting infrastructure, or the data itself? I have some thoughts on that, so [come back for #3](https://insights.comforte.com/applying-data-centric-security-early-in-your-zero-trust-initiative?hsLang=en) as I argue for the predominance of data-focused security, what we call data-centric security, within the Zero Trust paradigm. --- | Share this:  | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/data-is-the-prize-the-pillars-of-zero-trust-from-another-perspective&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/data-is-the-prize-the-pillars-of-zero-trust-from-another-perspective&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/data-is-the-prize-the-pillars-of-zero-trust-from-another-perspective&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/data-is-the-prize-the-pillars-of-zero-trust-from-another-perspective&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/data-is-the-prize-the-pillars-of-zero-trust-from-another-perspective&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## Spoiler alert! Data-centric security protects the data itself so that even in the event of a breach, no exploitable data is exposed. There are many cases where processes can be carried out on data while it's still in a protected state, allowing digital organizations to continue humming along while keeping sensitive data safe. To learn more, check out our data protection platform solution brief: [![Download Solution Brief](https://no-cache.hubspot.com/cta/default/4026697/7962e9ff-2c50-4207-910f-fc5fd97083e7.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/7962e9ff-2c50-4207-910f-fc5fd97083e7) ### Related posts ![Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/hubfs/comforte%20AG_%20Reuse%20Reward_%20How%20Banks%20Can%20Safely%20Unlock%20the%20Value%20of%20Their%20Data_03.2025.png) Mar 12, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Payments Transformation](https://insights.comforte.com/tag/payments-transformation) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) The financial world is awash with data. But too few organizations are able to use it effectively. In [Bank Director’s *2025 Technology Survey*](https://www.bankdirector.com/wp-content/uploads/2025/09/2025TechReport-OpenVersion.pdf), one-third of US banking leaders cite an inability to harness data as a top technology challenge facing their... [Read more](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) ![Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/hubfs/comforte%20AG_Delivering%20a%20Secure%2c%20Trusted%20Foundation%20for%20Cloud%20Growth%20at%20LGT_01.2026.png) Jan 15, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) There’s a world of difference between retail and private banking. While the former is transactional and focused on the mass market, the latter is built on trust and personal relationships. That trust can be hard won, but is easily lost, especially... [Read more](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) ![Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/hubfs/comforte%20AG_Top%20Indicators%20You%20Have%20a%20Cybersecurity%20Problem_and%20What%20to%20Do%20About%20It.png) May 22, 2025 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Digital Enablement](https://insights.comforte.com/tag/digital-enablement) ### [Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) Data is both blessing and curse to the modern enterprise. Yes, when analyzed effectively it can surface intelligence to improve decision making, customer engagement, process efficiency and, ultimately, drive revenue. But it also represents a major... [Read more](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### Germany comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Australia comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### USA comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Singapore comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026