Kipling Method Zero Trust: Who, What, When, Where, Why and How

The Kipling Method is a way of examining a problem by asking six questions: who, what, when, where, why and how, taken from Rudyard Kipling's poem about his "six honest serving-men". In zero trust security, the same six questions are used to write access policy: each allow rule has to state who may connect, to what resource, when, from where, why the access is needed and how the connection is made and checked. Anything a rule does not answer is denied. John Kindervag, who created the zero trust model, applied the Kipling Method to policy writing, and Palo Alto Networks describes it as the way to build a zero trust policy. A worked example is in the table below.

If you met the Kipling Method in zero trust material, a course or an exam, the example policy and the sections after it show how the six questions turn into rules you can enforce.

Understanding the Kipling Method for Problem Solving

Kipling's poem, from the "Just So Stories" (1902), begins "I keep six honest serving-men (They taught me all I knew); Their names are What and Why and When And How and Where and Who." The six questions, often written as 5W1H, became a standard way to define a problem before trying to solve it: journalists use them to make sure a story is complete, and teams use them in root cause analysis and planning.

Applied to a security problem, such as an incident, the questions make sure nothing is assumed:

• Who was involved, and whose account or device was used?
• What system or data was affected?
• When did it start, and how long did it run?
• Where in the network or which location did it come from?
• Why did the existing controls not stop it?
• How did it happen, and how can it be prevented next time?

Integrating Zero Trust Principles with the Kipling Method

Zero trust starts from the rule that no user or device is trusted because of where it sits on the network: every request for a resource is checked against policy, and the default is deny. That raises a practical question: how do you write the rules? The Kipling Method answers it. Each allow rule must answer all six questions, which turns a vague intention ("finance needs payroll") into a rule a firewall, gateway or identity provider can enforce.

Read as one rule: finance payroll staff may open the payroll application during working hours from a managed, compliant laptop, signed in through single sign-on with MFA via the gateway, because they process payroll. Everything else, including the same person on a personal laptop at midnight, is denied. For the components that enforce a rule like this, see the policy enforcement point and zero trust architecture.

Implementing the Kipling Method for Zero Trust in IT Environments

Kindervag's approach builds zero trust around what you are protecting, one resource at a time. In practice:

• Pick a protect surface: the data, application, asset or service that matters most, such as payroll, customer records or the domain controllers.
• Map how it is used: which users, devices and other systems talk to it, and how.
• Put an enforcement point in front of it: a gateway, next-generation firewall or identity-aware proxy that sees every request.
• Write the policy with the six questions, one rule per legitimate need, with everything else denied.
• Monitor and adjust: log every allowed and denied request, review the denials and tighten rules that are broader than the need.

The same questions help after an incident: who connected, to what, when, from where, why it was allowed and how. If a rule cannot answer "why", it usually grants more than anyone needs; see the least privilege access model and network segmentation.

Extended Questions of the Kipling Method

The six questions are the start. When a problem needs deeper analysis, problem-solving guides extend them. Here they are applied to a data breach that exposed customer information:

• Who else? Who else is affected (customers, employees, partners, regulators), and who else had access to the data?
• Where else? Where did the breach start, and where else could the same weakness exist?
• When else? When was it found, when did it really start, and has it happened before?
• How much? How much data and how many people were affected, and what will it cost?
• How often? How often are access reviews, audits and training actually done?
• Why not? Why were stronger controls, such as MFA, encryption or segmentation, not in place?
• What if? What if it had been detected a week earlier, or the data had been encrypted?
• What for? What is the protection for: which data and which obligations matter most?

The answers become the incident report and the list of fixes, and many of the fixes turn into new or tighter zero trust rules.

Overcoming Creative Blocks in Security Problem Solving

When a team is stuck on a recurring problem, going back to the six questions resets the discussion. If breaches keep happening, ask: are too many people or devices trusted (who)? Is the weak point remote access (where, how)? Are permissions granted for longer than needed (when)? Each answer points to a specific control to change.

Conclusion

The Kipling Method gives zero trust a simple discipline: every allow rule answers who, what, when, where, why and how, and anything a rule does not answer is denied. Start with the resource that matters most, write one rule per real need, enforce it at a gateway or proxy in front of the resource, and use the same six questions to review incidents and tighten rules over time. For the wider strategy around it, see defense in depth and unauthorized access to computer systems.

Related reading: zero trust architecture, policy enforcement point, least privilege access model and defense in depth.