The concept of a zero trust (ZT) architecture has been prevalent since the early 2000s. It has been born out of an industry requirement to define a solution for the fast disappearing security perimeter. With the advent of cloud computing and IOT, the risk of cyber security attacks due to compromised identities, accounts and credentials has increased exponentially. These attacks ultimately lead to a security breach, which often has significant reputational damage and negative financial impact to the organisation.
A traditional “network trust” model assumes that all users logged onto an internal network can be trusted, while a “zero trust” approach builds on the concept of “never trust, always verify”. This is achieved by enforcing risk-based authentication and authorisation policies for all users, regardless of the user identity being within an organisation's network or from the outside. Many organisations have already realised this and are moving away from the “network trust” (or perimeter-based security model) to a “zero trust” model.
Most IT security vendors are using zero trust to position their technologies, while cyber security specialists are realising that traditional network security is not adequate for the modern-day architecture and are exploring a zero trust architecture. This evolution has propelled identity solutions to the fore and the zero trust architecture has gravitated towards an “Identity Centric Zero Trust” model.
Identity is at the centre
Cyber criminals gain access to enterprise networks and sensitive data by targeting the weakest links that are compromising or stealing credentials that belong to an identity. An identity is defined as an employee, customer or partner who interacts with an organisation’s Web and/or mobile applications. A comprehensive security strategy recognises that identity is at the centre of any zero trust model. If a stolen identity has privileged access to ap ..
Support the originator by clicking the read the rest link below.
