Architecting for zero trust security
With a good understanding of the concept of zero trust, we can define architectures that apply the principles of zero trust. The following guidelines will help define the architecture. Some of these principles might be obvious, and others may lead to constraints in the way developers develop and deploy applications. But, at the end of the day, we need to be sure that the enterprise assets are secured:
- Assess and analyze all access controls. Strict policies on IAM must be in place. Least privilege must be part of those policies. This is the backbone of zero trust according to the National Institute of Standards and Technology (NIST). They defined a set of principles for zero trust architectures, all involving the way enterprises handle IAM. The key principle is to have a single source of identities. In most cases, enterprises will use Active Directory (AD) for this. In short, any user or identity must be known by the AD.
- Next, there must...
