Zero trust
Zero trust does not derive trust solely from network location. Resource access needs appropriate identity and permission checks.
Zero trust is a security approach in which an internal network location or possession of a company device alone does not justify access. The protected resource and the rules governing access are central.
An office example
In a hypothetical business, someone is on the company network. They may still open only the customer documents they are authorised to access. Identity and permission need checking; device properties can also matter, depending on the rule.
Zero trust is neither a single product nor a guarantee against attacks. Nor does the term mean refusing all use without distinction. It requires clear, auditable rules and their technical enforcement for the relevant resources.
Sources
Related terms
- Identity and access managementIAM combines management of digital identities with their access rights. Accounts, role changes and removal of old permissions belong together.
- Multi-factor authenticationMFA uses different types of authentication factors. Asking for the same factor type several times does not create a multi-factor check.
- Least privilegeLeast privilege limits permissions to the required task and data scope. Necessary work remains possible while unnecessary powers are removed.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Envelope encryptionEnvelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.