Dazzpers

Zero Trust is based on the idea that, by default, organizations should never trust any internal or external entity that enters their perimeter. You only deliver apps and data to authenticated and authorized users. This new approach is born of never trust and always verify.

castle-and-moat_security_model

Mario Moreno

IAM Engineer

July 4th, 2021

What you expect with Zero Trust Security is that the right people have the right level of access, resources and context at the right time. This access is constantly evaluated without generating issues for the user. In simpler terms, it seeks to provide a security environment for companies. This generates that each user within the corporate scheme has access to certain spaces according to their role.

Previously, companies used firewalls or other technologies to create a secure environment within the perimeter. However, if an intruder managed to gain access to the established perimeter, they could gain access to important resources. But now, why do Okta wants to improve this model? Currently, many employees work from their mobile devices, such as smartphones or laptops. They work through the cloud, so the network is not under the total control of the company. This is where the need to use identity as a system of trust between users, devices and networks arises.

What does Zero Trust propose?

With the new Zero Trust model, the following proposition is used: “Trust no one, verify everyone” . By these means, when the user wants to access the system, a verification process of the user’s location, the device with which he is accessing, password or other types of authorization factors to enter is carried out. This allows the right people to access the right resources.

This model has not emerged overnight and as simple as it may sound, a whole maturity curve was carried out in the development of this model. It started with Fragmented Identity, better known as stage 0, which was not entirely secure follows a traditional model with Active Directory On-Prem, no cloud integration and countless passwords. Then, in stage 1 with unified IAM there was single sign-on, multifactor implementation and policies between applications and servers. Subsequently, stage 2 is reached with Contextual Access, which has a multifactor between group users, automated deprovisioning for graduates and secure access to APIs. Finally, in stage 3 you have Adaptive Workforce, where policies are risk-based, authentication is continuous and adaptive, and you have frictionless access.

Okta is highly committed to delivering a Zero Trust based security ecosystem to provide quality security solutions. It invests in and maintains deep integrations of the Zero Trust ecosystem and uses Identity Cloud as the core of the next generation strategy like controlled access strategy. With Modern Access Management, we have the right people with the right level of access accessing the right resources in the right context that are continually evaluated.

If you want to know more about Zero Trust, you can visit the following pages:

https://www.okta.com/resources/whitepaper/zero-trust-with-okta-modern-approach-to-secure-access/

https://www.okta.com/blog/2021/06/how-to-reach-zero-trust-maturity/

[1] Getting Started with Zero Trust: Never trust, always verify, Okta Inc., November 2020

[2] How to Reach Zero Trust Maturity, Teju Shyamsundar, 8 June 2018

en_USEN