Today, least-privileged access and zero trust are essentially inseparable, with a modern approach incorporating user identity authentication, device security posture, and user-to-app segmentation in its controls. Let’s examine these three core elements.
User Identity Authentication
This is how you determine whether your users are who they claim to be. Identity and access management (IAM) providers and services (e.g., Okta, Azure Active Directory, Ping Identity) create, maintain, and manage identity information while offering various provisioning and authentication services.
Device Security Posture
A well-intentioned user with elevated privileges can still fall victim to malware. Paired with continuous assessment of endpoint security posture (provided by the likes of CrowdStrike, VMware Carbon Black, SentinelOne, etc.), modern least privilege policies can modify even a privileged user’s permissions based on their current device health.
User-to-App Segmentation
The traditional way to limit network exposure and lateral movement is network segmentation, using firewalls inside the enterprise network to restrict segments to privileged accounts. Although it’s key to limit internal lateral movement, this approach is complicated and doesn’t provide the granular control modern organizations need.
User-to-app segmentation is made possible with azero trust network access (ZTNA) service, which enables granular segmentation through IT-managed business policies, not a stack of firewalls. ZTNA connects verified users directly to the applications they’re authorized to use without ever connecting them to your network, making lateral movement impossible. This access policy is extended to both remote and on-premises users, regardless of their location, with identical security controls.