A zero trust network architecture for IT contractor access
The Zero Trust security concept asserts that organizations should not automatically trust devices or users, whether inside or outside its perimeters, and should verify all connections to its systems before granting access.
The Zero Trust model is a response to the inadequacies of the castle-and-moat mentality, where perimeters are both difficult to define and defend.
It calls for enterprises to leverage micro-segmentation, access control, and granular perimeter enforcement based on a combination of user and device authentication, locations and other data to determine whether to trust an attempted access to enterprise resources.
Becrypt have worked with organisations applying the Zero Trust model to IT contractor access. Such projects are often easier to approach as a ‘greenfield’ undertaking than legacy internal systems, necessarily span the organisational perimeter, and require a definition of trust beyond simple user authentication.
Becrypt’s Paradox Link platform includes both user and device identity management, and ensures device integrity through a standards-based remote attestation protocol. Web-based and online services access control can be automated through the integration of SAML based federated device identity with enforceable service to device encryption.
See for Paradox on a Stick for a proven approach to establishing trust on un-managed (3rd party) devices.