2024-11-24-Capgemini-零信任_从渴望到快速实施（英）_7页_2mb

Zero Trust: From Aspiration to Rapid Implementation

Zero Trust is a cybersecurity philosophy that assumes no user or device can be trusted by default, requiring dynamic, context-based verification for every access request. It was mandated by the US government in 2021, aiming for federal agencies to adopt its principles by 2024, driven by factors like increased cloud adoption, remote work, and rising cyber threats.

Key tenets include adaptive trust evaluation, micro-segmentation for limiting damage, and the core principle of least privilege access, where permission is granted only for necessary resources. This approach addresses challenges posed by traditional perimeter-based models, which are increasingly obsolete due to deperimeterization.

The implementation framework, as outlined by CISA, consists of five pillars (Identity, Devices, Networks, Applications, Workloads, and Data) with foundational layers of Visibility and Analytics, Automation and Orchestration, and Governance. It relies on a policy engine that uses various data sources to make access decisions, often aided by AI and automation.

Benefits include reduced costs through consolidated technology, lower insurance premiums, improved user experience in hybrid environments, and fewer security incidents by minimizing the attack surface. However, challenges include dispersed responsibility, change management needs, and compatibility issues during adoption.

Real-world applications demonstrate its value in simplifying mergers and acquisitions by unifying security tools, and protecting legacy systems through ring-fencing. Successful case studies, such as Capgemini's end-to-end transformation programs, highlight CAPEX/OPEX optimization and enhanced security for global organizations.

Overall, Zero Trust represents a shift in governance and operations, making it essential for modern cyber resilience amid evolving threats.