As telework has become the norm and multi-cloud usage has expanded, the traditional perimeter defense of ``safety inside the company network’’ has completely lost its effectiveness. What has become essential in its place is a zero-trust architecture that advocates “Never Trust, Always Verify.” However, even if they understand the concept, there are many organizations that have trouble implementing it in the field. We will answer three core questions asked by those in the field of infrastructure renovation.
Q1. Why did the myth that “it’s safe if you have an in-house VPN” collapse?
Traditional VPNs have a structural flaw that allows them to move laterally throughout the company’s LAN once they have breached the gateway. If an attacker infiltrates as a legitimate user by exploiting a malware infection or leaked credentials, it is extremely difficult to detect in an environment where communications within the perimeter are unconditionally trusted. Zero Trust fundamentally prevents damage from spreading after an intrusion by determining the identity of the user, the health of the device, and the context of the connection source each time a request occurs and dynamically granting only the minimum necessary access rights to a single application.
Q2. How to use microsegmentation and ID-aware proxy?
These two technologies are not contradictory, but complementary. Identity-aware proxies (IAPs) primarily control the “entrance” from users to SaaS and web applications, providing secure access without a VPN. On the other hand, microsegmentation is a technology that fragments and blocks “east-west traffic (lateral communication)” between container environments and virtual machines. The standard in the field is a hybrid configuration in which microsegmentation is applied to protect internal workloads, such as communication between pods within a Kubernetes cluster and access to the DB, and IAP is used to connect remote workers to business applications.
Q3. What are the key points in creating an authentication policy that will not cause opposition from the workplace in the early stages of implementation?
If zero trust is made too strict, requiring multi-factor authentication (MFA) once an hour, it will significantly reduce user convenience and encourage the use of unofficial tools (shadow IT). The key to success is implementing “risk-based authentication.” If you are accessing from the same company-provided terminal during normal hours, please maintain the session and design a context evaluation that requires additional authentication only when requests are made from overseas IPs, late at night, or from unknown terminals. A gradual transition that balances security and operational efficiency will determine whether it will take root in your organization.