Cloud 101CircleEventsBlog
Register for CSA’s free Virtual Cloud Trust Summit to tackle enterprise challenges in cloud assurance.

Download Publication

Zero Trust Principles and Guidance for Identity and Access Management (IAM)
Zero Trust Principles and Guidance for Identity and Access Management (IAM)
Who it's for:
  • Technology Providers
  • Technical Directors
  • CISOs, CTOs, CIOs

Zero Trust Principles and Guidance for Identity and Access Management (IAM)

Identity and the ability to consume information about that identity as well as other Zero Trust (ZT) signals (additional attributes about an identity), is one of the key principles of zero trust architecture. A ZT approach aims to reduce the success of cyber-attacks and data breaches through risk-based access requirements, that is, by requiring authentication and authorization prior to granting access to resources (data and/or systems).

In order to meet this requirement, it is important to look at both existing and new identity, access management, and cloud solutions with a ZT lens.

ZT is a technology-agnostic guidance framework to bring controls closer to the asset being protected (the protect surface). From an identity and access management perspective, this has the potential to significantly increase the richness of the risk-based decision about granting access and eliminate the granting of access based on the binary trust of a single access control method.
Download this Resource

Bookmark
Share
Related resources
The Six Pillars of DevSecOps: Measure, Monitor, Report, and Action
The Six Pillars of DevSecOps: Measure, Monitor,...
Cloud Controls Matrix and CAIQ v4
Cloud Controls Matrix and CAIQ v4
Confronting Shadow Access Risks: Considerations for Zero Trust and Artificial Intelligence Deployments
Confronting Shadow Access Risks: Considerations...
Five Considerations to Keep Your Cloud Secure
Five Considerations to Keep Your Cloud Secure
Published: 05/22/2024
Exploring Syscall Evasion – Linux Shell Built-ins
Exploring Syscall Evasion – Linux Shell Built-ins
Published: 05/20/2024
The Risk and Impact of Unauthorized Access to Enterprise Environments
The Risk and Impact of Unauthorized Access to Enterprise Environments
Published: 05/17/2024
Securing Generative AI with Non-Human Identity Management and Governance
Securing Generative AI with Non-Human Identity Management and Gover...
Published: 05/16/2024

Acknowledgements

Shruti Kulkarni
Shruti Kulkarni
Cyber Security Architect at 6point6 & PhD Student

Shruti Kulkarni

Cyber Security Architect at 6point6 & PhD Student

I am a security professional with experience across various domains of security. I work in defining organisation’s security strategy, security architecture and security practices. Translating business objectives and risk management strategies into specific security processes enabled by security technologies and services. I work on gap analysis, design, implementation and...

Read more

Alon Nachmany
Alon Nachmany

Alon Nachmany

Alon Nachmany is a highly accomplished cybersecurity professional with over 20 years of experience in the industry. He is recognized as a thought leader in the field and has been named one of the top 40 under 40 in cybersecurity by Top Cyber News Magazine. Additionally, Alon serves as a Board Member for multiple organizations.

Throughout his career, Alon has led teams and delivered global safeguards to Fortune 100 partners across a wi...

Read more

Jonathan Flack Headshot Missing
Jonathan Flack
Principal Architect, Cloud & Security Architecture. Under contract to the Department of the Air Force

Jonathan Flack

Principal Architect, Cloud & Security Architecture. Under contract to the Department of the Air Force

Jonathan Flack is a 30 year veteran engineer with extensive expertise in large scale distributed systems and security, serving in Principal or Executive roles. In addition to retaining hands on keyboard with his team, notable areas of focus include NIST 800-63, NIST 800-218 and NIST 800-207 (Zero Trust), software supply chain, and various governance compliance regimes. Recent work includes direct collaboration with the US Department of Defe...

Read more

Erik Johnson
Erik Johnson
Cloud Security Specialist & Senior Research Analyst, CSA

Erik Johnson

Cloud Security Specialist & Senior Research Analyst, CSA

Worked for the Federal Reserve for many years and volunteered with the CSA with a focus on CCM/CAIQ V4, specifically the STA domain, and developing a comprehensive framework and guidance for defining and managing the cloud shared security responsibility model (SSRM).

I recently retired from the Federal Reserve and am now consulting with the CSA as a Senior Research Analyst with a focus on Zero Trust and Financial Services.

Linke...

Read more

Paul Simmonds
Paul Simmonds
CEO at Global Identity Foundation & Board Member of CSA UK Chapter

Paul Simmonds

CEO at Global Identity Foundation & Board Member of CSA UK Chapter

Paul is the CEO of the Global Identity Foundation and formerly the global CISO of AstraZeneca, ICI and prior to that Motorola Cellular Infrastructure. He is twice listed as one of Network World’s “most powerful people in networking”. He is a director of the Cloud Security Alliance (Europe), co-founded the Jericho Forum, and sits on the advisory boards of a number of global tech companies.

Read more

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?

Related Certificates & Training