Zero Trust

In recent years, standards related to Zero Trust Security have developed rapidly: in 2013, CSA issued SDP Standard Specification 1.0; In 2017, the CSA issued Enterprise Security Migration on the Cloud with the Help of SDP; In 2019, the Ministry of Industry and Information Technology drafted the Guidelines on Promoting the Development of the Cyber Security Industry (Exposure Draft), which took striving to break through cyber security technology; as one of its main tasks and mentioned ;Zero Trust Security; The China Academy of Information and Communication Technology issued a white paper on China's Cyber Security Industry, which pointed out that Zero Trust has moved from concept to implementation; In May 2019, the CSA issued the SDP Architecture Guidelines; In February 2020, The National Institute of Standards and Technology (NIST) issued the second edition of the white paper Draft Standards for Zero Trust Architecture in February 2020, which established standard definitions for the concepts of Zero Trust Security and logical architecture. In the future, industry standards, alliance standards and national standards related to Zero Trust Security will be further improved and developed, and the Zero Trust security industry will become more standardized.

Most enterprises still adopt the traditional cyber security architecture, that is, border-based protection, at the moment. Due to inherent limitations of the physical security boundary, enterprises cannot install the public cloud into their own firewalls if they want to migrate their services to the cloud. If enterprises want to develop mobile office, the firewall cannot cover every corner of the outside. If enterprises want to embrace big data, they must exchange data with their partners. Under the development trend of new technology, the conventional security border model rapidly disintegrates and has turned into a barrier to the growth of services. Enterprises need to build a new security architecture. The Zero Trust architecture breaks the traditional security boundaries. It no longer assumes that the intranet is secure and controllable. Instead, it continuously confirms the user's identity and the device's legality and permissions before dynamically granting them the minimum access rights.