---
title: "Council Post: Why We Need To Apply Zero Trust To Applications"
description: "Networks are not the only IT elements vulnerable to attacks and compromises."
type: "news"
locale: "en"
url: "https://longbridge.com/en/news/33674593.md"
published_at: "2021-04-19T12:15:41.000Z"
---

# Council Post: Why We Need To Apply Zero Trust To Applications

> Networks are not the only IT elements vulnerable to attacks and compromises.

*Sameer Malhotra is co-founder and CEO of* TrueFort*, a former Wall Street tech exec and an expert in IT infrastructure and cyber security.*

![Digital security concept](https://imageproxy.pbkrs.com/https://specials-images.forbesimg.com/imageserve/5f7cdc22235350fb9f68821a/960x0.jpg/query-Zml0PXNjYWxl?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg)

While the term "zero trust" is often used in cybersecurity circles, the phrase has different meanings to different IT professionals. For some, it is an end-state. For others, it is a set of guiding principles or a framework to apply when augmenting security.

Zero trust evolved from the concept of applying specific best practices to network access. These best practices included assigning the least amount of rights to users that would allow them to do their jobs or validating user accounts and applying policies based upon specific criteria. Ultimately, those practices for securing the network layer became somewhat synonymous with the term "zero trust." 

However, networks are not the only IT elements vulnerable to attacks and compromises. Many other IT stack components are quickly becoming attack vectors just waiting for a zero-day exploit to compromise them. That raises the question: Can zero trust be implemented in other parts of the enterprise security estate? The answer is a resounding yes—yet perhaps not in exactly the same way.

For example, take enterprise applications, which are a top attack vector for unauthorized access by data-seeking hackers. Applications are normally accessed after a user is authenticated to the network. Yet network user authentication alone does not offer full protection against today's range of threats. Enterprise applications are susceptible to numerous other attacks such as SQL or code injection, lateral movement, API weaknesses and many more. Simply put, just because you are using a zero-trust solution for network access does not mean enterprise applications are properly protected.

However, extending zero trust to application environments proves to be somewhat more complex than applying it to the network. Applications and their workloads are more numerous, dynamic and complex than networks. They perform many different functions and have dependencies on data sources and potentially other applications. In other words, applications are not always static and can take on numerous different roles depending upon the use case. 

Protecting applications means rethinking how they are accessed and how they communicate with each other, share data and authenticate users. In fact, applying zero trust to application environments often requires thinking a little differently. Instead of looking at applications strictly from a code vulnerability perspective, cybersecurity pros need to understand the acceptable behavior of the applications and, ideally, assign a behavior-based security identity to them that determines their entitlements.

Accordingly, establishing application-centric zero trust means first analyzing each application's behavior to verify it is only performing appropriate functions and only interacting with the needed binaries and data sources. This analysis can be used to build a library of behavioral parameters for each application and, subsequently, establish a security identity for it.

In this context, applications have their own trust footprint, and permissions can be limited to only what is necessary for the app to function (zero trust). Any type of attack, such as code injection, will fall out of the normal range of behavior and trigger an alert or shut down the application session to block any unauthorized activity or access to restricted resources.

To get started with application-centric zero trust, you'll need to:

• Discover and catalog all of your applications.

• Monitor their behavior over time to create a baseline of expected and authorized activity.

• Eliminate any security risks identified as part of the behavior profiling process (i.e., unnecessary permissions, excessive entitlements, risky dependencies, etc.).

• Create security policies that enforce a zero-trust stance on application activity so only authorized behavior is allowed.

• Push out alerts to control points when a policy is violated so corrective action can be triggered to remediate threats.

Ultimately, cybersecurity professionals want to protect not only the network but also data, identities and applications to reduce the attack surface. By applying the concepts of zero trust to applications, cybersecurity teams can achieve the goal of more fully protecting the enterprise from risks, preventing brand damage and avoiding business interruption. 

* * *

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

* * *

## Related News & Research

| Title | Description | URL |
|-------|-------------|-----|
| 沃尔玛四季度财报超预期但盈利指引不及预期，CEO 称 “美国低收入家庭只能勉强维持生计” | 沃尔玛 Q4 营收超预期，新财年盈利指引（每股 2.75-2.85 美元）远低于市场预期的 2.96 美元，显示通胀压力下消费者支出不确定性犹存，拖累股价下跌 1.38%。财报印证 K 型” 分化：高收入家庭驱动增长，低收入群体 “钱包吃紧 | [Link](https://longbridge.com/en/news/276398633.md) |
| 谷歌突然发布 Gemini 3.1 Pro：核心推理性能直接翻倍 | 谷歌发布了最新的大模型 Gemini 3.1 Pro，其推理性能较去年发布的 Gemini 3 Pro 翻倍。在 ARC-AGI-2 评测中，Gemini 3.1 Pro 得分 77.1%，显示出强大的推理能力。新模型支持多源数据综合和复杂 | [Link](https://longbridge.com/en/news/276396515.md) |
| GRAIL｜8-K：2025 财年 Q4 营收 43.6 百万美元超过预期 |  | [Link](https://longbridge.com/en/news/276379877.md) |
| 最高法裁决后特朗普动用替补选择：加征 10% 全球关税 | 美国总统特朗普在最高法院裁决后宣布将加征 10% 的全球关税，以补救被推翻的关税措施。根据《1974 年贸易法》第 122 条款，现有的关税将全面生效。最高法院裁定特朗普政府的部分关税措施缺乏法律授权。市场风险提示，投资需谨慎。 | [Link](https://longbridge.com/en/news/276477629.md) |
| 学习英伟达刺激芯片销售，AMD 为 “AI 云” 借款做担保 | AMD 为扩大市场份额祭出金融 “狠招”！为初创公司 Crusoe 的 3 亿美元购芯贷款提供担保，承诺在其无客户时 “兜底” 租用芯片。这一复刻英伟达 “租卡云” 路径的策略虽能短期推高销量，但也令 AMD 在 AI 需求放缓时面临更大的 | [Link](https://longbridge.com/en/news/276401504.md) |

---

> **Disclaimer**: This article is for reference only and does not constitute any investment advice.
