---
title: "理事会帖子: 为什么我们需要对应用程序应用零信任"
description: "Networks are not the only IT elements vulnerable to attacks and compromises."
type: "news"
locale: "zh-CN"
url: "https://longbridge.com/zh-CN/news/33674593.md"
published_at: "2021-04-19T12:15:41.000Z"
---

# 理事会帖子: 为什么我们需要对应用程序应用零信任

> Networks are not the only IT elements vulnerable to attacks and compromises.

*Sameer Malhotra is co-founder and CEO of* TrueFort*, a former Wall Street tech exec and an expert in IT infrastructure and cyber security.*

![Digital security concept](https://imageproxy.pbkrs.com/https://specials-images.forbesimg.com/imageserve/5f7cdc22235350fb9f68821a/960x0.jpg/query-Zml0PXNjYWxl?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg)

While the term "zero trust" is often used in cybersecurity circles, the phrase has different meanings to different IT professionals. For some, it is an end-state. For others, it is a set of guiding principles or a framework to apply when augmenting security.

Zero trust evolved from the concept of applying specific best practices to network access. These best practices included assigning the least amount of rights to users that would allow them to do their jobs or validating user accounts and applying policies based upon specific criteria. Ultimately, those practices for securing the network layer became somewhat synonymous with the term "zero trust." 

However, networks are not the only IT elements vulnerable to attacks and compromises. Many other IT stack components are quickly becoming attack vectors just waiting for a zero-day exploit to compromise them. That raises the question: Can zero trust be implemented in other parts of the enterprise security estate? The answer is a resounding yes—yet perhaps not in exactly the same way.

For example, take enterprise applications, which are a top attack vector for unauthorized access by data-seeking hackers. Applications are normally accessed after a user is authenticated to the network. Yet network user authentication alone does not offer full protection against today's range of threats. Enterprise applications are susceptible to numerous other attacks such as SQL or code injection, lateral movement, API weaknesses and many more. Simply put, just because you are using a zero-trust solution for network access does not mean enterprise applications are properly protected.

However, extending zero trust to application environments proves to be somewhat more complex than applying it to the network. Applications and their workloads are more numerous, dynamic and complex than networks. They perform many different functions and have dependencies on data sources and potentially other applications. In other words, applications are not always static and can take on numerous different roles depending upon the use case. 

Protecting applications means rethinking how they are accessed and how they communicate with each other, share data and authenticate users. In fact, applying zero trust to application environments often requires thinking a little differently. Instead of looking at applications strictly from a code vulnerability perspective, cybersecurity pros need to understand the acceptable behavior of the applications and, ideally, assign a behavior-based security identity to them that determines their entitlements.

Accordingly, establishing application-centric zero trust means first analyzing each application's behavior to verify it is only performing appropriate functions and only interacting with the needed binaries and data sources. This analysis can be used to build a library of behavioral parameters for each application and, subsequently, establish a security identity for it.

In this context, applications have their own trust footprint, and permissions can be limited to only what is necessary for the app to function (zero trust). Any type of attack, such as code injection, will fall out of the normal range of behavior and trigger an alert or shut down the application session to block any unauthorized activity or access to restricted resources.

To get started with application-centric zero trust, you'll need to:

• Discover and catalog all of your applications.

• Monitor their behavior over time to create a baseline of expected and authorized activity.

• Eliminate any security risks identified as part of the behavior profiling process (i.e., unnecessary permissions, excessive entitlements, risky dependencies, etc.).

• Create security policies that enforce a zero-trust stance on application activity so only authorized behavior is allowed.

• Push out alerts to control points when a policy is violated so corrective action can be triggered to remediate threats.

Ultimately, cybersecurity professionals want to protect not only the network but also data, identities and applications to reduce the attack surface. By applying the concepts of zero trust to applications, cybersecurity teams can achieve the goal of more fully protecting the enterprise from risks, preventing brand damage and avoiding business interruption. 

* * *

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

* * *

## Related News & Research

| Title | Description | URL |
|-------|-------------|-----|
| ConocoPhillips considers selling Permian assets worth $2 billion, Bloomberg News reports | Feb 20 (Reuters) - ConocoPhillipsis exploring a sale of some of its Permian Basin assets as part of a broader streamlini | [Link](https://longbridge.com/zh-CN/news/276478732.md) |
| IronBridge Private Wealth LLC Has $905,000 Holdings in Apple Inc. $AAPL | IronBridge Private Wealth LLC reduced its stake in Apple Inc. (NASDAQ:AAPL) by 77.3% in Q3, holding 3,555 shares valued  | [Link](https://longbridge.com/zh-CN/news/276436345.md) |
| Financial Advocates Investment Management Lowers Stock Position in Meta Platforms, Inc. $META | Financial Advocates Investment Management reduced its stake in Meta Platforms, Inc. by 66.7% in Q3, now holding 2,343 sh | [Link](https://longbridge.com/zh-CN/news/276432394.md) |
| Rocket Lab Corporation $RKLB Stock Holdings Increased by Vanguard Group Inc. | Vanguard Group Inc. increased its stake in Rocket Lab Corporation (NASDAQ:RKLB) by 5.4% in Q3, owning 41.8 million share | [Link](https://longbridge.com/zh-CN/news/276451972.md) |
| Denali Advisors LLC Lowers Stake in Alphabet Inc. $GOOG | Denali Advisors LLC reduced its stake in Alphabet Inc. (NASDAQ:GOOG) by 27.4% in Q3, now holding 76,983 shares valued at | [Link](https://longbridge.com/zh-CN/news/276432387.md) |

---

> **免责声明**：本文内容仅供参考，不构成任何投资建议。
