---
title: "理事會帖子: 為什麼我們需要對應用程序應用零信任"
description: "Networks are not the only IT elements vulnerable to attacks and compromises."
type: "news"
locale: "zh-HK"
url: "https://longbridge.com/zh-HK/news/33674593.md"
published_at: "2021-04-19T12:15:41.000Z"
---

# 理事會帖子: 為什麼我們需要對應用程序應用零信任

> Networks are not the only IT elements vulnerable to attacks and compromises.

*Sameer Malhotra is co-founder and CEO of* TrueFort*, a former Wall Street tech exec and an expert in IT infrastructure and cyber security.*

![Digital security concept](https://imageproxy.pbkrs.com/https://specials-images.forbesimg.com/imageserve/5f7cdc22235350fb9f68821a/960x0.jpg/query-Zml0PXNjYWxl?x-oss-process=image/auto-orient,1/interlace,1/resize,w_1440,h_1440/quality,q_95/format,jpg)

While the term "zero trust" is often used in cybersecurity circles, the phrase has different meanings to different IT professionals. For some, it is an end-state. For others, it is a set of guiding principles or a framework to apply when augmenting security.

Zero trust evolved from the concept of applying specific best practices to network access. These best practices included assigning the least amount of rights to users that would allow them to do their jobs or validating user accounts and applying policies based upon specific criteria. Ultimately, those practices for securing the network layer became somewhat synonymous with the term "zero trust." 

However, networks are not the only IT elements vulnerable to attacks and compromises. Many other IT stack components are quickly becoming attack vectors just waiting for a zero-day exploit to compromise them. That raises the question: Can zero trust be implemented in other parts of the enterprise security estate? The answer is a resounding yes—yet perhaps not in exactly the same way.

For example, take enterprise applications, which are a top attack vector for unauthorized access by data-seeking hackers. Applications are normally accessed after a user is authenticated to the network. Yet network user authentication alone does not offer full protection against today's range of threats. Enterprise applications are susceptible to numerous other attacks such as SQL or code injection, lateral movement, API weaknesses and many more. Simply put, just because you are using a zero-trust solution for network access does not mean enterprise applications are properly protected.

However, extending zero trust to application environments proves to be somewhat more complex than applying it to the network. Applications and their workloads are more numerous, dynamic and complex than networks. They perform many different functions and have dependencies on data sources and potentially other applications. In other words, applications are not always static and can take on numerous different roles depending upon the use case. 

Protecting applications means rethinking how they are accessed and how they communicate with each other, share data and authenticate users. In fact, applying zero trust to application environments often requires thinking a little differently. Instead of looking at applications strictly from a code vulnerability perspective, cybersecurity pros need to understand the acceptable behavior of the applications and, ideally, assign a behavior-based security identity to them that determines their entitlements.

Accordingly, establishing application-centric zero trust means first analyzing each application's behavior to verify it is only performing appropriate functions and only interacting with the needed binaries and data sources. This analysis can be used to build a library of behavioral parameters for each application and, subsequently, establish a security identity for it.

In this context, applications have their own trust footprint, and permissions can be limited to only what is necessary for the app to function (zero trust). Any type of attack, such as code injection, will fall out of the normal range of behavior and trigger an alert or shut down the application session to block any unauthorized activity or access to restricted resources.

To get started with application-centric zero trust, you'll need to:

• Discover and catalog all of your applications.

• Monitor their behavior over time to create a baseline of expected and authorized activity.

• Eliminate any security risks identified as part of the behavior profiling process (i.e., unnecessary permissions, excessive entitlements, risky dependencies, etc.).

• Create security policies that enforce a zero-trust stance on application activity so only authorized behavior is allowed.

• Push out alerts to control points when a policy is violated so corrective action can be triggered to remediate threats.

Ultimately, cybersecurity professionals want to protect not only the network but also data, identities and applications to reduce the attack surface. By applying the concepts of zero trust to applications, cybersecurity teams can achieve the goal of more fully protecting the enterprise from risks, preventing brand damage and avoiding business interruption. 

* * *

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?

* * *

## Related News & Research

| Title | Description | URL |
|-------|-------------|-----|
| 彭博新聞報道，康菲石油正在考慮出售其價值 20 億美元的二疊紀資產 | 2 月 20 日（路透社）- 據彭博新聞週五報道，康菲石油正在探索出售其部分二疊紀盆地資產，這是其更廣泛的投資組合精簡的一部分，消息人士透露。這些資產是通過與 Concho Resources 和 Shell（SHEL.L）的交易在多年中收 | [Link](https://longbridge.com/zh-HK/news/276478732.md) |
| 學習英偉達刺激芯片銷售，AMD 為 “AI 雲” 借款做擔保 | AMD 為擴大市場份額祭出金融 “狠招”！為初創公司 Crusoe 的 3 億美元購芯貸款提供擔保，承諾在其無客户時 “兜底” 租用芯片。這一復刻英偉達 “租卡雲” 路徑的策略雖能短期推高銷量，但也令 AMD 在 AI 需求放緩時面臨更大的 | [Link](https://longbridge.com/zh-HK/news/276401504.md) |
| 沃爾瑪四季度財報超預期但盈利指引不及預期，CEO 稱 “美國低收入家庭只能勉強維持生計” | 沃爾瑪 Q4 營收超預期，新財年盈利指引（每股 2.75-2.85 美元）遠低於市場預期的 2.96 美元，顯示通脹壓力下消費者支出不確定性猶存，拖累股價下跌 1.38%。財報印證 K 型” 分化：高收入家庭驅動增長，低收入羣體 “錢包吃緊 | [Link](https://longbridge.com/zh-HK/news/276398633.md) |
| 谷歌突然發佈 Gemini 3.1 Pro：核心推理性能直接翻倍 | 谷歌發佈了最新的大模型 Gemini 3.1 Pro，其推理性能較去年發佈的 Gemini 3 Pro 翻倍。在 ARC-AGI-2 評測中，Gemini 3.1 Pro 得分 77.1%，顯示出強大的推理能力。新模型支持多源數據綜合和複雜 | [Link](https://longbridge.com/zh-HK/news/276396515.md) |
| 最高法裁決後特朗普動用替補選擇：加徵 10% 全球關税 | 美國總統特朗普在最高法院裁決後宣佈將加徵 10% 的全球關税，以補救被推翻的關税措施。根據《1974 年貿易法》第 122 條款，現有的關税將全面生效。最高法院裁定特朗普政府的部分關税措施缺乏法律授權。市場風險提示，投資需謹慎。 | [Link](https://longbridge.com/zh-HK/news/276477629.md) |

---

> **免責聲明**：本文內容僅供參考，不構成任何投資建議。
