MODERN PERSPECTIVES OF APPLYING THE CONCEPT OF ZERO TRUST IN BUILDING A CORPORATE INFORMATION SECURITY POLICY

Abstract

Modern businesses have undergone significant changes as a result of digital advances and the recent COVID-19 pandemic. In particular, there has been an increase in the number of employees working remotely, using personal digital devices alongside corporate devices, and the enterprise itself moving business processes to the cloud or using hybrid environments that combine both cloud and on-premises services. Taken together, this leads to increased interaction between devices and services over open networks, creating new risks of cyber-attack. It is this situation that has led to the relevance and direction of this research. The paper analyzes the current state of effectiveness of the application of enterprise information security policy, in particular, identifies the main limitations associated with the difficulty, and sometimes impossibility, to control the behavioral aspects of enterprise employees to comply with the basic provisions of security policy and general information security. The basic principles of the Zero Trust conceptual approach are analyzed and the main advantages of its application in the formation of the security policy as a strategic approach to ensuring the information security of the enterprise in the conditions of dynamic growth of new threats and transformation of modern business are determined. At the same time, it is established that one of the key components of the Zero Trust architecture is the access control system. As a result, forming the prospects of applying the concept of Zero Trust in the construction and implementation of the information security policy, the necessity of conducting an accompanying study of the effectiveness of modern mechanisms of identification/authentication of access subjects was determined.