Which security concept requires continuous identity and authorization checks to allow access to data?

The Zero Trust security model is founded on the principle of "never trust, always verify." It eliminates the outdated concept of a trusted internal network and an untrusted external network. Instead, it requires that all users, whether inside or outside the organization’s network, be continuously authenticated, authorized, and validated before being granted or keeping access to applications and data. This involves strict identity verification and authorization checks for every single access request, ensuring that trust is never implicit and access is granted on a least-privilege, need-to-know basis.

A. Traffic inspection: This process analyzes network data packets for malicious content or policy violations, not the continuous verification of user identity for data access.

C. Intrusion prevention: This is a threat prevention technology that examines network traffic to detect and block vulnerability exploits, rather than a model for continuous identity validation.

D. Secret management: This refers to the tools and practices for managing credentials like API keys and passwords, which is a component of security but not the overarching concept itself.

1. National Institute of Standards and Technology (NIST). (2020). Zero Trust Architecture (NIST Special Publication 800-207).

Section 2.1

Tenet 2: "Access to resources is determined by dynamic policy—including the observable state of client identity

application/service

and the requesting asset—and may include other behavioral and environmental attributes." This highlights the continuous

dynamic nature of authorization checks.

2. Microsoft. (2023). What is Zero Trust?

Guiding Principles Section: "Verify explicitly. Always authenticate and authorize based on all available data points

including user identity

location

device health

service or workload

data classification

and anomalies." This directly supports the concept of continuous checks.

3. Google Cloud. (n.d.). BeyondCorp Overview.

Introduction: "BeyondCorp is Google's implementation of the zero trust model. It builds upon a decade of experience at Google

combined with ideas and best practices from the community. By shifting access controls from the network perimeter to individual users

BeyondCorp enables secure work from any location without the need for a traditional VPN." This illustrates the shift to user-centric

continuous verification.

4. Rose

S.

Borchert

O.

Mitchell

S.

& Connelly

S. (2020). Zero Trust Architecture. (NIST Special Publication 800-207). National Institute of Standards and Technology.

DOI: https://doi.org/10.6028/NIST.SP.800-207

Page 6

Section 2.1

Tenet 1: "All data sources and computing services are considered resources. A network connection must not be the sole determining factor for trust in a network." This establishes the foundation that requires every resource access to be checked independently.