Abstract:

With the rapid deployment of new technologies like cloud computing, big data and mobile communication, as well as the IT systems’ growing internalsecurity threat such as data breach and advanced persistent threats, Zero Trust concept has been put forward and drawn considerable attention recently. Domestic and foreign cybersecurity companies implemented several new security projects based on the Zero Trustconcept. However, several obstacles occurred during the research and implementation of Zero Trust. For example, it is difficult to involve the existing applications systems and security devices into the Zero Trust architecture without efforts of modification, which is of high cost. Meanwhile, based on the literal understanding of Zero Trust, Zero Trust equals to no trust in the network security architecture. Moreover, traditional security concepts are deemed to be replaced by Zero Trust. These defects and misunderstandings impeded the implementations and promotion of Zero Trust. In this paper, a Lean Trust secure access architecture is proposed based on the Lean Trust concept. Comparing with Zero Trust, Lean Trust architecture clearly identifies the role of risk and trust in network security architecture. Based on the continuous evaluation and precise manipulation of risk and trust, the Lean Trust secure access architecture promotes the security of the access process to the application and service resources. Moreover, the compatibility with existing security devices and application systems makes the proposed architecture more practical.

Key words: lean trust, risk management, trust evaluation, network security