Questão 96617

The paradigm of network security has undergone a significant transformation over the past decade. Traditionally, security was based on the 'castle-and-moat' concept, where a strong perimeter defense was deemed sufficient to protect internal resources. This model, however, presupposes that everything inside the network is trusted. The rise of sophisticated cyber threats, insider attacks, and the dissolution of the traditional network perimeter due to cloud adoption and remote work has rendered this approach obsolete. In response, the Zero Trust security model has emerged, operating on the principle of 'never trust, always verify.' It requires strict identity verification for every person and device trying to access resources on a private network, regardless of whether they are sitting within or outside of the network perimeter. This model is not a single technology but a holistic approach to network security that embeds security throughout the network, rather than just at the perimeter.

Considering the principles of the Zero Trust security model as described, analyze the following statements:

I. A key implementation of Zero Trust is the principle of least privilege, where users are given only the access they absolutely need to perform their jobs. This minimizes each user's potential impact in the event of a compromised account.

II. In a Zero Trust architecture, once a user has been authenticated and granted access to the network, they are considered trusted and can access all internal resources without further verification, streamlining workflow.

III. Microsegmentation is a foundational element of Zero Trust. It involves breaking up the network into small, isolated zones to limit the lateral movement of an attacker who has breached the perimeter.

Which of the statements are correct?