Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Zenith Insurance allows staff to work remotely. The risk committee proposes that access to claims data be granted only after checking user identity, device compliance and location for every request, with no automatic trust for anyone on the internal network. Which approach does this describe, and what does it imply?

This is a zero trust model: no user or device is trusted merely for being on the internal network, and identity, device compliance and context are verified for every access request. It differs from perimeter security, which trusts anyone already inside the network.

  1. AA perimeter-based model, implying strong firewalls are sufficient
  2. BA zero trust model, implying continuous verification of each access request regardless of network locationCorrect
  3. CA discretionary access model, implying data owners freely share access
  4. DA single sign-on model, implying one login grants access to all systems without further checks

Explanation

Zero trust assumes no implicit trust based on network position and verifies identity, device and context on each request. A perimeter model trusts internal users once inside. Single sign-on simplifies authentication but does not itself involve per-request contextual checks, and discretionary access leaves decisions to owners.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions