Protecting Identities and Secrets at Enterprise Scale: A Zero Trust Framework for the Age of AI-Augmented Threats

Abstract

As contemporary cloud-native systems evolve, identity has quickly become the foremost surface where attackers can compromise accounts. In addition to the 600 million identity-based attacks seen on a daily basis, 97% of these attacks leverage credentials i.e., passwords to gain access to systems. Rapid cloud adoption, new workloads created through cloud services, and emerging methods of attack (e.g., AI-assisted phishing or AiTM, which is often paired with credential theft) have made off-the-shelf authentication models obsolete. The objective of this paper is to present a comprehensive framework to protect an enterprise’s identity and secret at an enterprise-level and is based on Zero Trust principles as well as the experience of the author who serves as an SRE Platform manager for a large public cloud company. We will also address the evolving landscape of potential identity threats; for example: credential stuffing, token replay, OAuth consent phishing and attacks against non-person identities; and provide a multi-layered defense architecture to include: phishing-resistant multi-factor authentication (MFA), passwordless migration, workload identity governance, secrets lifecycle management, and AI-based anomaly detection. As part of this paper, we will also share results from an enterprise-scale implementation of MFA where we achieved more than 99.6% MFA adoption across 200,000+ employees and discuss the operational, cultural, and architectural lessons learned from this implementation. We will conclude this paper with action items for those organizations that hope to move from password-based authentication to a Zero Trust identity model.