"Why should I be treated like a suspect at work when I've done nothing wrong?" That question came up during…
Michael I. — SOC RESIDENT ANALYST
"Why should I be treated like a suspect at work when I've done nothing wrong?"
That question came up during a conversation I recently had.
At first, it sounded unfair. Employees, contractors, and vendors are there to contribute to the organization, not harm it. So why should everyone be subjected to repeated verification, access controls, and the Principle of Least Privilege?
Then I thought about the MGM Resorts cyberattack in 2023.
The attackers didn't begin by doing anything too complicated or breaking through layers of security. Instead, they gathered publicly available information about an employee, contacted the IT help desk, impersonated that employee, and convinced the support team to reset the account's credentials.
The employee wasn't malicious.
The help desk technician wasn't malicious.
The credentials were legitimate.
Yet that single act of misplaced trust gave the attackers a foothold. From there, they moved through MGM's environment, disrupting hotel operations, casino systems, digital room keys, and customer services across multiple properties. Investigations later revealed that social engineering played a central role in the attack.
That was the moment it clicked for me.
Zero Trust isn't built on the assumption that people are untrustworthy. It's built on the reality that identities can be compromised.
An employee's account can be stolen.
A vendor's credentials can be abused.
A contractor's device can become infected.
The account requesting for access may be legitimate but are we certain the request itself is?
That's why Zero Trust follows a simple principle
Never trust, Always verify.
And it's why the Principle of Least Privilege is just as important. If someone only needs access to one application or system, they shouldn't automatically have access to everything else. Limiting access reduces the damage an attacker can cause if a single identity is compromised.
Zero Trust isn't about distrusting people.
It's about recognizing that identities can be stolen, devices can be compromised, and even well-intentioned people can unknowingly become an attacker's entry point.
Today it might be an employee.
Tomorrow it could be a contractor.
Next week it might be a vendor.
That's why modern security asks for verification every time, not because you're a suspect, but because trust itself can be compromised.
2 reactions · 0 comments