A Zero Trust approach to access management is based on the principle of verifying every access request as if it originates from an open network, regardless of the source, destination, or context. This means that no implicit trust is granted based on network location, user identity, or device status. Instead, every access request is evaluated based on multiple factors, such as user credentials, device health, data sensitivity, and threat intelligence. A Zero Trust approach also requires that all communication is encrypted and protected, and that access is granted on a per session basis with the least privilege principle123.

Utilizing a solution that allows direct access by third parties to the organization’s network does not reflect a Zero Trust approach, because it implies that the network perimeter is a reliable boundary for security and trust. This assumption is risky, because it exposes the organization to potential breaches and attacks from compromised or malicious third parties, who may have access to sensitive data and resources without proper verification or protection. A Zero Trust approach would require that third parties use secure and isolated channels to access the organization’s network, such as VPNs, proxies, or gateways, and that their access is monitored and controlled based on granular policies and conditions123. References:

Zero Trust part 1: Identity and access management

Zero Trust Model - Modern Security Architecture | Microsoft Security

Zero Trust identity and access management development best practices …