The Day-One Hole in Zero Trust Architecture

Zero Trust principles are now commonplace in enterprise infrastructure; organizations have spent years investing in measures that secure identities and systems against sophisticated attacks.

However, human error is still a readily exploitable path into even hardened organizations, particularly where trust is established manually. Onboarding and service desk processes are a natural pressure point where agents may need to make high-impact access decisions with limited context, while attackers only need to convince one person that they are who they claim to be.

For an established user, agents have plenty of ways to verify identity. A new employee typically hasn’t set those verification methods up, but the organization still needs to establish trust. And if the initial check is weak, the controls that follow cannot fix it.

Organizations therefore need robust methods to confidently verify identity and close the gaps that attackers are increasingly targeting.

The Fraudulent Identity Problem

The FBI has repeatedly warned that North Korean IT workers are using stolen or fraudulent identities to secure remote jobs and gain access to corporate networks. In some cases, workers have used false identity documents, proxy infrastructure and US-based facilitators to make themselves appear to be legitimate applicants.

This turns the usual identity security model on its head. Intrusion techniques typically involve the attacker stealing an employee’s credentials and using them to gain access. In an onboarding attack, the attacker passes the hiring process, and the organization creates credentials for them.

North Korean fake worker schemes are persistent threats, and the FBI now recommends identity verification during the hiring process and throughout the employment of remote workers. The wider lesson is that organizations must apply the same level of scrutiny to creating an identity as they do to authenticating one that already exists.

Strong MFA Has a Weak Point: Enrollment

Once a new employee has passed onboarding, the service desk is often heavily involved in getting them set up. Agents may help activate the account, issue an initial credential, enroll MFA, register a passkey or security key, and configure a corporate device.

If the wrong person reaches this stage, strong authentication doesn’t correct the mistake. The attacker may end up with an account secured by MFA and linked to a trusted device, all issued through normal processes.

Users are particularly exposed during this credential bootstrapping stage, when they may still depend on weaker authentication before phishing-resistant credentials are registered. Attackers that compromise this window can interfere with enrollment and establish persistent access before stronger controls are fully in place.

Day One Needs its Own Identity Verification Layer

Authentication asks whether someone can prove control of a credential linked to an account. Identity proofing asks whether the person in front of you is the individual the organization intends to give that account to.

For an existing employee, a trusted factor such as an enrolled authenticator or registered device can provide enough assurance for many service desk requests. New starters may not yet have a corporate device or any established authentication factor the organization can trust.

That means Day One needs its own verification process, especially when the user is about to receive access to sensitive systems or register the credentials that will represent them going forward.

Strong forms of identity proofing, such as validating a government-issued identity document and pairing it with biometric liveness checks, can provide assurance in the absence of existing authentication factors. This helps establish confidence in the person before the organization starts issuing trust.

Make Identity Verification Part of the Workflow

Solutions like Specops Secure Onboarding apply that principle by making identity verification a required step in the onboarding process, rather than something left to the service desk agent to judge case by case.

As onboarding is usually the point where trust is first created, if an identity is poorly established at that stage, every control that follows is built on the wrong foundation.

For new hires, Specops Secure Onboarding combines government-issued document scanning and validation with biometric liveness detection. This gives organizations a higher level of assurance that the person being onboarded is the person they claim to be before credentials, MFA methods, devices or application access are issued.

The same principle continues after onboarding. When that employee later contacts the service desk for help, Specops Secure Onboarding requires them to verify their identity using trusted authentication factors before the agent can proceed.

This removes much of the guesswork from the process. Agents do not have to decide whether a caller sounds convincing or whether the information they provide is good enough. Instead, verification becomes part of the workflow itself.

Zero Trust Should Start Before the First Login

Organizations have become much better at verifying users once they are inside the environment. The next step is applying the same thinking to the moment those identities are created.

A new employee shouldn’t become trusted simply because an onboarding email reached the right inbox or a service desk agent was convinced by a caller. Identity needs to be established before credentials and access are issued, then verified again when sensitive support requests arise.

To strengthen identity verification across your onboarding and service desk processes, book a demo with Specops to learn how our solutions can help.

Sponsored and written by Specops Software.