[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDw1q6ul-9BMGNfcznz_TQW0eNvElYdtPz6a1n3GSLpw":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":129},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"15095e6d-b4c7-4fbf-8829-8075d1aaf74f","The Day-One Hole in Zero Trust Architecture","the-day-one-hole-in-zero-trust-architecture-929134","Zero Trust can verify users once they are established, but onboarding creates a gap where organizations must decide who to trust before strong authentication exists. Specops explains why identity verification should begin before credentials, MFA methods, and access are issued. [...]","The article highlights a critical gap in Zero Trust architectures: the 'Day One' vulnerability during user onboarding. Attackers can exploit the initial stages of identity verification and credential issuance before strong authentication methods are established. The FBI's warnings about North Korean IT workers using fraudulent identities for remote jobs underscore the need for robust identity proofing processes, similar to those used for existing users, to prevent attackers from gaining access during this vulnerable onboarding window.","Zero Trust architectures have a 'Day One' vulnerability during user onboarding.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-day-one-hole-in-zero-trust-architecture\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F09\u002F23\u002Fspecops-question-mark.jpg","2026-10-01T14:01:11+00:00","2026-10-01T16:00:05.63078+00:00",7,[17,20,23,26],{"name":18,"type":19},"North Korean IT workers","threat_actor",{"name":21,"type":22},"Specops Software","vendor",{"name":24,"type":25},"Zero Trust Architecture","technology",{"name":27,"type":25},"Active Directory","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":28,"icon":30,"name":31,"slug":32},null,"Identity & Access","identity-access",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21],{"controls":49,"vendors":128},[50,79,101],{"slug":51,"name":52,"problem":53,"products":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":80,"name":81,"problem":82,"products":83},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[84,85,93],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":102,"name":103,"problem":104,"products":105},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[106,114,121],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":115,"product_name":118,"url":119,"description":120},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":102,"product_name":125,"url":126,"description":127},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[],{"slug":130,"title":131,"body":132,"framework_refs":133,"framework_notes":144},"zero-trust-has-a-day-one-blind-spot-the-onboarding-identity-gap","Zero Trust Has a Day-One Blind Spot: The Onboarding Identity Gap","Zero Trust architectures assume strong identity verification, but the onboarding window — before MFA and robust credentials are fully established — creates a critical vulnerability that attackers actively exploit. North Korean state-sponsored actors have demonstrated this by infiltrating organizations using fraudulent identities during remote hiring processes, effectively bypassing the security controls that Zero Trust promises. The core failure is treating new user onboarding as a lower-risk process than ongoing authentication, when in reality it is the most exploitable moment in the identity lifecycle. Without rigorous identity proofing at the point of hire — equivalent to or stronger than controls applied to existing users — organizations are handing adversaries a trusted foothold before security controls are even applied.",[134,135,136,137,138,139,140,141,142,143],"NIST SP 800-63-3 (Digital Identity Guidelines — IAL2\u002FIAL3)","NIST SP 800-207 (Zero Trust Architecture — Section 3.3 Identity)","NIST AC-2 (Account Management)","NIST IA-12 (Identity Proofing)","CIS Control 6 (Access Control Management)","CIS Control 5 (Account Management)","CISA Zero Trust Maturity Model — Identity Pillar","GDPR Article 32 (Security of Processing — applicable to employee data handling)","ISO\u002FIEC 27001 A.9.2.1 (User Registration and De-registration)","FBI PSA: North Korean IT Worker Threat (2022–2024)",{"NIST AC-2 (Account Management)":145,"NIST IA-12 (Identity Proofing)":146,"CIS Control 5 (Account Management)":147,"CIS Control 6 (Access Control Management)":148,"CISA Zero Trust Maturity Model — Identity Pillar":149,"FBI PSA: North Korean IT Worker Threat (2022–2024)":150,"NIST SP 800-63-3 (Digital Identity Guidelines — IAL2\u002FIAL3)":151,"ISO\u002FIEC 27001 A.9.2.1 (User Registration and De-registration)":152,"NIST SP 800-207 (Zero Trust Architecture — Section 3.3 Identity)":153,"GDPR Article 32 (Security of Processing — applicable to employee data handling)":154},"Account management covers how accounts are created and what access new staff get on day one.","Identity proofing helps detect fraudulent identities used by North Korean IT workers.","Account management covers processes for creating and reviewing new user accounts.","Access control management limits what new accounts can reach until identity is fully verified.","The identity pillar covers verifying identities before granting access, including during onboarding.","Describes how North Korean IT workers use fake identities to get hired, the threat this lesson describes.","Identity proofing at a high assurance level helps confirm new hires are who they claim to be.","Registration controls ensure accounts are only created for verified new staff.","Zero trust depends on strong identity, which must start with verifying new staff.","Requires appropriate security for employee data, including during onboarding."]