[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2NXbWQBk2CBrPwnEkvkHAMZcrOOP9RjB2ASk8z_G38c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":33,"created_at":34,"published_at":35,"article":36,"tags":40,"podcasts":59,"controls":60},"4a590e4f-04c5-4617-bccb-13e734c8b6f3","zero-trust-has-a-day-one-blind-spot-the-onboarding-identity-gap","15095e6d-b4c7-4fbf-8829-8075d1aaf74f","Zero Trust Has a Day-One Blind Spot: The Onboarding Identity Gap","Zero Trust architectures assume strong identity verification, but the onboarding window — before MFA and robust credentials are fully established — creates a critical vulnerability that attackers actively exploit. North Korean state-sponsored actors have demonstrated this by infiltrating organizations using fraudulent identities during remote hiring processes, effectively bypassing the security controls that Zero Trust promises. The core failure is treating new user onboarding as a lower-risk process than ongoing authentication, when in reality it is the most exploitable moment in the identity lifecycle. Without rigorous identity proofing at the point of hire — equivalent to or stronger than controls applied to existing users — organizations are handing adversaries a trusted foothold before security controls are even applied.","**Immediate actions:**\n- Implement government-grade identity proofing (e.g., verified ID documents + liveness checks) for all new remote hires before issuing any credentials.\n- Restrict Day-One access to a minimal, isolated environment with no lateral movement capability until full identity verification is confirmed.\n- Flag and manually review all fully remote job applicants who decline video onboarding or exhibit inconsistencies in identity documentation.\n\n**Long-term improvements:**\n- Establish a formal Identity Proofing Policy that mandates equivalent verification rigor for new users as for privileged access re-certification.\n- Integrate third-party background verification and identity-proofing services (e.g., NIST SP 800-63-3 IAL2\u002FIAL3 compliant) into the HR and IT onboarding pipeline.\n- Design Zero Trust onboarding workflows that enforce progressive trust elevation, granting broader access only after behavioral and identity signals are validated over time.\n\n**Detection measures:**\n- Deploy User and Entity Behavior Analytics (UEBA) tuned specifically to flag anomalous behavior patterns in newly onboarded accounts during the first 90 days.\n- Log and alert on all access attempts made by accounts in a 'probationary' identity state, escalating unusual off-hours or bulk-data-access activity for immediate review.",[12,13,14,15,16,17,18,19,20,21],"NIST SP 800-63-3 (Digital Identity Guidelines — IAL2\u002FIAL3)","NIST SP 800-207 (Zero Trust Architecture — Section 3.3 Identity)","NIST AC-2 (Account Management)","NIST IA-12 (Identity Proofing)","CIS Control 6 (Access Control Management)","CIS Control 5 (Account Management)","CISA Zero Trust Maturity Model — Identity Pillar","GDPR Article 32 (Security of Processing — applicable to employee data handling)","ISO\u002FIEC 27001 A.9.2.1 (User Registration and De-registration)","FBI PSA: North Korean IT Worker Threat (2022–2024)",{"NIST AC-2 (Account Management)":23,"NIST IA-12 (Identity Proofing)":24,"CIS Control 5 (Account Management)":25,"CIS Control 6 (Access Control Management)":26,"CISA Zero Trust Maturity Model — Identity Pillar":27,"FBI PSA: North Korean IT Worker Threat (2022–2024)":28,"NIST SP 800-63-3 (Digital Identity Guidelines — IAL2\u002FIAL3)":29,"ISO\u002FIEC 27001 A.9.2.1 (User Registration and De-registration)":30,"NIST SP 800-207 (Zero Trust Architecture — Section 3.3 Identity)":31,"GDPR Article 32 (Security of Processing — applicable to employee data handling)":32},"Account management covers how accounts are created and what access new staff get on day one.","Identity proofing helps detect fraudulent identities used by North Korean IT workers.","Account management covers processes for creating and reviewing new user accounts.","Access control management limits what new accounts can reach until identity is fully verified.","The identity pillar covers verifying identities before granting access, including during onboarding.","Describes how North Korean IT workers use fake identities to get hired, the threat this lesson describes.","Identity proofing at a high assurance level helps confirm new hires are who they claim to be.","Registration controls ensure accounts are only created for verified new staff.","Zero trust depends on strong identity, which must start with verifying new staff.","Requires appropriate security for employee data, including during onboarding.","published","2026-10-01T16:22:29.324837+00:00","2026-10-01T16:22:29.214+00:00",{"id":7,"url":37,"slug":38,"title":39},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fthe-day-one-hole-in-zero-trust-architecture\u002F","the-day-one-hole-in-zero-trust-architecture-929134","The Day-One Hole in Zero Trust Architecture",[41,47,53],{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":48,"name":49,"slug":50,"description":51,"color":52},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":54,"name":55,"slug":56,"description":57,"color":58},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[61,65,69],{"slug":62,"name":63,"problem":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":66,"name":67,"problem":68},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":70,"name":71,"problem":72},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]