Continuing our series of posts on Enterprise Infrastructure capabilities, featured in a dedicated tab within the Blueprint dashboard, this post explores the Zero Trust Architecture.
Pega Cloud and Zero Trust Architecture implement a comprehensive security model that rejects the traditional assumption of trust and instead requires continuous verification, authentication, and authorization for every access request, regardless of origin.
What It Means
Zero Trust Architecture is a security philosophy that operates on the principle of “never trust, always verify”—eliminating implicit trust based on location or network and instead requiring explicit verification of every identity, device, and access request.
Pega Cloud implements Zero Trust principles across all infrastructure, requiring multi-factor authentication, continuous compliance checking, encryption, least-privilege access, and real-time monitoring for every connection and transaction.
What It Does
Enforces continuous verification and least-privilege access:
- Requires multi-factor authentication (MFA) for all user and service access
- Verifies device identity and compliance before granting network or application access
- Grants minimal necessary permissions (principle of least privilege) to every user and service
- Monitors and logs all access attempts, approvals, and denials in real-time
- Encrypts all data in transit and at rest using industry-standard protocols
- Implements microsegmentation to isolate applications and data within the network
How It Works
Zero Trust operates through continuous, contextual verification:
- Identity Verification: Every user and service is authenticated using strong credentials and MFA before access is granted
- Device Compliance Checking: Access is conditional on the device meeting security compliance standards (patched, encrypted, firewall enabled)
- Context-Based Access: Access decisions consider time, location, device type, and risk level to grant appropriate permissions
- Microsegmentation: Networks are divided into smaller zones to maintain separate access control for each segment
- Continuous Monitoring & Adaptive Response: All traffic is monitored for anomalies; suspicious activity triggers immediate restrictions or re-authentication
Best Practices
- Enforce multi-factor authentication (MFA) for all users and service-to-service integrations
- Implement role-based access control (RBAC) with the principle of least privilege
- Regularly audit access logs and user permissions to remove unnecessary or outdated access rights
- Use IP Allow Lists in combination with Zero Trust controls to restrict network access
- Monitor device security posture and ensure endpoints comply with organizational security policies
- Implement continuous threat detection to identify and respond to suspicious behavior in real-time
Technical Documentation: Pega Cloud and Zero Trust Architecture