People are by no means implicitly reliable. Every time a user tries to access a useful resource, they must be authenticated and approved, irrespective of whether they're previously on the company network. Authenticated people are granted the very least-privilege accessibility only, as well as their permissions are revoked as https://www.researchgate.net/publication/365308473_Development_of_Cyber_Attack_Model_for_Private_Network