InfoSec Notes

Zero Trust Security Architecture

Comprehensive guide to Zero Trust principles including never trust always verify, microsegmentation, continuous authentication, and implementation strategies.

What is Zero Trust?

Zero Trust is a security framework that eliminates implicit trust from network architecture. Instead of the traditional "castle and moat" approach (trust everything inside the perimeter), Zero Trust assumes breach and verifies every request regardless of origin.

Traditional vs Zero Trust

============================

Traditional (Perimeter-based)

Internet ──[Firewall]──→ Internal Network (TRUSTED)

"If you're inside, you're trusted"

Problem: Once an attacker gets in, they move freely

Zero Trust

Every request → [Verify Identity] → [Check Device] → [Evaluate Context]

→ [Apply Least Privilege] → [Monitor Continuously]

"Never trust, always verify — regardless of network location"

Zero Trust Principles

Principle	Description	Implementation
Verify explicitly	Always authenticate and authorize	MFA, device health, context
Least privilege	Minimum access, just-in-time	Time-limited access, RBAC/ABAC
Assume breach	Minimize blast radius	Microsegmentation, encryption
Continuous monitoring	Never stop verifying	Real-time risk assessment
Encrypt everything	Protect data everywhere	E2E encryption, TLS everywhere

Zero Trust Architecture Components

\| Identity	\| \| Policy Decision \| \| Applications \|
\| - Who are you? \|------>\| Point (PDP)	\|--->\| Data stores \|
\| Device Trust	\| \| Policy Enforce- \|
\| - Patched? \| \| ment Point (PEP)	\|

Implementation Strategy

Example

class ZeroTrustPolicyEngine: """Zero Trust policy evaluation engine.""" def __init__(self): self.risk_threshold = 70 # Score below this = deny def evaluate_request(self, request: dict) -> dict: """Evaluate every access request against zero trust policies.""" risk_score = 100 # Start at full trust, deduct for risks reasons = [] # Factor 1: Identity verification if not request.get("mfa_verified"): risk_score -= 40 reasons.append("MFA not verified") # Factor 2: Device health device = request.get("device", {}) if not device.get("compliant"): risk_score -= 20 reasons.append("Device not compliant") if not device.get("encrypted"): risk_score -= 15 reasons.append("Device not encrypted") # Factor 3: Network context if request.get("network") == "untrusted": risk_score -= 10 reasons.append("Untrusted network") # Factor 4: Behavioral analysis if request.get("unusual_location"): risk_score -= 15 reasons.append("Unusual access location") if request.get("unusual_time"): risk_score -= 10 reasons.append("Unusual access time") # Factor 5: Resource sensitivity if request.get("resource_sensitivity") == "high": risk_score -= 5 # Raise the bar for sensitive resources # Decision decision = "ALLOW" if risk_score >= self.risk_threshold else "DENY" return { "decision": decision, "risk_score": risk_score, "threshold": self.risk_threshold, "risk_factors": reasons, "recommendation": self._get_recommendation(risk_score, reasons) } def _get_recommendation(self, score, reasons): if score >= 90: return "Full access granted" elif score >= self.risk_threshold: return "Access granted with monitoring" elif score >= 50: return "Step-up authentication required" else: return "Access denied - too many risk factors" # Test scenarios zt = ZeroTrustPolicyEngine() # Scenario 1: Trusted employee at office result = zt.evaluate_request({ "user": "alice@company.com", "mfa_verified": True, "device": {"compliant": True, "encrypted": True, "managed": True}, "network": "corporate", "unusual_location": False, "unusual_time": False, "resource_sensitivity": "medium" }) print(f"Office access: {result['decision']} (score: {result['risk_score']})") # Scenario 2: Same employee from coffee shop result = zt.evaluate_request({ "user": "alice@company.com", "mfa_verified": True, "device": {"compliant": True, "encrypted": True, "managed": True}, "network": "untrusted", "unusual_location": True, "unusual_time": False, "resource_sensitivity": "high" }) print(f"Coffee shop: {result['decision']} (score: {result['risk_score']})")

Google BeyondCorp (Real-World Zero Trust)

Google pioneered Zero Trust with BeyondCorp after the Operation Aurora attack (2009):

Eliminated VPN for employee access
Every request authenticated regardless of network
Device trust based on certificate and health
Access decisions based on user + device + context
All internal services treated as internet-facing

Interview Questions

What is Zero Trust and how does it differ from perimeter security?

Zero Trust eliminates implicit trust based on network location. Perimeter security trusts everything inside the firewall. Zero Trust verifies every request (identity, device, context) regardless of where it originates, assuming the network is already compromised.

What are the key pillars of a Zero Trust architecture?

Identity verification (strong authentication), device trust (health and compliance), network segmentation (microsegmentation), least privilege access, continuous monitoring, and encryption everywhere.

How does microsegmentation support Zero Trust?

Microsegmentation creates isolated network zones around individual workloads or resources. Even if an attacker compromises one segment, they cannot move laterally to others without re-authenticating. Each segment has its own access policies.

What challenges do organizations face when implementing Zero Trust?

Legacy system compatibility, performance overhead of continuous verification, user experience friction, complexity of policy management, cost of implementation, cultural resistance to removing implicit trust, and difficulty with IoT/OT devices.

How does Zero Trust handle the case of a compromised device?

Continuous device health monitoring detects compromise indicators (missing patches, disabled security tools, unusual behavior). The policy engine immediately reduces the device's trust score, requiring re-authentication or blocking access until remediation. Access can be revoked in real-time.

Exam Focus

Revise definitions, diagrams, examples, and short-answer points for Zero Trust Security Architecture.

Interview Use

Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.

Search Terms

information-security, information security, information, security, access, control, zero, trust

Continue learning this concept

Access ControlIntroduction to Access ControlComprehensive overview of access control concepts, models, and mechanisms for controlling who can access resources in information systems.Access ControlAttribute-Based Access Control (ABAC)Understanding ABAC policies that evaluate multiple attributes of subjects, resources, actions, and environment for fine-grained access decisions.Access ControlDiscretionary Access Control (DAC)Understanding DAC where resource owners control access permissions, including Unix file permissions, Windows ACLs, and security implications.Access ControlMandatory Access Control (MAC)Understanding MAC systems where access decisions are enforced by the system based on security labels, covering Bell-LaPadula, Biba models, and SELinux.Access ControlRole-Based Access Control (RBAC) — Information SecurityUnderstanding RBAC implementation, role hierarchies, permission assignment, and best practices for enterprise access management.Operating System SecurityOS Access Control ModelsImplementing access control at the operating system level including DAC, MAC, capabilities, and security policies.

PreviousRole-Based Access Control (RBAC) — Information Security NextFirewalls in Network Security