Lesson 1.9: Zero trust in practice
Zero trust is the idea that being on the company network, or on the VPN, proves nothing. Every request to every application should be decided on who the user is, the state of their device and the sensitivity of the data, every time. NIST SP 800-207 defines the architecture and CISA's Zero Trust Maturity Model describes stages from traditional to optimal across identity, devices, networks, applications and data. In the lab you find the applications Northwind still trusts by network location, read the broad firewall rules behind them, place the company on the maturity model and write a one-year plan.
20 min
You will learn to
- Explain zero trust and implicit trust
- Find access decided by network location
- Read the CISA maturity pillars and stages
- Prioritise by data sensitivity
- Write a phased zero trust plan
Key terms
- Zero trust
- No implicit trust from network location; every access is decided per request on identity, device and context.
- Implicit trust
- Access granted because of where a request comes from (office, VPN), not who or what makes it.
- Policy decision point
- The component that decides each access request; enforced by a policy enforcement point in front of the resource.
- CISA ZTMM
- CISA's Zero Trust Maturity Model: pillars identity, devices, networks, applications, data; stages traditional to optimal.
- Microsegmentation
- Allowing only specific flows between workloads instead of whole network zones.
← Running a risk register · All lessons · Monte Carlo: risk as a distribution, not a number →