Zero trust changes how organizations decide who and what can access their systems. Instead of assuming that a user or device is safe because it is inside a corporate network, zero trust verifies each access request. This lesson explains the core principles and how they apply to complex networks and data.
Traditional security often treats a corporate network as a trusted zone, with a firewall or VPN separating it from the outside. This approach can be inadequate when an organization uses cloud services, remote work, mobile devices, interconnected network zones, and Internet of Things (IoT) devices. There may be no single, dependable boundary around all of an organization's technology.
All flashcards
What does “never trust by default” mean in zero trust?
Network location or a previous successful check does not automatically make a user or device trustworthy. Access is decided through explicit verification and relevant context.
What is least privilege?
A security principle that limits a user or device to the minimum access needed for an authorized task, and only to explicitly permitted resources.
Why is a VPN connection not sufficient proof of trust?
A VPN connection alone does not establish that the user is authorized for a particular resource or that the device is currently secure.
What is zero trust data security?
Applying zero trust principles to data so each access request is dynamically authenticated and receives only the least privilege allowed by policy.
What role does ABAC play in zero trust?
Attribute-based access control evaluates relevant attributes—such as data characteristics, user identity, and environment—to determine whether an access request meets policy.
Quiz questions
What does NIST SP 800-207 emphasize when describing zero trust?Answer: Making per-request access decisions in a network treated as potentially compromised.
What is a Zero Trust Architecture (ZTA)?Answer: An enterprise cybersecurity plan specifying component relationships, workflows, and access policies.
Who used the term “Zero Trust model” for stricter cybersecurity programs in 2010?Answer: Forrester analyst John Kindervag.
Which step follows “Map the transaction flows” in the ZT-Kipling methodology?Answer: Build a zero trust architecture.
Which set contains the six Kipling Criteria used in the ZT-Kipling methodology?Answer: What, why, when, where, who, and how.