Cyberstudy
PDF p.178 In progress

Zero Trust Security Concepts

Open PDF at p.178 18 flashcards

Summary

PDF p.178

Zero Trust is a security model that requires all devices, users, and services to be authenticated and authorized before accessing network resources. It assumes no inherent trust, whether inside or outside a network's perimeter, and includes several fundamental concepts for comprehensive security.

In plain words

Supplementary — not from your PDF

Zero trust uses several ideas: adaptive identity (continuous, context-aware verification), threat scope reduction (need-to-know access), policy-driven access control, and device posture checks. The control plane decides: the policy engine makes decisions and the policy administrator issues tokens and sessions. The data plane enforces: the policy enforcement point sets up the secure path, and the implicit trust zone is kept as small as possible.

Detailed explanation

PDF p.178
  • Adaptive Identity
    • Definition: Continuous identity verification based on a user's current context and the resources they are accessing.
    • Purpose: Ensures dynamic and context-aware authentication.
  • Threat Scope Reduction
    • Definition: Grants access on a need-to-know basis, limiting access to necessary resources.
    • Purpose: Reduces the network's attack surface and potential damage from attacks.
  • Policy-Driven Access Control
    • Definition: Enforces access restrictions based on user identity, device posture, and network context.
    • Purpose: Ensures that access is granted according to predefined policies.
  • Device Posture
    • Definition: Security status of a device, including configurations, software versions, and patch levels.
    • Purpose: Assesses whether a device meets security requirements or poses a risk.

Significance of Control and Data Planes in Zero Trust Models

  • Control Plane
    • Function: Manages policies for user and device authorization.
    • Components
      • Policy Engine: Configures identities, access policies, threat intelligence, and behavioral analytics to make dynamic decisions.
      • Policy Administrator: Manages access tokens and session establishment based on policy engine decisions.
  • Data Plane
    • Function: Establishes secure sessions for information transfers.
    • Components
      • Policy Enforcement Point: Mediates access requests and interfaces with the policy administrator to set up secure data pathways.
  • Implicit Trust Zone
    • Definition: Secure data pathway established between the policy enforcement point and the resource.
    • Purpose: Ensures data protection through encryption and minimizes trust zones.

Zero Trust Architecture Examples

  • Google BeyondCorp
    • Description: Uses multiple security layers (identity verification, device verification, access control) to secure internal networks and provide remote access.
  • Cisco Zero Trust Architecture
    • Description: Incorporates network segmentation, access control policies, and threat detection to protect against various cyber threats.
  • Palo Alto Networks Prisma Access
    • Description: Cloud-delivered security service using Zero Trust to secure network traffic and prevent data exfiltration.

Important terms

taken from the text above
Adaptive Identity
Continuous identity verification based on a user's current context and the resources they are accessing.
Threat Scope Reduction
Grants access on a need-to-know basis, limiting access to necessary resources.
Policy-Driven Access Control
Enforces access restrictions based on user identity, device posture, and network context.
Device Posture
Security status of a device, including configurations, software versions, and patch levels.
Policy Engine
Configures identities, access policies, threat intelligence, and behavioral analytics to make dynamic decisions.
Policy Administrator
Manages access tokens and session establishment based on policy engine decisions.
Policy Enforcement Point
Mediates access requests and interfaces with the policy administrator to set up secure data pathways.
Implicit Trust Zone
Secure data pathway established between the policy enforcement point and the resource.
Google BeyondCorp
Uses multiple security layers (identity verification, device verification, access control) to secure internal networks and provide remote access.
Cisco Zero Trust Architecture
Incorporates network segmentation, access control policies, and threat detection to protect against various cyber threats.
Palo Alto Networks Prisma Access
Cloud-delivered security service using Zero Trust to secure network traffic and prevent data exfiltration.

Examples & real-world scenarios

Supplementary — not from your PDF
  • Blocking access from a laptop missing critical patches (device posture).
  • Asking for step-up MFA when a user opens a sensitive app from a new location.
  • Google BeyondCorp as a real-world zero trust model.

Scenario

A user with valid credentials tries to open payroll data from an unmanaged personal tablet. The policy engine evaluates identity plus device posture and denies access, even though the password is correct.

Common mistakes

Supplementary — not from your PDF
  • Mixing up the policy engine (decides) and the policy enforcement point (enforces).
  • Placing the policy administrator in the data plane. It belongs to the control plane.

Practical skills

Supplementary — not from your PDF
  • Map zero trust components to the control and data planes.

What I should remember

Key Points PDF p.178
  • Zero Trust Model
    • No Inherent Trust: Continuous authentication and authorization.
    • Adaptive Identity: Context-aware verification.
    • Threat Scope Reduction: Need-to-know access.
    • Policy-Driven Control: Enforces access restrictions.
    • Device Posture: Security status assessment.
  • Control and Data Planes
    • Control Plane: Manages policies and decisions.
    • Data Plane: Establishes secure sessions.
    • Implicit Trust Zone: Secure data pathways.
  • Examples
    • Google BeyondCorp: Multi-layer security.
    • Cisco Zero Trust: Comprehensive threat protection.
    • Palo Alto Prisma Access: Secure network traffic.