1.3 Zero Trust Architecture (ZTA) and Least Privilege

🎯 Key CompTIA Security+ Exam Takeaways

• Zero Trust abandons the legacy 'castle-and-moat' perimeter model, enforcing the core tenet: 'never trust, always verify'.
• ZTA operates under the explicit assumption that adversaries already exist inside the internal corporate network.
• Every access request is dynamically authenticated, authorized, and encrypted based on contextual attributes (user identity, device posture, location).
• Microsegmentation restricts lateral east-west movement by isolating workloads and applying granular policy enforcement.

Traditional enterprise cybersecurity relied heavily on the 'castle-and-moat' perimeter defense model: everything outside the firewall was treated as hostile, while everything inside the corporate local area network (LAN) was granted implicit trust. Once an attacker or insider compromised a single workstation or VPN tunnel, they could move laterally across flat internal subnets with minimal friction.

Zero Trust Architecture (ZTA), formalized in NIST SP 800-207, completely eliminates implicit trust based on network location or IP address. ZTA treats the internal network as hostile, adhering to three fundamental principles: 1) Verify explicitly (always authenticate and authorize based on all available data points, including user identity, location, device health, and anomalous behaviors); 2) Use least privilege access (limit user access with Just-In-Time and Just-Enough-Access); and 3) Assume breach (minimize blast radius by segmenting networks, encrypting all communications, and actively hunting for threats).

A critical technical pillar of Zero Trust is microsegmentation. By creating granular, software-defined security perimeters around individual workloads, containers, or applications, microsegmentation prevents compromised endpoints from pivoting laterally ('east-west') to adjacent database servers or domain controllers.

⚠️ Common Pearson VUE Exam Traps

• Believing Zero Trust is a single hardware appliance or software product you can purchase off the shelf; it is an architectural framework.
• Assuming internal corporate LAN or VPN connections grant implicit trust under Zero Trust; ZTA treats internal subnets with the exact same suspicion as the public internet.