1.3.2. The Zero Trust Mindset
š” First Principle: Traditional security assumes everything inside the network perimeter is trusted. Zero Trust assumes nothing is trusted ā every access request is verified regardless of where it comes from. In a world of cloud services, remote workers, and compromised insiders, the old perimeter-based model is fundamentally broken.
Think of the traditional model like a castle with a moat: once you're past the drawbridge (VPN, firewall), you're trusted and can roam freely inside. Zero Trust replaces the castle with an airport ā every doorway has its own checkpoint, every person is verified every time, and access is granted only to the specific gate on your boarding pass.
The shift to Zero Trust is driven by reality: attackers who breach the perimeter move laterally through networks with ease because internal traffic is rarely inspected. Cloud services exist outside any perimeter. Remote workers connect from untrusted networks. The perimeter has dissolved, and the trust model must evolve with it.
Zero Trust Network Access (ZTNA) is the practical implementation model ā replacing VPN-based access with per-application, per-session verification. Instead of granting network-wide access through a VPN tunnel, ZTNA grants access to specific applications only after verifying user identity, device health, and policy compliance. The user never touches the network ā only the specific resource they're authorized to reach.
Zero Trust operates on two planes:
- Control Plane ā makes policy decisions (adaptive identity, threat scope reduction, policy-driven access, policy administrator, policy engine)
- Data Plane ā enforces those decisions (implicit trust zones, subject/system identification, policy enforcement points)
The exam tests the specific components of each plane, which we'll cover in depth in Phase 2 (section 2.2.4). For now, internalize the core principle: never trust, always verify.
Reflection Question: An employee logs into the VPN from their home network. Under traditional security, what happens next? Under Zero Trust, what additional verifications might occur before they access a sensitive database?
