Zero Trust (SEC+ 1.2)( DONE)

Zero Trust

Network security covers every device, process, and person whether you are a trusted person or not.

Functional planes of operations

Taking current security devices and breaking them into small individual components

Data Plane

the part of the device that is performing the actual security process and movement of data (Ex. Switch, router, firewall)

Control Plane

Where you manage all of the actions that are occurring in the data plane

Adaptive Identity

Adjusting security measures based on real-time data

What is an example of Adaptive Identity?

Someone is requesting data located in the US but is using an IP address that’s in China. So we gather additional info to confirm if the user is who they say they are.

Threat Scope Reduction

Limiting how many places can be used to get into the network

Policy driven access control

Combine the adaptive identity with a predefined set of rules

Security zones

instead of seeing a user logging in to a server as a 1 to 1 relationship we look at the overall path of the connection

Policy enforcement point (PEP)

multiple devices working together to provide identification of the users and the traffic

What is an example of using zones to deny access?

Rules that automatically denies access from someone coming from an untrusted zone trying to communicate with someone in a trusted zone

Policy Decision Point (PDP)

This process has 2 parts to make a decision on whether a request is allowed

What are the two policies that make up a PDP?

Policy engine and Policy administrator

Policy engine

Evaluates each access decision based on policy and decides to grant, deny, or revoke

Policy Administrator

Takes the decision from the policy engine and provides it to the PEP. Creating access tokens or credentials

How does the whole zero trust process work?

request from an untrusted zone over the data plane > send to PEP > if need for a policy enforcement, it will tell the policy administrator > sent to policy engine for a decision > policy administrator passes result back to PEP > if allowed, the PEP provides access to the trusted zone / resource