FR FieldReady Academy
Unit 1ConceptsObjective 1.29 min read

Zero Trust

Unit 1: Security Foundations. Lesson 3 of 54 in SecPlus Academy.

Traditional security was a castle: a hard perimeter, and anything inside was trusted. Zero trust throws that out. Location grants nothing. Every request, from anyone, from anywhere, is verified against policy before it is allowed. The exam expects the vocabulary of how that verification is organized.

Two planes

Zero trust splits the work into a control plane that decides and a data plane that carries traffic and enforces the decision.

Control plane components

  • Adaptive identity: authentication strength changes with context. A login from a managed laptop in the office needs less than the same account from a new phone in another country.
  • Threat scope reduction: limit what any single identity can reach, so a compromised account can do little.
  • Policy-driven access control: rules based on identity, device, and context decide access, never the network location.
  • Policy engine: the component that evaluates each request against policy and returns allow or deny.
  • Policy administrator: takes the engine's decision and instructs the enforcement point to open or close the path.

Data plane components

  • Subject and system: the user or process asking, and the resource being asked for.
  • Policy enforcement point: where the decision is applied. It sits in the path of the traffic and only passes what the control plane approved.
  • Implicit trust zones: small zones where, after verification, traffic is allowed to flow. They replace the one big trusted inside.

The subject/system making the request is evaluated at the policy enforcement point before it reaches the resource.

How a request flows

  1. The subject asks the enforcement point for a resource.
  2. The enforcement point hands the request to the policy administrator.
  3. The policy engine evaluates identity, device health, location, and the requested action against policy.
  4. The administrator tells the enforcement point to allow or deny.
  5. Access is granted only to that resource, for that session, and can be re-evaluated.
Exam tip: "decides" is the policy engine, "communicates the decision" is the policy administrator, "applies it to traffic" is the policy enforcement point. "Authentication requirements change with context" is adaptive identity.
Remember
Never trust, always verify. Control plane decides (engine, administrator, adaptive identity, scope reduction, policy-driven). Data plane enforces (enforcement point, implicit trust zones, subject and system).
Deeper explanation

Zero Trust, explained slowly

The castle and the airport

The old model was a castle: a moat and a wall, and once you were inside you could walk anywhere. Attackers learned to get one foothold inside, then roam. Zero trust is an airport instead: your ticket is checked at the door, again at security, again at the gate, and you can only enter the one gate on your boarding pass. Being inside the terminal earns you nothing.

Two planes

Zero trust separates deciding from doing.

  • The control plane makes the decisions. It never touches the traffic.
  • The data plane carries the traffic and enforces the decisions.
CONTROL PLANE (decides)
   Policy engine ............ evaluates the request against policy: allow or deny
   Policy administrator ..... sends the decision down to the enforcement point
   Adaptive identity ........ how much proof is required depends on context
   Threat scope reduction ... each identity can reach as little as possible
   Policy-driven access ..... rules about identity and device, not network location
            |
            v decision
DATA PLANE (enforces)
   Policy enforcement point . the gate: opens or stays closed
   Implicit trust zone ...... the small area you may move in once admitted
   Subject / system ......... the requester, and the resource it asked for

A request, step by step

  1. A subject (Maria on her laptop) asks for a system (the payroll app).
  2. The policy enforcement point in front of payroll holds the request and asks the control plane.
  3. The policy administrator passes it to the policy engine.
  4. The engine checks: is Maria authenticated? Is the laptop managed and patched? Is she in an allowed location? Does her role include payroll? Adaptive identity may demand a second factor because she is on a new network.
  5. The engine says allow, for payroll only, for this session. The administrator tells the enforcement point to open.
  6. Maria reaches payroll and nothing else. That is her implicit trust zone. If her device health changes mid-session, the decision can be re-evaluated and access revoked.

The part that trips people up: engine versus administrator versus enforcement point

Three components, three verbs. The engine decides. The administrator communicates the decision. The enforcement point applies it to traffic. Questions test exactly this separation.

Why the pieces matter

  • Threat scope reduction is why a stolen account in a zero trust network is a small problem instead of a catastrophe.
  • Policy-driven access control is why "I am on the office network" is no longer a credential.
  • Adaptive identity is why a login from a strange place asks for more.

How the exam asks it

  • "Which component makes the access decision?" Policy engine.
  • "Which component is in the data plane and enforces access?" Policy enforcement point.
  • "Authentication requirements change based on user behavior and location." Adaptive identity.
  • "Limiting the resources any single compromised identity can reach." Threat scope reduction.

What to memorize

  • Never trust, always verify; location is not a credential.
  • Control plane: engine decides, administrator communicates, adaptive identity, threat scope reduction, policy-driven access control.
  • Data plane: enforcement point, implicit trust zones, subject and system.