A company is implementing a Zero Trust security model. As part of this, every network access attempt, regardless of origin (internal or external), must be explicitly verified and authorized before granting access. This verification must be continuous, meaning access can be revoked if the user or device posture changes during a session. Which Zero Trust principle does this scenario primarily highlight?
- ALeast Privilege Access
- BMicro-segmentation
- CVerify Explicitly
- DAssume Breach
Show answer & explanationAnswer & explanation
Correct answer: C. Verify Explicitly
The scenario emphasizes 'every network access attempt... must be explicitly verified and authorized' and 'continuous' verification, which are direct tenets of the 'Verify Explicitly' principle of Zero Trust. This principle dictates that all resources are accessed securely regardless of location, and all access requests are authenticated and authorized based on all available data points, including user identity, device posture, location, and service.
Why the other options are wrong
- A. Least Privilege Access ensures users only have necessary permissions, which is a consequence of verification, not the verification process itself.
- B. Micro-segmentation is an architectural approach to limit lateral movement, which is enabled by Zero Trust but not the principle of verification itself.
- D. Assume Breach is a foundational mindset, but the scenario focuses on the active verification process, not the overall assumption.
Zero Trust Principle: Verify Explicitly
A core Zero Trust principle stating that all access requests, regardless of origin, must be explicitly authenticated and authorized based on all available data points (identity, device, context) and continuously re-evaluated.
- No implicit trust granted based on network location.
- Requires strong authentication and authorization for every access.
- Access is continuously monitored and re-verified.
Memory trick: Zero Trust: 'Never Trust, Always Verify' – it's like a strict bouncer at every door.