Cyber Attacks and Defense in Practice
Which of the following correctly describes access control based on the idea of zero trust?
- AIt does not trust anyone just for being on the internal network; for each request it checks the user and the device state and allows only the minimum access needed
- BIt regards the inside of the internal network as safe and lets traffic flow freely there, using the perimeter firewall and VPN only to keep out intruders from outside
- COnce a user and a device have logged in successfully, they are trusted and can afterwards access all systems freely without further checks
Show answer and explanation
Answer: A. It does not trust anyone just for being on the internal network; for each request it checks the user and the device state and allows only the minimum access needed
Traditional perimeter defense regarded the internal network as a trusted inside and kept intruders out at the perimeter. As cloud use and remote work spread what must be protected beyond the company, and because an attacker who gets inside the perimeter can move freely, the idea of zero trust, which grants no trust based on network location, has spread. In SP 800-207, published in 2020, the US NIST set out principles such as not trusting implicitly based on network location, granting access to resources per request and deciding by dynamic policies based on factors such as the state of users and devices. It is summed up as "never trust, always verify".
- A. Correct. Trust is decided by checking each request, not by network location.
- B. This is the perimeter-defense approach. Once an attacker is inside, they can move freely.
- C. Trusting broadly after a single authentication is the opposite of zero trust. Only the minimum access needed is allowed per request.
Continue: 9 more Cyber Attacks and Defense in Practice questions