What's changed: Initial version
4.4Zero trust and new defense approaches
Covers zero trust architecture, which discards the assumption that "inside the perimeter is trustworthy" (verify everything, microsegmentation), threat intelligence (OSINT) for gathering and analyzing attacker trends, digital forensics, which emphasizes evidence preservation and integrity, IoT security and operational technology (OT) security, and hardware-level defenses via secure boot, TPM, and SED.
The idea seen in earlier sections—"defend the perimeter, layer your defenses"—rested on the assumption that the inside of the internal network is fundamentally trustworthy. But cloud adoption, remote work, and rising insider threats have eroded that assumption. This section studies newer defense concepts from the perspective of what motivates, and how to design, a move from perimeter defense to zero trust.
4.4.1Zero trust architecture
- Zero trust architecture discards the perimeter-defense assumption of "trust it because it is inside the internal network," instead verifying every access, whether from inside or outside, on a per-request basis. It evaluates user authentication, device health, and the sensitivity of the resource being accessed on every access, granting only least-privilege permission.
- Microsegmentation divides the network into fine-grained units (e.g., per workload) and verifies and restricts communication between segments on every request. It counters the weakness of perimeter defense—"once inside, an attacker can move laterally at will"—by containing a breach so it cannot spread horizontally even inside the network.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.