4.4Zero trust and new defense approaches

The idea seen in earlier sections—"defend the perimeter, layer your defenses"—rested on the assumption that the inside of the internal network is fundamentally trustworthy. But cloud adoption, remote work, and rising insider threats have eroded that assumption. This section studies newer defense concepts from the perspective of what motivates, and how to design, a move from perimeter defense to zero trust.

4.4.1Zero trust architecture

• Zero trust architecture discards the perimeter-defense assumption of "trust it because it is inside the internal network," instead verifying every access, whether from inside or outside, on a per-request basis. It evaluates user authentication, device health, and the sensitivity of the resource being accessed on every access, granting only least-privilege permission.
• Microsegmentation divides the network into fine-grained units (e.g., per workload) and verifies and restricts communication between segments on every request. It counters the weakness of perimeter defense—"once inside, an attacker can move laterally at will"—by containing a breach so it cannot spread horizontally even inside the network.

4.4.2Threat intelligence and digital forensics

• Threat intelligence is information gathered and analyzed about attackers' TTPs (tactics, techniques, procedures), known malicious IPs/domains, and industry-specific attack trends, processed into a form usable for one's own organization's defense. OSINT (Open Source Intelligence), gathered from public sources such as news, social media, and forums, is one representative collection method. It underpins a shift from passive detection to proactive defense that closes likely weaknesses in advance.
• Digital forensics is the technique of collecting, preserving, and analyzing electronic evidence (logs, memory dumps, disk images, etc.) after an incident occurs, in a form that is legally and technically valid. To maintain the evidence's integrity (proof it has not been tampered with), the principle is to record a hash value at the time of collection and to perform all subsequent work on a copy (image), never altering the original.

4.4.3IoT and operational technology (OT) security

• IoT security starts from the premise that IoT devices such as sensors and cameras have significant resource constraints, making frequent patching or deploying sophisticated agents difficult, so the focus shifts to operational measures: changing default passwords, disabling unnecessary features, and network isolation (a dedicated IoT segment).
• Operational technology (OT) security protects the control equipment of factories and plants. Availability (never stopping the process) is the top priority, and the inability to casually reboot or patch as freely as in IT systems is a fundamental difference from IT-side security measures. Logically and physically separating the IT network from the OT network is the basic policy.

Suppose a manufacturing company, amid growing cloud adoption and remote work, finds the limits of its traditional "trust the inside of the office LAN" perimeter defense model exposed. Sales staff now access the core system from outside via various networks, and the risk has surfaced that once the perimeter (firewall) is breached, an attacker can move freely inside. The CSIRT therefore considers migrating to zero trust architecture—evaluating user authentication, device health (patch status, etc.), and the sensitivity of the resource on every single access, shifting to a design that does not unconditionally trust access even from the office LAN, and further microsegmenting the core system by function so that a breach in one segment cannot spread laterally to others. The key point is that this migration is motivated by the fact that the "inside the perimeter is safe" assumption has collapsed due to cloud usage, remote work, and insider threats alike, and the judgment is to extend verification granularity to all access, not to remove the existing firewall. In parallel, informed by threat intelligence (attacker TTPs gathered via OSINT), the company shifts to proactively identifying and closing its own likely weaknesses in advance. Meanwhile, at this company's factory OT environment, where availability is the top priority and frequent patching is not feasible, the same zero-trust mechanisms used in IT cannot simply be carried over, so IT/OT network separation and hardware-level defenses—secure boot (verifying firmware signatures at startup to prevent booting tampered code), TPM (Trusted Platform Module) (a dedicated chip that securely holds keys inside hardware), and SED (Self-Encrypting Drive) (a drive that transparently encrypts its own data so its contents cannot be read even if stolen)—are prioritized. If an incident does occur, rather than examining the original disk directly, the team records its hash value and performs digital forensics on a copy of the image, preserving evidence integrity while pursuing root-cause analysis and recurrence prevention.

4.4.4Section summary

• Zero trust architecture does not trust the perimeter interior and verifies every access; microsegmentation contains lateral movement inside the network
• Threat intelligence (OSINT) underpins proactive defense; digital forensics preserves the original unaltered and analyzes a copy while maintaining integrity via hash values
• IoT/OT security addresses the constraints of availability priority and difficult patching through operational measures and network separation; secure boot/TPM/SED provide hardware-level defense