openskills.info
Course catalog
Course Preview

Zero Trust Architecture

Zero trust architecture protects each resource by checking the identity and context of every access request instead of treating a network location as trusted. It combines policy decisions, enforcement points, identity systems, device information, and monitoring to grant only the access needed for one session.

itCybersecurity fundamentals and governance

Zero Trust Architecture

Zero trust architecture is an enterprise security design that removes implicit trust based on network location or asset ownership. A request from an office network is not trusted merely because it is inside a firewall. A request from the internet is not rejected merely because it is outside. Each request reaches a policy enforcement point, which permits or blocks access to a specific resource after a policy decision.

The protected unit is a resource: an application, service, data store, device, or workload. This resource-centered model fits enterprises whose users, devices, and services span offices, homes, data centers, partner networks, and multiple clouds. It complements network security controls, but it does not turn an internal network into one trusted zone.

The decision and enforcement path

NIST separates the control plane from the data plane. The control plane decides whether access should exist. The data plane carries the permitted traffic.

  1. A subject requests access to a resource through a policy enforcement point, or PEP.
  2. The PEP sends the request and available context to the policy decision point.
  3. A policy engine evaluates enterprise policy and signals. These signals can include subject identity, device health, resource sensitivity, requested action, behavior, threat intelligence, and environmental conditions.
  4. A policy administrator establishes or terminates the communication path according to the decision.
  5. The PEP enforces that result and produces telemetry about the session.
  6. The architecture re-evaluates access when policy or context requires it. A prior approval does not create permanent trust.

The policy engine and policy administrator together form the policy decision point. Implementations can combine these roles, but the logical distinction remains useful. Decision logic answers whether access is allowed. Administration turns that answer into a session that the PEP can enforce.

Signals behind a decision

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources