Zero-Trust Policy Builder

Design Zero-Trust Security Policies

Learning Objectives

By playing this game, you will be able to:

Design zero-trust network architectures balancing security, usability, and complexity
Apply microsegmentation strategies to prevent lateral movement
Implement identity-based access control with continuous verification
Evaluate policy effectiveness through attack simulation
Balance security requirements with operational practicality
Understand context-aware policy enforcement (device health, location, behavior)

For Beginners: What is Zero Trust?

Zero Trust is a security model that assumes no one and nothing is trustworthy by default—even inside your network.

Think of it like airport security:

Traditional Security	Zero Trust Security
Locked front door - Once inside, wander freely	ID check everywhere - Verify at every checkpoint
Trust everyone in the building	Trust no one automatically
One breach = entire building compromised	Breach contained to one area

In IoT, zero trust means: - Every device must prove its identity every time it wants to do something - Devices can only access exactly what they need (not the whole network) - The system continuously monitors for suspicious behavior

Example: A smart camera can send video to storage, but cannot access employee computers or change building temperatures.

How to Play

Choose Difficulty Level:
- Easy: Basic office/retail scenarios (4 scenarios)
- Medium: Healthcare, smart city, campus networks (4 scenarios)
- Hard: Critical infrastructure, multi-tenant platforms (4 scenarios)
Read the Scenario: Understand the network environment, threats, and constraints
Design Your Policy: Select one option from each of four categories:
- Network Segmentation
- Identity & Authentication
- Access Control
- Continuous Verification
Deploy & Test: See how your policy performs against real attacks
Review Results: Check security score, usability impact, and which attacks were blocked
Learn & Iterate: Complete all scenarios to master zero-trust design

Zero-Trust Principles

Core Tenets

Three Pillars of Zero Trust

Verify Explicitly: Always authenticate and authorize based on all available data points
Use Least Privilege Access: Limit user/device access with just-in-time and just-enough-access (JIT/JEA)
Assume Breach: Minimize blast radius and segment access, verify end-to-end encryption, use analytics to detect threats

Traditional vs Zero Trust

Aspect	Traditional (Perimeter)	Zero Trust
Trust Model	Trust internal network	Never trust, always verify
Verification	At perimeter only	Every transaction
Access Control	Network-based (IP/port)	Identity + context-based
Lateral Movement	Often unrestricted	Blocked by microsegmentation
Default Posture	Allow unless denied	Deny unless explicitly allowed

Policy Categories Explained

1. Network Segmentation

What it does: Divides network into isolated zones to prevent attackers from moving laterally.

Strategy	Security	Complexity	When to Use
Flat Network	⭐	⭐	Never (legacy only)
VLAN Segmentation	⭐⭐⭐	⭐⭐	Small offices, low-risk
Microsegmentation	⭐⭐⭐⭐	⭐⭐⭐	Most enterprises
Zero-Trust Microseg	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	Critical infrastructure, high-value targets

IoT Example: In a smart building, HVAC sensors should not communicate with door locks, even though both are “IoT devices.”

2. Identity & Authentication

What it does: Proves a device/user is who they claim to be.

Strategy	Security	Complexity	When to Use
No Auth	⭐	⭐	Never (insecure)
Password-Based	⭐⭐	⭐⭐	Consumer IoT (with strong passwords)
Certificate-Based	⭐⭐⭐⭐	⭐⭐⭐	Enterprise IoT, managed devices
Continuous Auth	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	High-security environments

IoT Example: Industrial sensors should use X.509 certificates burned into hardware (not changeable passwords).

3. Access Control

What it does: Determines what authenticated identities can access.

Strategy	Security	Complexity	When to Use
Implicit Trust	⭐	⭐	Never (violates zero-trust)
RBAC	⭐⭐⭐	⭐⭐	Stable roles (admin, employee)
ABAC	⭐⭐⭐⭐	⭐⭐⭐	Dynamic policies (location, time)
Least Privilege + JIT	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	Critical systems, privileged access

IoT Example: Temperature sensor can write to time-series database but cannot read historical data or access configuration APIs.

4. Continuous Verification

What it does: Re-checks trust continuously, not just at initial connection.

Strategy	Security	Complexity	When to Use
Trust Once	⭐	⭐	Never (allows long-term compromise)
Periodic Re-auth	⭐⭐⭐	⭐⭐	Low-risk environments
Per-Request	⭐⭐⭐⭐	⭐⭐⭐	Financial, healthcare
Continuous Trust Scoring	⭐⭐⭐⭐⭐	⭐⭐⭐⭐	Critical infrastructure

IoT Example: If a smart camera’s behavior suddenly changes (uploading 10x normal data), continuous scoring detects and blocks it.

Scoring System

Your score is based on:

Attack Defense Rate (50%): How many attacks your policy blocked
Optimal Policy Match (20%): Alignment with recommended best practices
Security-Usability Balance (20%): Avoiding extreme tradeoffs
Difficulty Multiplier (10%): Easy 1x, Medium 1.5x, Hard 2x

Perfect Score: High security + reasonable usability + blocks all attacks

Attack Types You’ll Defend Against

Easy Attacks

Lateral Movement: Compromised IoT device tries to access other systems
Credential Theft: Attacker steals device passwords/tokens

Medium Attacks

IoT Botnet Infection: Malware spreads across IoT devices
Insider Threat: Authorized user abuses access privileges

Hard Attacks

Supply Chain Compromise: Malicious firmware in new devices
Zero-Day Exploit: Unknown vulnerability in IoT platform

Real-World Case Studies

Google BeyondCorp - Zero Trust for Corporate Network

Challenge: Employees working from anywhere need access to internal resources.

Zero-Trust Solution: - No VPN - Access based on device/user identity + context - Continuous verification of device health - Per-application access (not network-wide)

Results: Enabled remote work without sacrificing security. No perimeter to breach.

Target Data Breach (2013) - Lack of Segmentation

Attack: Hackers compromised HVAC vendor credentials, moved laterally to POS systems.

Failure: Flat network allowed HVAC systems to access payment card data.

Zero-Trust Prevention: Microsegmentation would have blocked lateral movement from HVAC to POS network.

Mirai Botnet (2016) - IoT Identity Weakness

Attack: Malware exploited default passwords in cameras/DVRs, built massive botnet.

Failure: No strong device authentication, passwords rarely changed.

Zero-Trust Prevention: Certificate-based identity + continuous verification would prevent compromise propagation.

Summary

Zero-trust security is essential for IoT because:

IoT devices often have weak security - Can’t rely on device protection alone
Large attack surface - Many devices = many entry points
Lateral movement is deadly - One compromised sensor shouldn’t compromise entire network
Continuous monitoring needed - IoT devices run 24/7, threats evolve constantly

Key Takeaway: In zero-trust, location ≠ trust. Being “inside the network” grants no privileges. Every access must be verified based on identity, context, and risk.

Interactive Game