Authentication & Access · Study deck
Never Trust, Always Verify
To replace the vague idea of an “inside” network with a testable decision, inspect the diagram and identify the subject, resource, and narrow action before considering the result.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: NIST SP 800-207 sets out a set of tenets that describe what a zero trust architecture should hold true, and a small set of logical components that make the access decision.
- Explain: Zero trust becomes concrete when you treat every access as a small decision: who or what is asking, for which resource, in what state, and should it be allowed this time.
- Explain: Together the policy engine and administrator form the decision point, while the enforcement point is the gate that the request must pass through.
- Explain: Bounded sessions that expire and are re-evaluated.
Major section
Build One Access Decision
A strong, per-device credential that is hard to clone or share.
- Zero trust becomes concrete when you treat every access as a small decision: who or what is asking, for which resource, in what state, and should it be allowed this time.
- The goal is to replace standing, network-wide trust with a deliberate decision before each resource session and re-evaluate it when needed.
- No health check; any device that authenticates is trusted fully.
Major section
Build One Access Decision (continued)
The Signals a Decision Should UseA zero trust policy decision combines several signals rather than relying on one.
- For IoT, the most useful signals are identity, device posture, context, and the sensitivity of the resource being requested.
- Least Privilege and ContainmentTwo practitioner moves do most of the work.
- Proof: every change logged, every grant audited.
Major section
Make the Decision Hard to Bypass
A policy administrator carries out that decision by setting up or tearing down the connection.
- The deeper layer explains why per-request verification needs structure.
- Understanding both helps you see where a design only looks like zero trust.
- The Decision ComponentsThe architecture separates the decision from the enforcement.
- Mechanism That Makes It Real.
Major section
Make the Decision Hard to Bypass (continued)
A map of all routes showing each is guarded.
- NIST SP 800-207 sets out a set of tenets that describe what a zero trust architecture should hold true, and a small set of logical components that make the access decision.
- Credential grants reviewed against actual need.
- Bounded sessions that expire and are re-evaluated.
Major section
Make the Decision Hard to Bypass (continued)
Proof: it must guard every path to the resource — one unguarded route defeats the model.
- A policy enforcement point sits in the data path in front of the resource and actually permits or blocks the request.
- Over-broad roles that grant far more than the task needs.
- Segmentation that limits the blast radius.
Major section
Make the Decision Hard to Bypass (continued)
Together the policy engine and administrator form the decision point, while the enforcement point is the gate that the request must pass through.
- Tests showing one foothold cannot reach sensitive resources.
- A flat network where any device can reach any other.
- Decisions that use posture and context, not location.
Deck summary
Key takeaways
A strong, per-device credential that is hard to clone or share.
- The Signals a Decision Should UseA zero trust policy decision combines several signals rather than relying on one.
- A policy administrator carries out that decision by setting up or tearing down the connection.
- A map of all routes showing each is guarded.
- Proof: it must guard every path to the resource — one unguarded route defeats the model.
Retrieval practice
Recall check 1 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q1An attacker compromises one IoT camera and is then able to reach a building controller and a database, because everything on the internal network is trusted. Which idea would have most limited this?
Show answer
Answer: A Removing implicit network trust and scoping access per resource limits what a single foothold can reach.
Retrieval practice
Recall check 2 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q2A gateway only needs to forward sensor readings to one cloud endpoint. Which access grant best follows zero trust?
Show answer
Answer: C Least privilege plus a recorded, scoped session keeps the blast radius small if the gateway is compromised.
Retrieval practice
Recall check 3 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q3A team builds per-request verification for most traffic, but leaves a legacy maintenance port that lets devices reach each other directly without passing the enforcement point. Why does this undermine zero trust, and what is the fix?
Show answer
Answer: B A single unguarded route defeats per-request verification, so every path must pass through enforcement.
Print reference
Answers
Answer key.
- A · Removing implicit network trust and scoping access per resource limits what a single foothold can reach.
- C · Least privilege plus a recorded, scoped session keeps the blast radius small if the gateway is compromised.
- B · A single unguarded route defeats per-request verification, so every path must pass through enforcement.