Authentication & Access · Study deck
Never Trust, Always Verify
To replace the vague idea of an “inside” network with a testable decision, inspect @fig-pc-ztf-request-loop and identify the subject, resource, and narrow action before considering the result.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: NIST SP 800-207 sets out a set of tenets that describe what a zero trust architecture should hold true, and a small set of logical components that make the access decision.
- Explain: Zero trust becomes concrete when you treat every access as a small decision: who or what is asking, for which resource, in what state, and should it be allowed this time.
- Explain: At this depth, zero trust is a discipline of decisions: verify each request, decide with real signals, grant the least access, contain the blast radius, and keep evidence of every choice.
Major section
Build One Access Decision
Zero trust becomes concrete when you treat every access as a small decision: who or what is asking, for which resource, in what state, and should it be allowed this time.
- The goal is to replace standing, network-wide trust with a deliberate decision that is made fresh for each request and recorded as evidence.
Major section
Build One Access Decision (continued)
The Signals a Decision Should Use A zero trust policy decision combines several signals rather than relying on one.
- For IoT, the most useful signals are identity, device posture, context, and the sensitivity of the resource being requested.
- A strong, per-device credential that is hard to clone or share.
- Proof: every change logged, every grant audited.
Major section
Build One Access Decision (continued)
Worked Reasoning: Three Requesters, One Method Publish-only sensor Need: send readings to one topic.
- No health check; any device that authenticates is trusted fully.
- Least Privilege and Containment Two practitioner moves do most of the work.
- If you can turn a request into a scoped, recorded decision, you can stop here.
Major section
Make the Decision Hard to Bypass
The deeper layer explains why per-request verification needs structure.
- NIST SP 800-207 sets out a set of tenets that describe what a zero trust architecture should hold true, and a small set of logical components that make the access decision.
- Understanding both helps you see where a design only looks like zero trust.
Major section
Make the Decision Hard to Bypass (continued)
The Decision Components The architecture separates the decision from the enforcement.
- A policy administrator carries out that decision by setting up or tearing down the connection.
- A policy enforcement point sits in the data path in front of the resource and actually permits or blocks the request.
- Mechanism That Makes It Real.
Major section
Make the Decision Hard to Bypass (continued)
Together the policy engine and administrator form the decision point, while the enforcement point is the gate that the request must pass through.
- Proof: it must guard every path to the resource — one unguarded route defeats the model.
- A map of all routes showing each is guarded.
- Credential grants reviewed against actual need.
Major section
Make the Decision Hard to Bypass (continued)
A policy engine makes the allow-or-deny decision using the signals and rules.
- Over-broad roles that grant far more than the task needs.
- Bounded sessions that expire and are re-evaluated.
- Segmentation that limits the blast radius.
- Tests showing one foothold cannot reach sensitive resources.
Major section
Make the Decision Hard to Bypass (continued)
A flat network where any device can reach any other.
- Decisions that use posture and context, not location.
- Logged signals behind each allow or deny.
- At this depth, zero trust is a discipline of decisions: verify each request, decide with real signals, grant the least access, contain the blast radius, and keep evidence of every choice.
Deck summary
Key takeaways
Zero trust becomes concrete when you treat every access as a small decision: who or what is asking, for which resource, in what state, and should it be allowed this time.
- The Signals a Decision Should Use A zero trust policy decision combines several signals rather than relying on one.
- Worked Reasoning: Three Requesters, One Method Publish-only sensor Need: send readings to one topic.
- The deeper layer explains why per-request verification needs structure.
- The Decision Components The architecture separates the decision from the enforcement.
Retrieval practice
Recall check 1 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q1An attacker compromises one IoT camera and is then able to reach a building controller and a database, because everything on the internal network is trusted. Which idea would have most limited this?
Show answer
Answer: B Removing implicit network trust and scoping access per resource limits what a single foothold can reach.
Retrieval practice
Recall check 2 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q2A gateway only needs to forward sensor readings to one cloud endpoint. Which access grant best follows zero trust?
Show answer
Answer: C Least privilege plus a recorded, scoped session keeps the blast radius small if the gateway is compromised.
Retrieval practice
Recall check 3 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q3A team builds per-request verification for most traffic, but leaves a legacy maintenance port that lets devices reach each other directly without passing the enforcement point. Why does this undermine zero trust, and what is the fix?
Show answer
Answer: D A single unguarded route defeats per-request verification, so every path must pass through enforcement.
Print reference
Answers
Answer key.
- B · Removing implicit network trust and scoping access per resource limits what a single foothold can reach.
- C · Least privilege plus a recorded, scoped session keeps the blast radius small if the gateway is compromised.
- D · A single unguarded route defeats per-request verification, so every path must pass through enforcement.