Zero trust principles, least privilege, defense in depth, microsegmentation, SASE, secure design models and trust boundaries.
35 cards · basic cards · AI-written, checked twice. Edit anything.
- What is the zero trust security model?
Show answer
A security approach that requires verification of every access request, assumes no implicit trust, and validates all users and devices regardless of network location.- What does never trust, always verify mean?
Show answer
All access must be authenticated and authorized, even from inside the network perimeter, rather than trusting a connection based on its origin.- What is the assume breach mindset?
Show answer
Designing security systems on the assumption that a breach has already occurred, so internal and external threats are treated equally.- What is continuous verification in zero trust?
Show answer
Ongoing authentication and authorization checks throughout a user or device session, not just at initial login.- What is required for explicit authentication?
Show answer
Direct proof of identity using credentials, multifactor authentication, or cryptographic verification before any access is granted.- What is a trust boundary?
Show answer
A logical or physical boundary that separates trusted resources from untrusted ones, requiring verification to cross.- Define the principle of least privilege.
Show answer
Granting users and processes the minimum access rights and permissions needed to perform their specific job functions.- What is just-in-time access?
Show answer
Granting temporary elevated permissions for a specific duration only when needed, then automatically revoking them.- What is just-enough access?
Show answer
Limiting permissions to only the specific resources and actions required for a particular task or role.- How does least privilege prevent privilege escalation attacks?
Show answer
By limiting what a compromised account can access or do, attackers cannot easily elevate to higher permissions from a low-privileged account.- Why are regular access reviews important?
Show answer
To ensure permissions remain aligned with current job functions and to remove unnecessary or outdated access rights.- Define defense in depth.
Show answer
A layered security strategy using multiple independent controls and barriers to protect systems, so failure of one layer does not compromise the whole.- Name three layers commonly used in defense in depth.
Show answer
Perimeter security, network segmentation, endpoint protection, and application-level controls are common examples.- What is the main benefit of defense in depth?
Show answer
An attacker must breach multiple independent security controls to reach a critical asset, increasing the difficulty and time required to succeed.- Why are redundant controls important in defense in depth?
Show answer
If one control is bypassed or fails, other independent controls remain to protect the system.
FlashKeepers