Zero-Trust Policy Builder
Zero-Trust Policy Builder
Design Zero-Trust Security Policies
Learning Objectives
By playing this game, you will be able to:
- Design zero-trust network architectures balancing security, usability, and complexity
- Apply microsegmentation strategies to prevent lateral movement
- Implement identity-based access control with continuous verification
- Evaluate policy effectiveness through attack simulation
- Balance security requirements with operational practicality
- Understand context-aware policy enforcement (device health, location, behavior)
Zero Trust is a security model that assumes no one and nothing is trustworthy by default—even inside your network.
Think of it like airport security:
| Traditional Security | Zero Trust Security |
|---|---|
| Locked front door - Once inside, wander freely | ID check everywhere - Verify at every checkpoint |
| Trust everyone in the building | Trust no one automatically |
| A breach may spread if internal access is unrestricted | Scoped access can limit a breach |
In IoT, zero trust means: - Authenticate and authorize each resource session; reassess access as context changes - Devices can only access exactly what they need (not the whole network) - The system continuously monitors for suspicious behavior
Example: A smart camera can send video to storage, but cannot access employee computers or change building temperatures.
How to Play
Choose Difficulty Level:
- Easy: Basic office/retail scenarios (4 scenarios)
- Medium: Healthcare, smart city, campus networks (4 scenarios)
- Hard: Critical infrastructure, multi-tenant platforms (4 scenarios)
Read the Scenario: Understand the network environment, threats, and constraints
Design Your Policy: Select one option from each of four categories:
- Network Segmentation
- Identity & Authentication
- Access Control
- Continuous Verification
Deploy & Test: Compare your policy against illustrative threat-control checklists
Review Results: Check exercise score, policy recommendations, and residual risks
Learn & Iterate: Complete all scenarios to master zero-trust design
Zero-Trust Principles
Core Tenets
- Verify Explicitly: Always authenticate and authorize based on all available data points
- Use Least Privilege Access: Limit user/device access with just-in-time and just-enough-access (JIT/JEA)
- Assume Breach: Minimize blast radius and segment access, verify end-to-end encryption, use analytics to detect threats
Traditional vs Zero Trust
| Aspect | Traditional (Perimeter) | Zero Trust |
|---|---|---|
| Trust Model | Trust internal network | Never trust, always verify |
| Verification | Mainly at the perimeter | Resource sessions and changing context |
| Access Control | Network-based (IP/port) | Identity + context-based |
| Lateral Movement | Often unrestricted | Limited by enforced resource access rules |
| Default Posture | Allow unless denied | Deny unless explicitly allowed |
Policy Categories Explained
1. Network Segmentation
What it does: Divides the network into zones; enforced filtering between zones can limit lateral movement. VLANs alone do not enforce access policy.
| Strategy | Security | Complexity | When to Use |
|---|---|---|---|
| Flat Network | ★ | ★ | Never (legacy only) |
| VLAN Segmentation | ★★★ | ★★ | Small offices, low-risk |
| Microsegmentation | ★★★★ | ★★★ | Most enterprises |
| Zero-Trust Microseg | ★★★★★ | ★★★★ | Critical infrastructure, high-value targets |
IoT Example: In a smart building, HVAC sensors should not communicate with door locks, even though both are “IoT devices.”
2. Identity & Authentication
What it does: Validates evidence of identity; stolen credentials or compromised devices can still authenticate.
| Strategy | Security | Complexity | When to Use |
|---|---|---|---|
| No Auth | ★ | ★ | Never (insecure) |
| Password-Based | ★★ | ★★ | Consumer IoT (with strong passwords) |
| Certificate-Based | ★★★★ | ★★★ | Enterprise IoT, managed devices |
| Continuous Auth | ★★★★★ | ★★★★ | High-security environments |
IoT Example: Managed sensors can use X.509 credentials with protected private keys, certificate validation, rotation and revocation. Certificates need lifecycle management, not permanent unchangeable provisioning.
3. Access Control
What it does: Determines what authenticated identities can access.
| Strategy | Security | Complexity | When to Use |
|---|---|---|---|
| Implicit Trust | ★ | ★ | Never (violates zero-trust) |
| RBAC | ★★★ | ★★ | Stable roles (admin, employee) |
| ABAC | ★★★★ | ★★★ | Dynamic policies (location, time) |
| Least Privilege + JIT | ★★★★★ | ★★★★ | Critical systems, privileged access |
IoT Example: Temperature sensor can write to time-series database but cannot read historical data or access configuration APIs.
4. Continuous Verification
What it does: Re-checks trust continuously, not just at initial connection.
| Strategy | Security | Complexity | When to Use |
|---|---|---|---|
| Trust Once | ★ | ★ | No reassessment after access is granted |
| Periodic Re-auth | ★★★ | ★★ | Low-risk environments |
| Per-Request | ★★★★ | ★★★ | Financial, healthcare |
| Continuous Trust Scoring | ★★★★★ | ★★★★ | Critical infrastructure |
IoT Example: An unusual camera upload rate can trigger a policy reassessment. Detection thresholds, false positives, enforcement and response latency must be tested.
Scoring System
Each scenario awards up to 100 points, once: 50 for policy match (12.5 per exact recommendation), and 50 for the proportion of eligible threat-control checklists met. Adjacent menu positions earn no match credit. Allow All fails authorization checks. Residual risks are excluded from the denominator. All difficulties use the same scale. A perfect exercise score is not proof of security, usability or compliance.
Attack Types You’ll Defend Against
Easy Attacks
- Lateral Movement: Compromised IoT device tries to access other systems
- Credential Theft: Attacker steals device passwords/tokens
Medium Attacks
- IoT Botnet Infection: Malware spreads across IoT devices
- Insider Threat: Authorized user abuses access privileges
Hard Attacks
- Supply Chain Compromise: Malicious firmware in new devices
- Zero-Day Exploit: Unknown vulnerability in IoT platform
Real-World Case Studies
Challenge: Employees working from anywhere need access to internal resources.
Zero-Trust Solution: - No VPN - Access based on device/user identity + context - Continuous verification of device health - Per-application access (not network-wide)
Results: Enabled remote work without sacrificing security. Access decisions are made at resource enforcement points; those points still need protection.
Attack: Hackers compromised HVAC vendor credentials, moved laterally to POS systems.
Failure: Stolen third-party credentials and insufficient access restrictions enabled progression toward payment systems.
Zero-Trust Prevention: Correctly enforced isolation can restrict vendor access to POS systems; segmentation alone cannot establish that a historical breach would have been prevented.
Attack: Malware exploited default passwords in cameras/DVRs, built massive botnet.
Failure: No strong device authentication, passwords rarely changed.
Zero-Trust Prevention: Remove default credentials, patch devices and restrict unnecessary access. Certificate identity and monitoring can support defense but do not guarantee prevention.
Summary
Zero-trust security is essential for IoT because:
- IoT devices often have weak security - Can’t rely on device protection alone
- Large attack surface - Many devices = many entry points
- Lateral movement is deadly - One compromised sensor shouldn’t compromise entire network
- Continuous monitoring needed - IoT devices run 24/7, threats evolve constantly
Key Takeaway: In zero-trust, location ≠ trust. Being “inside the network” grants no privileges. Every access must be verified based on identity, context, and risk.