Security Concepts · Topic 6 of 7
Security Intelligence, Zero Trust and Defense in Depth
Learn how security intelligence is authored, shared and consumed, the principles of zero trust architecture, and defense in depth with Cisco SAFE.
- 4 min
- Includes a diagram
- Security intelligence has three stages: authoring, sharing and consumption.
- STIX describes threat data. TAXII transports it.
- IOCs include hashes, IP addresses, domains and URLs.
What it is
This page covers three ideas that shape security design: threat intelligence, zero trust and layered defence.
Security intelligence is knowledge about threats that you can act on. Zero trust removes the idea of a trusted internal network. Defense in depth uses several layers, so one failure does not mean a breach.
How it works
The three ideas support each other, because each control is stronger with good intelligence and tight access.
Authoring, sharing and consumption
Authoring is creating intelligence. Research teams such as Cisco Talos analyse malware, spam and attacks, and then produce detections, signatures and reputation data. An organisation can also author its own, such as a custom Snort rule or its own list of bad domains.
Sharing uses standard formats so tools can exchange data. STIX is the language that describes threat information, and TAXII is the transport protocol used to exchange it. Intelligence is made of indicators of compromise (IOCs), such as file hashes, IP addresses, domains and URLs.
Consumption is using the intelligence to act. A firewall blocks a malicious IP, a DNS service blocks a bad domain, and a SIEM raises an alert on a matching hash.
| Stage | Examples |
|---|---|
| Authoring | Talos research, custom detection rules, internal blocklists |
| Sharing | STIX and TAXII feeds, vendor and community exchanges |
| Consumption | Reputation based blocking, SIEM correlation, threat hunting |
Cisco Secure Firewall can ingest third party indicators through its Threat Intelligence Director feature, which accepts STIX over TAXII and publishes them to sensors. Intelligence ages quickly, so confidence and expiry matter.
Zero trust architecture
Zero trust assumes the network is hostile, and says never trust, always verify. Every request is checked using identity, device health and context, whether the user is inside or outside.
The core principles are:
- Verify explicitly: authenticate and authorise using all available signals.
- Least privilege: give only the access needed, for only as long as needed.
- Assume breach: segment the network and monitor everything.
NIST SP 800-207 describes the model with a policy decision point and policy enforcement points. The decision point judges the request and the enforcement point allows or blocks it.
Cisco describes zero trust across the workforce, the workload and the workplace. The workforce covers users and devices, the workload covers applications in data centres and clouds, and the workplace covers the network and its segmentation.
Defense in depth and SAFE
Defense in depth places several different controls in series. If an attacker passes the firewall, endpoint protection, segmentation and monitoring still stand in the way. Controls should be different in kind, so one weakness does not defeat them all.
Cisco SAFE (Secure Architecture for Everyone) is a design framework for this. It divides the network into places in the network, and groups security capabilities into secure domains.
| SAFE element | Items |
|---|---|
| Places in the network | Branch, campus, data centre, edge, WAN, cloud |
| Secure domains | Management, security intelligence, compliance, segmentation, threat defense, secure services |
A SAFE design lets you ask, for each place, whether every domain is covered. It also links to zero trust, since segmentation and compliance are domains that support least privilege.
What to remember for the exam
Six facts cover most questions on this topic.
- Security intelligence has three stages: authoring, sharing and consumption.
- STIX describes threat data. TAXII transports it.
- IOCs include hashes, IP addresses, domains and URLs.
- Zero trust means never trust and always verify, with least privilege and assumed breach.
- Defense in depth uses multiple different layers of control.
- SAFE organises places in the network and secure domains.
If an answer says trust internal traffic by default, it contradicts zero trust.
Common mistakes
These four mistakes appear often.
Mixing up STIX and TAXII. STIX is the format, and TAXII is how it is delivered.
Treating zero trust as one product. It is an architecture and strategy that uses many products.
Stacking identical controls. Defense in depth needs layers that fail in different ways.
Using stale intelligence. Old indicators cause false positives, so use expiry and confidence ratings.
Zero trust does not mean removing the perimeter firewall. It means the firewall is no longer the only trust decision.
Check yourself
Work through these three questions.
What is the difference between STIX and TAXII?
STIX is the format that describes threat information, and TAXII is the transport protocol used to exchange it.
What are the core principles of zero trust?
Verify explicitly, use least privilege and assume breach, so every request is checked and the network is segmented.
What two groupings does Cisco SAFE use?
Places in the network, such as branch, campus and cloud, and secure domains, such as segmentation and threat defense.
Topic 6 of 7 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.