General Security Concepts · Topic 3 of 7
Zero Trust, Physical Security and Deception
Zero trust planes, physical security controls and sensors, and deception tools such as honeypots, honeynets, honeyfiles and honeytokens for Security+.
- 4 min
- Includes a diagram
- Zero trust means never trust, always verify, for users, devices and every request.
- The control plane decides, and the data plane carries traffic. The policy enforcement point sits on the data plane.
- The policy engine decides and the policy administrator carries out the decision.
What it is
Three ideas from the fundamentals objective sit together here.
Zero trust is a model that trusts no user or device by default. Physical security protects buildings, rooms and equipment. Deception and disruption technology sets traps to waste an attacker's time and reveal their methods.
How it works
Zero trust
Zero trust assumes a breach is possible anywhere, so every request is checked, even from inside the network. Trust is based on identity, device state and context, not on network location.
The model splits into two planes.
| Plane | Role | Parts |
|---|---|---|
| Control plane | Decides whether access is allowed | Adaptive identity, threat scope reduction, policy driven access control, policy administrator, policy engine |
| Data plane | Carries the allowed traffic | Implicit trust zones, subjects and systems, policy enforcement point |
The policy engine makes the decision, the policy administrator passes it on, and the policy enforcement point is the gate that lets traffic through or blocks it. Adaptive identity means the checks change with context, such as location or device health. Threat scope reduction limits how far an attacker can move.
Physical security
Physical controls keep unauthorized people away from equipment.
| Control | Purpose |
|---|---|
| Bollards | Stop vehicles from reaching a building |
| Access control vestibule | Two doors in sequence so that only one person enters at a time (formerly called a mantrap) |
| Fencing and gates | Mark and restrict the boundary |
| Video surveillance | Deters and records activity |
| Security guard | Checks identity and responds |
| Access badge | Proves who may enter |
| Lighting | Deters and helps cameras |
| Sensors | Detect movement, heat, pressure or sound |
Sensors in the objectives are infrared, pressure, microwave and ultrasonic. Each detects a different kind of change in the area, so a question usually describes the physical signal and asks which sensor fits.
Deception and disruption technology
These tools are decoys. No legitimate user should touch them, so any contact is suspicious.
| Tool | What it is |
|---|---|
| Honeypot | A fake system that looks like a real target |
| Honeynet | A network of honeypots |
| Honeyfile | A fake file that triggers an alert when opened |
| Honeytoken | Fake data, such as a credential or record, that alerts when used |
The aim is early detection and learning how attackers behave. A honeypot should be isolated so that it cannot be used to reach real systems.
What to remember for the exam
- Zero trust means never trust, always verify, for users, devices and every request.
- The control plane decides, and the data plane carries traffic. The policy enforcement point sits on the data plane.
- The policy engine decides and the policy administrator carries out the decision.
- An access control vestibule lets one person through at a time and helps stop tailgating.
- Bollards stop vehicles. Fences and gates control the boundary.
- Honeypots, honeynets, honeyfiles and honeytokens are all deception tools.
- Any access to a decoy is suspicious, because no legitimate user has a reason to touch it.
- Physical access can defeat technical controls: a stolen server exposes its data if the disk is not encrypted.
If a question says "a document that sends an alert when opened" or "a fake credential left in a database", the answer is a honeyfile or honeytoken, not a honeypot.
Common mistakes
Believing zero trust means no trust is ever granted. Access is granted, but only after each request is checked against policy and context, and only for the resource needed.
Assuming the internal network is safe. Traditional models trusted the inside. Zero trust removes that assumption.
Confusing the two planes. The control plane makes decisions. The data plane moves the traffic that the decisions permit.
Mixing up a honeypot with a honeyfile. A honeypot is a whole fake system. A honeyfile or honeytoken is a single piece of bait.
Forgetting tailgating. A badge reader does not stop a second person from following through the door. An access control vestibule or a guard does.
Deception tools are not a replacement for real controls. A honeypot connected carelessly to the production network can become a path for an attacker.
Check yourself
Which component of a zero trust design allows or blocks the traffic?
The policy enforcement point, which acts on the decision made by the policy engine.
What device lets only one person pass at a time to prevent tailgating?
An access control vestibule.
A fake database record exists only to trigger an alert when someone uses it. What is it?
A honeytoken, a form of deception technology.
Topic 3 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-701 question bank has 848 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.