General Security Concepts · Topic 2 of 7
Defense in Depth, Zero Trust and Least Privilege
Learn defense in depth, the core zero trust principles and least privilege, and how layered controls stop one failure from turning into a full breach.
- 5 min
- Defense in depth uses several different layers so that one failure does not expose the asset.
- Zero Trust means never trust, always verify, for every user, device and request.
- Under Zero Trust, being on the internal network does not grant access.
What it is
Defense in depth means protecting a system with several independent layers of controls. If one layer fails, the next one still stands between the attacker and the asset.
Zero Trust is a security model that gives no user, device or network location automatic trust. Every request is checked before access is granted.
Least privilege means each account, person or service gets only the access it needs to do its job, and nothing more. It is one of the main tools that both defense in depth and Zero Trust rely on.
How it works
Defense in depth
No single control is perfect. Passwords are stolen, filters miss messages and staff make mistakes, so controls are stacked so that each one covers gaps in the others.
| Layer | Example controls |
|---|---|
| Physical | Locked server room, badge readers |
| Network | Firewall, network segmentation |
| Endpoint | Patching, endpoint protection |
| Identity | Multifactor authentication (MFA), least privilege |
| Data | Encryption, backups |
| People and policy | Training, acceptable use policy |
The layers should be different in kind. Two firewalls from the same rule set are weaker than a firewall plus encryption plus monitoring, because one mistake can defeat both firewalls.
Zero Trust principles
Traditional networks trusted anything inside the perimeter. Once an attacker got in, they could often move freely. Zero Trust removes that assumption.
| Principle | What it means in practice |
|---|---|
| Never trust, always verify | Every request is authenticated and authorized, even from the internal network |
| Verify explicitly | Decisions use identity, device health, location and other context |
| Least privilege access | Grant only the access needed for the task, often for a limited time |
| Assume breach | Design as if an attacker is already inside, so limit how far they can move |
| Continuous monitoring | Keep checking sessions and devices, not only at sign in |
| Segmentation | Split the network into small zones so that one compromise stays contained |
Trust is decided per request and can change. A user on a healthy company laptop may get access, while the same user on an unknown device may be blocked or asked for more proof.
Least privilege
Least privilege limits the damage any single account can do. If a user with read only access is phished, the attacker cannot change or delete records.
Common ways to apply it:
- Give standard accounts for daily work and separate administrator accounts for admin tasks.
- Grant time limited access, so elevated rights expire when the job is done.
- Review permissions regularly to remove access that people no longer need.
- Give service accounts only the rights the application actually uses.
Permissions that build up as people change jobs are called privilege creep. Regular access reviews are the main fix.
How the three ideas connect
Defense in depth is the overall strategy of layering. Zero Trust is a way of designing those layers so that location never grants trust. Least privilege is a control that appears in both, because it limits what an attacker can reach after one layer fails.
How the exam asks about this
- "An attacker phished a password but still could not sign in because a second factor was required." -> Defense in depth, with MFA as a second layer.
- "Internal users must be verified for each application, even on the office network." -> Zero Trust.
- "A help desk employee still has payroll access from a previous role." -> Privilege creep, a least privilege failure fixed by an access review.
What to remember for the exam
- Defense in depth uses several different layers so that one failure does not expose the asset.
- Zero Trust means never trust, always verify, for every user, device and request.
- Under Zero Trust, being on the internal network does not grant access.
- Zero Trust uses identity, device health and context to decide access.
- Assume breach means designing to limit movement after an attacker gets in.
- Least privilege gives only the minimum access needed, for only as long as needed.
- Privilege creep is fixed with regular access reviews.
- Separate administrator accounts are a direct use of least privilege.
If a scenario stresses checking every request no matter where it comes from, the answer is Zero Trust. If it stresses stacking controls, the answer is defense in depth.
Common mistakes
Believing Zero Trust means no trust is ever granted. Access is granted, but only after each request is checked against policy and context, and only for the resource needed.
Assuming the internal network is safe. Traditional models trusted the inside. Zero Trust removes that assumption.
Stacking the same control twice. Defense in depth needs different kinds of layers, not copies of one layer.
Giving administrators admin rights for everything. Daily tasks such as email should use a standard account, so a phished session does not hand over admin rights.
Granting access forever. Rights that were needed for a project should be removed when the project ends.
Zero Trust is a model, not a single product. A vendor tool can help, but it does not make a network Zero Trust on its own.
Check yourself
What is the main idea of defense in depth?
Several independent layers of controls, so that if one fails, another still protects the asset.
Under Zero Trust, is a request from inside the corporate network trusted automatically?
No. Every request is verified using identity, device health and context, wherever it comes from.
What is privilege creep, and how is it fixed?
Access that builds up as a person changes roles. It is fixed with regular access reviews that remove rights no longer needed.
Topic 2 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.