Zero trust architecture explained: NIST SP 800-207 for Security+
Zero trust means no user or device is trusted because of where it sits on the network or who owns it. Every request to every resource is authenticated and authorized before access, per session. NIST SP 800-207 does this with a policy decision point (policy engine and policy administrator) and policy enforcement points placed as close to each resource as possible.
The core idea
NIST SP 800-207 says zero trust moves defenses from static, network-based perimeters to users, assets and resources. It assumes no implicit trust is granted to assets or accounts based only on their physical or network location, or on whether the enterprise owns them.
Two tenets carry most exam questions. Network location alone does not imply trust: requests from inside the enterprise network must meet the same security requirements as requests from any other network. And access is granted per session: authenticating and being authorized for one resource does not automatically grant access to a different one.
Other tenets: access is set by dynamic policy (identity, device state, behavior, environment), no asset is inherently trusted, authentication and authorization are re-evaluated continually, and least privilege applies to each request.
Components: PE, PA and PEP
The policy engine (PE) makes the decision to grant, deny or revoke access, using policy and inputs such as device monitoring and threat intelligence. The policy administrator (PA) carries out that decision by setting up or shutting down the path between subject and resource. Together they form the policy decision point (PDP).
The policy enforcement point (PEP) enables, monitors and ends the connection. It can be split into a client agent and a gateway in front of the resource.
Shrinking the implicit trust zone
The implicit trust zone is the area behind the last PDP/PEP where everything is trusted to that gateway's level. SP 800-207 says this zone must be as small as possible, and zero trust moves PDP/PEPs closer to the resource.
Example: a company that checked users only at its perimeter firewall, after which they could reach any server, moves those checks to gateways in front of each application. A user in the HR application must then pass a new check before opening the payroll database.
Where the exam catches people
Believing zero trust means internal traffic is trusted once inside the firewall: internal requests must meet the same requirements as external ones.
Believing one login grants access to everything: access is per session and per resource.
Believing zero trust is the same as defense in depth: defense in depth layers controls; zero trust removes trust based on network location and checks each request.
Believing the policy enforcement point makes the access decision: the policy engine decides, the policy administrator executes, and the PEP enforces.