An enterprise organization is replacing its legacy perimeter-based defenses with a Zero Trust Architecture (ZTA) across its internal API microservices. Currently, services authenticate once at session initiation and receive unrestricted inter-service communication permissions across the internal subnet. Which design change must the security team implement to adhere to core Zero Trust principles?
- Enforce dynamic continuous verification of identity, device posture, and context for every request, regardless of whether the traffic originates internally.Answer
- BGrant implicit trust to all internal subnet traffic after successful initial mutual TLS authentication at the edge gateway.
- CRequire multi-factor authentication during initial user login while allowing session authorization privileges to remain static for the remainder of the session.
- DDeploy internal honeypots to act as inline filtering mechanisms for preventing unauthorized inter-service microservice requests.
Answer
Enforce dynamic continuous verification of identity, device posture, and context for every request, regardless of whether the traffic originates internally.
The core tenets of Zero Trust Architecture (NIST SP 800-207) mandate explicit validation and continuous verification. Every access request must be authenticated, authorized, and encrypted based on real-time contextual data, identity, and device health, regardless of whether the request originates inside or outside the traditional network perimeter.
Step-by-Step Solution
Key Concept
Zero Trust Architecture Principles - Explicit Validation and Continuous Verification