Security+ — Part 2: Zero Trust, Physical Security & Deception Technologies
Welcome Back!
Zero Trust is one of those terms that gets thrown around a lot, but the actual model behind it is straightforward and worth understanding properly. It changes the assumption from “trust everything inside the network” to “verify everything, always.” That shift has real implications for how networks are designed and how access is managed.
This is Part 2 of the Security+ series. The full notes are on GitHub.
Zero Trust Architecture (ZTA)
Zero Trust is built on one principle: never trust, always verify.
The old perimeter model assumed that anything inside the network was safe. Zero Trust assumes the opposite — that breach is inevitable, and every request needs to be verified regardless of where it comes from.
Key Tenets
- Continuous verification — authenticate and authorize every session, not just at login
- Least privilege access — grant only what’s absolutely needed for the task
- Microsegmentation — divide networks into isolated zones so a breach in one doesn’t spread
- Assume breach — design systems as if compromise has already happened
Core Components
- Identity verification (MFA, IAM)
- Network segmentation (VLANs, firewalls)
- Endpoint monitoring (EDR)
- Policy enforcement (ABAC, RBAC)
Zero Trust isn’t a product you buy — it’s a design philosophy. You implement it through the combination of tools and policies above.
Physical Security
Digital security controls only go so far. Physical access to hardware can bypass almost everything else. Security architecture has to account for physical layers too.
| Layer | Description | Examples |
|---|---|---|
| Perimeter | Outside boundary | Fences, lighting, gates |
| Exterior | Entry points to buildings | Doors, locks, badge readers |
| Internal | Inner rooms/zones | Secure server rooms, mantraps |
| Personnel Security | Human-centered policies | ID badges, guards, visitor logs |
Control Types
- Deterrent — warning signs, cameras (discourage attempts)
- Preventive — locks, mantraps (stop access)
- Detective — CCTV, alarms (identify when something happens)
- Compensating — extra guards when primary controls fail
Layering these is the point. No single control is enough on its own.
Deception and Disruption Technologies
Deception technologies flip the script — instead of just defending, you create traps that alert you when someone is poking around where they shouldn’t be.
| Tool | Purpose |
|---|---|
| Honeypots | Simulated vulnerable systems to lure attackers |
| Honeynets | Networks of honeypots |
| Tarpits | Slow attackers down by responding very slowly |
| Fake credentials | Detect exfiltration or credential misuse |
The key benefit is early detection. An attacker interacting with a honeypot has no idea they’ve already been flagged. You get telemetry on their behavior without them touching anything real.
For a real-world example of network monitoring and detection, check out the Snort IDS series — the same principles around detection and network visibility apply there.
Part 3 covers encryption and public key infrastructure
Stay Curious!