Zero Trust

An employee connects to the corporate VPN from a cafe, and is now "inside the network". The internal wiki, the admin console and three databases are all reachable, because they were built when inside meant a desk in a building with a door. Nothing has verified that the laptop is patched, that the person holding it is the account owner, or that this account has any business reaching the admin console at all. One stolen credential, and the attacker is inside too — with exactly the same reach.

This track is about the model that replaces that assumption. Zero trust says the network location of a request is not evidence of anything, and every request is decided on its own: who the user is, whether their device meets a posture requirement, what they are asking for, and whether this identity is entitled to it right now. You will implement that decision rather than describe it, which is where it stops being a slogan — the policy takes identity and device signals as inputs, and the same user on a compliant laptop and on an unmanaged phone gets different answers to the same request.

The second half is what to do about the compromise that happens anyway. Micro-segmentation limits reach: instead of one flat internal network where any workload can talk to any other, each service can reach only the specific services it genuinely needs, so a foothold in one converts into a much smaller blast radius. The design work is unglamorous — you have to know what actually talks to what before you can forbid the rest, and the honest starting point is usually that nobody does. The track has you derive the segmentation from real communication patterns and then check what an attacker who lands in one segment can still reach, which is the number that matters.