Zero Trust Architecture (NIST Special Publication 800-207)¶
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust Architecture (NIST Special Publication 800-207).
Cited by¶
6 citations across 6 artifacts.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Eventual Realisation of Possibility
- Defensive doctrine assumes any vulnerability deployed at scale will eventually be found, which is why "assume breach" and blast-radius containment displace per-attempt prevention as the organising posture — catalogue the failure modes, require independent layers (defence-in-depth), and accept that perimeter prevention alone is a per-trial argument applied to a many-trial reality.
This sourceCodifies the 'assume breach' doctrine — treat the network as compromised and design for containment rather than perimeter prevention — the security analogue of designing for the certain eventual discovery of a deployed vulnerability.
Supported in partVerified against the work's full text
NIST SP 800-207 supports the assume-compromise stance and the shift from perimeter defence to limiting lateral movement, but not the 'vulnerabilities at scale are eventually found' premise.
“Zero trust security models assume that an attacker is present in the environment and that an enterprise-owned environment is no different—or no more trustworthy—than any nonenterprise-owned environment.”
- Defensive doctrine assumes any vulnerability deployed at scale will eventually be found, which is why "assume breach" and blast-radius containment displace per-attempt prevention as the organising posture — catalogue the failure modes, require independent layers (defence-in-depth), and accept that perimeter prevention alone is a per-trial argument applied to a many-trial reality.
- Principle of Least Privilege
- In network and zero-trust architecture, it appears as per-service credentials, micro-segmentation, and just-in-time privilege elevation.
This sourceDefines per-request access, micro-segmentation, and just-in-time least-privilege elevation.
Supported in partVerified against the work's full text
NIST SP 800-207 supports least-privilege per-session access and micro-segmentation in ZTA; it does not name per-service credentials or just-in-time privilege elevation.
“Access to individual enterprise resources is granted on a per-session basis. Trust in the requester is evaluated before the access is granted. Access should also be granted with the least privileges needed to complete the task.”
- In network and zero-trust architecture, it appears as per-service credentials, micro-segmentation, and just-in-time privilege elevation.
- Trusted Intermediary Compromise
- The insider-threat model from espionage ported into zero-trust corporate architectures that explicitly assume trusted-channel compromise is always possible.
This sourceFormalizes the zero-trust assumption that any channel or insider may be compromised, requiring per-request verification.
Supported in partVerified against the work's full text
NIST SP 800-207 grounds the zero-trust premise that an attacker or insider may already be inside, but says nothing of espionage origins or a port from that field.
“Zero trust security models assume that an attacker is present in the environment”
- The insider-threat model from espionage ported into zero-trust corporate architectures that explicitly assume trusted-channel compromise is always possible.
Domain-specific¶
- Fallacy of the Secure Network
- Network-Security Architecture
- Listed in the references but not attached to a specific claim.
Mechanisms¶
- Network Segmentation Policy
- Its strength is turning total loss into partial loss: it caps how far any one compromise travels, and each boundary an attacker must cross buys detection and response time on the way to what matters.
This sourceStates that zero-trust architecture aims to minimize or prevent lateral movement after a host is compromised.
- Its strength is turning total loss into partial loss: it caps how far any one compromise travels, and each boundary an attacker must cross buys detection and response time on the way to what matters.
Verification¶
Does it exist? Confirmed. This work's DOI resolves to a registered record, which fixes its identity. That is all it fixes.
Does it back the claim? Read against the text for 4 of 6 citations: 1 supported, 3 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:9f68d441461d · see in the full table