CSA CCZT flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Policy Engine

The component in a Zero Trust Architecture that evaluates access requests against policy and trust signals and produces a decision (grant, deny, or revoke).

Policy Administrator

Component that establishes or terminates the connection between subject and resource based on the Policy Engine's decision; together with the PE it forms the PDP.

Policy Enforcement Point

The component that actually enables, monitors, and terminates connections between a subject and a resource, enforcing the PDP's decision.

Trust algorithm

The method a Policy Engine uses to compute an access decision, either criteria-based (matching rules) or score-based (weighted trust signals).

NIST SP 800-207

The foundational NIST publication defining Zero Trust Architecture principles, the PE/PA/PEP model, trust algorithms, and deployment variants.

Enhanced identity governance

A NIST ZT deployment variant where identity and access management, plus strong authentication, are the primary policy enforcement mechanisms.

Micro-segmentation

A ZT deployment variant that divides the network into fine-grained zones, each with its own policy, limiting east-west movement.

Single Packet Authorization

A pre-authentication technique where a client sends one cryptographically signed packet; the gateway drops all other traffic until it verifies that packet.

SDP controller

The control-plane component of a Software Defined Perimeter that authenticates clients and devices and authorizes connections to gateways.

SDP gateway

The data-plane component of a Software Defined Perimeter that proxies authorized traffic to protected resources and hides their addresses.

Dark network

A network state in which protected resources are non-discoverable and do not respond to unauthenticated probes, achieved via SPA and gateways.

ZTNA

Zero Trust Network Access: a product category that grants per-application access based on identity and context rather than broad network-level access.

Protect surface

The set of data, applications, assets, and services (DAAS) that a Zero Trust strategy must protect, ranked by business criticality.

CISA ZTMM tiers

CISA's four maturity levels - Traditional, Initial, Advanced, Optimal - used to assess and communicate Zero Trust progress across pillars.

CISA ZTMM pillars

Identity, Devices, Networks, Applications/Workloads, Data, plus cross-cutting Visibility/Analytics, Automation/Orchestration, and Governance.

Assume breach

A Zero Trust tenet: design controls as if adversaries are already inside the environment, minimizing blast radius and maximizing detection.

Verify explicitly

A Zero Trust tenet requiring every access request to be authenticated and authorized using all available identity, device, and contextual signals.

Least privilege

Granting subjects only the minimum access needed for a task, for the shortest time necessary, and revoking it when no longer needed.

Implicit trust

Trust granted solely because a request originates from inside a network perimeter; Zero Trust eliminates this assumption.

Just-in-time access

Granting elevated or sensitive access only for a limited window upon request and approval, then automatically revoking it.

Device posture

The assessed security state of an endpoint - patch level, encryption, EDR presence - used as a condition in access decisions.

Continuous verification

Re-evaluating trust signals throughout a session, not just at login, so access can be revoked when conditions degrade.

Phishing-resistant MFA

Authenticators such as FIDO2 security keys or passkeys that bind authentication to the origin and resist credential phishing.

East-west traffic

Traffic between workloads inside the data center; Zero Trust requires it to be authenticated and authorized, not implicitly trusted.

Identity as perimeter

The concept that access control centers on verified identity rather than network location, replacing the traditional network boundary.

Business process mapping

Linking Zero Trust controls to specific business workflows and their DAAS so security investment maps to business outcomes.

Phased ZT roadmap

A staged plan: inventory DAAS, deploy identity and MFA quick wins, then segmentation and SDP, then continuous monitoring and automation.

PEP reuse

A planning practice of leveraging existing enforcement points such as VPNs, proxies, and API gateways instead of replacing them wholesale.

DAAS inventory

A catalogue of data, applications, assets, and services with owners and sensitivity ratings; the prerequisite for Zero Trust planning.

NIST SP 800-207A

NIST guidance extending Zero Trust to cloud-native and multi-cloud environments, emphasizing micro-segmentation and service-to-service trust.

NIST CSF

A framework of Identify, Protect, Detect, Respond, Recover functions used alongside ZT guidance for program governance.

PDP

Policy Decision Point: the logical combination of the Policy Engine and Policy Administrator that decides and orchestrates access in a ZT architecture.