Zero Trust, Microsegmentation, and Ransomware Risk Reduction
What this domain tests
Zero Trust principles applied concretely: deny-by-default east-west control, least privilege, and reducing ransomware blast radius.
Core concepts
- Zero Trust: no implicit trust from network location. Identity and policy decide access, and every flow is verified.
- Assume breach: design as if an attacker is already inside; the goal is to limit how far they move.
- Microsegmentation granularity: environment → application → tier → individual workload (ringfence). Finer granularity means smaller blast radius but more policy to maintain.
- Ransomware kill chain: initial access, credential theft, discovery and lateral movement (SMB 445, RDP 3389, WMI), then encryption. Segmentation breaks the lateral-movement stage, which is where the damage multiplies.
- Crown-jewel protection: databases, domain controllers, and backup infrastructure get the tightest rules and are never reachable from user subnets.
Worked example
A laptop on the corporate network is infected. Without segmentation it can reach file shares and a database subnet, encrypting backups and spreading. With Illumio policy, the endpoint's environment label permits only its app tier; SMB to the database is denied by default. The infection stays on one host. The analyst ringfences it, rebuilds, and reviews Insights for any connection attempts that succeeded before enforcement.
Traps
- Equating microsegmentation with VLANs or firewall zones; those are coarse and IP-bound.
- Assuming "internal" traffic is trustworthy.
- Writing broad allow rules inside production that recreate a flat network.
- Thinking segmentation replaces EDR or backups; the exam frames it as a complementary containment layer.