{
 "slug": "illusion-zero-trust-network-microsegmentation-fails-against",
 "topic_id": "TOPIC-034",
 "cluster": "Privileged Identity & Help-Desk Takeover",
 "tier": "Tier B",
 "title": "Zero Trust verifies the connection, not the command",
 "summary": "Microsegmentation and continuous verification decide who may reach what. Inside an authorised connection, an attacker using valid credentials does exactly what the policy permits.",
 "lede": "Ransomware moves through a fully microsegmented network using domain credentials it stole. Every connection is policy-compliant. Every authentication succeeds. The architecture worked as designed, and the design does not cover this.",
 "date": "2024-12-14",
 "category": "Developer",
 "author_id": "margot-reyes",
 "tags": [
  "zero trust",
  "microsegmentation",
  "lateral movement",
  "credential abuse",
  "ZTNA",
  "architecture"
 ],
 "image_title": "Zero Trust Connection Not Command",
 "schema": "Article",
 "key_takeaways": [
  "Zero Trust replaced implicit network trust with explicit per-connection verification. The unit of verification is still a connection.",
  "An attacker with valid credentials satisfies every connection-time check, because the checks are about identity and posture rather than intent.",
  "Extending verification to the action — requiring a fresh, bound proof for irreversible commands — covers the gap the connection model leaves."
 ],
 "body": [
  {
   "type": "h2",
   "text": "What Zero Trust actually replaced"
  },
  {
   "type": "diagram",
   "kind": "flow",
   "alt": "Every connection-time check passes",
   "caption": "The controls evaluate the right things about the wrong subject.",
   "nodes": [
    {
     "label": "Identity authenticated",
     "note": "a real account",
     "bad": true
    },
    {
     "label": "Device posture compliant",
     "note": "the victim's managed device",
     "bad": true
    },
    {
     "label": "Authorisation policy evaluated",
     "note": "access the account has",
     "bad": true
    },
    {
     "label": "Continuous re-evaluation",
     "note": "signals stay clean",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "The old model granted trust by network position: inside the perimeter meant trusted. Zero Trust removed that assumption and required every connection to be authenticated, authorised and evaluated against device posture."
  },
  {
   "type": "p",
   "html": "This was a substantial improvement and should not be undersold. Flat networks where a single foothold reached everything are genuinely worse."
  },
  {
   "type": "p",
   "html": "But look carefully at what changed. The unit of verification moved from the network segment to the connection. It did not move to the action."
  },
  {
   "type": "h2",
   "text": "The attacker's view"
  },
  {
   "type": "table",
   "head": [
    "Check at connection time",
    "What an attacker with valid credentials presents"
   ],
   "rows": [
    [
     "Identity authenticated",
     "A real account, authenticated normally or via a stolen session"
    ],
    [
     "Device posture compliant",
     "The victim's managed device, fully compliant"
    ],
    [
     "Authorisation policy evaluated",
     "Access the account genuinely has"
    ],
    [
     "Location and risk signals",
     "The victim's network and typical geography"
    ],
    [
     "Continuous re-evaluation",
     "Nothing changes — the signals stay clean"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Every row passes. Not because the controls are weak, but because they are evaluating the right things about the wrong subject. The connection is legitimate; the intent behind it is not, and intent is not a connection property."
  },
  {
   "type": "h2",
   "text": "Why lateral movement still works"
  },
  {
   "type": "p",
   "html": "Microsegmentation limits which systems an identity can reach. Administrative and service identities, by function, need to reach many systems."
  },
  {
   "type": "p",
   "html": "So segmentation constrains the compromise of a marketing analyst's account effectively, and constrains the compromise of a domain administrator's account hardly at all. The identities worth stealing are the ones whose legitimate scope is broad."
  },
  {
   "type": "p",
   "html": "Tightening those scopes is worthwhile and has a floor: an administrator who cannot administer is not an administrator."
  },
  {
   "type": "h2",
   "text": "Moving verification to the action"
  },
  {
   "type": "p",
   "html": "The extension is straightforward to state. For a defined set of irreversible operations, the connection's authority is insufficient; the operation requires a fresh proof bound to what it will do."
  },
  {
   "type": "code",
   "text": "# Connection-time (existing Zero Trust)\n  identity ✓  device ✓  policy ✓  → connection established\n\n# Action-time (the extension)\n  operation: \"encrypt_volume\" | \"delete_backup\" | \"disable_logging\"\n    → requires assertion over the rendered operation\n    → fresh (< 2 min), user-verified, bound to this instance\n    → absent or mismatched: refused\n\n# Ransomware holding valid domain credentials\n#   passes every connection-time check\n#   cannot produce the assertion\n#   is stopped at the operation that matters"
  },
  {
   "type": "p",
   "html": "The gated set is small and consistent across environments: backup deletion, retention changes, logging and telemetry disablement, mass encryption or permission rewrites, credential creation."
  },
  {
   "type": "h2",
   "text": "Why these operations specifically"
  },
  {
   "type": "p",
   "html": "They are the prerequisites for the damage rather than the damage itself. Ransomware deletes backups before encrypting, disables logging before moving, and creates persistence credentials early."
  },
  {
   "type": "p",
   "html": "Gating the prerequisites is more effective than trying to gate every write, and it is tractable: there are perhaps a dozen such operations in a typical estate."
  },
  {
   "type": "h2",
   "text": "What this is not"
  },
  {
   "type": "p",
   "html": "It is not a replacement for Zero Trust architecture. Connection-time verification, segmentation and posture checks all remain necessary; removing them would be a straightforward regression."
  },
  {
   "type": "p",
   "html": "It is also not a claim that action-time verification stops everything. An attacker present on an endpoint at the moment a legitimate user approves an operation can obtain that one action. That is a much harder attack with a much smaller yield than holding credentials that authorise thousands."
  },
  {
   "type": "h2",
   "text": "A sequencing note"
  },
  {
   "type": "p",
   "html": "Organisations often approach this in the wrong order — pursuing exhaustive microsegmentation for years before considering action-level controls."
  },
  {
   "type": "p",
   "html": "The inverse tends to deliver more. Gating a dozen operations is weeks of work and blunts the most damaging attack patterns. Segmentation is a multi-year programme whose benefit accrues gradually and which, for administrative identities, has a low ceiling."
  },
  {
   "type": "h2",
   "text": "The dozen operations worth gating"
  },
  {
   "type": "p",
   "html": "Ransomware deletes backups before encrypting, disables logging before moving, and creates persistence credentials early. Gating the prerequisites is more effective than gating every write, and it is tractable."
  },
  {
   "type": "table",
   "caption": "The prerequisite set",
   "head": [
    "Operation",
    "Why it is a prerequisite"
   ],
   "rows": [
    [
     "Backup deletion",
     "Removes recovery"
    ],
    [
     "Retention configuration change",
     "Removes recovery, quietly"
    ],
    [
     "Logging or telemetry disablement",
     "Removes detection"
    ],
    [
     "Mass encryption or permission rewrite",
     "The damage itself"
    ],
    [
     "Credential creation",
     "Persistence"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Is Zero Trust a failed model?”</strong> No. Removing implicit network trust was a large and real improvement. Its unit of verification is the connection, and some attacks operate entirely inside authorised connections."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Should we stop investing in segmentation?”</strong> No, but consider sequencing. Gating a dozen operations takes weeks; comprehensive segmentation takes years and has a low ceiling for privileged identities, which are the ones worth stealing."
  }
 ],
 "faq": [
  {
   "q": "Is Zero Trust a failed model?",
   "a": "No. It removed implicit network trust, which was a real and large improvement. Its unit of verification is the connection, and some attacks operate entirely inside authorised connections."
  },
  {
   "q": "Why doesn't microsegmentation stop lateral movement?",
   "a": "It constrains identities with narrow legitimate scope. Administrative and service identities need broad reach by function, and those are the identities attackers target."
  },
  {
   "q": "How many operations need action-time verification?",
   "a": "Typically around a dozen: backup deletion, retention and logging changes, mass encryption or permission rewrites, credential creation."
  },
  {
   "q": "Should we stop investing in segmentation?",
   "a": "No, but consider sequencing. Gating a dozen operations takes weeks; comprehensive segmentation takes years and has a low ceiling for privileged identities."
  },
  {
   "q": "Is Zero Trust failing?",
   "a": "No. It removed implicit network trust, which was a real improvement. Its unit of verification is the connection, and some attacks live inside authorised connections."
  },
  {
   "q": "Why doesn't segmentation stop lateral movement?",
   "a": "It constrains identities with narrow legitimate scope. Administrative and service identities need broad reach by function, and those are what attackers target."
  }
 ],
 "sources": [
  {
   "t": "NIST SP 800-207 — Zero Trust Architecture",
   "u": "https://csrc.nist.gov/pubs/sp/800/207/final"
  },
  {
   "t": "CISA Zero Trust Maturity Model",
   "u": "https://www.cisa.gov/zero-trust-maturity-model"
  },
  {
   "t": "CISA — known exploited vulnerabilities and incident reporting",
   "u": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
  },
  {
   "t": "MITRE ATT&CK Enterprise techniques",
   "u": "https://attack.mitre.org/techniques/enterprise/"
  }
 ],
 "related": [
  {
   "slug": "session-hijacking-via-infostealers-mfa-login-protect-post",
   "title": "Why MFA at login does not protect post-login actions",
   "category": "Developer"
  },
  {
   "slug": "privileged-access-management-pam-under-attack-gating-just",
   "title": "Gating just-in-time escalation",
   "category": "Developer"
  },
  {
   "slug": "okta-cross-tenant-impersonation-architectural-lessons-2023-support",
   "title": "Support access and standing authority",
   "category": "Developer"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Zero%20Trust%20Connection%20Not%20Command/1500_900/blog.jpg",
 "wordcount": 577,
 "url": "/blog/illusion-zero-trust-network-microsegmentation-fails-against.html",
 "reading_time": "3 min read",
 "meta_description": "Microsegmentation decides who may reach what. Inside an authorised connection, an attacker with valid credentials does what policy permits.",
 "hub": {
  "slug": "topics/privileged-identity",
  "title": "Privileged identity and account recovery"
 },
 "answer": "The connection. It replaced trust-by-network-position with per-connection authentication, authorisation and posture evaluation, which was a genuine improvement. The unit of verification moved from the segment to the connection — and not to the action, which is where an attacker with valid credentials operates.",
 "answer_q": "What does Zero Trust verify?",
 "glossary": [
  {
   "term": "Microsegmentation",
   "def": "Constraining which systems an identity can reach — effective for narrow identities, limited for administrative ones."
  },
  {
   "term": "Lateral movement",
   "def": "Moving between systems using valid credentials, which passes every connection-time check."
  },
  {
   "term": "Prerequisite operation",
   "def": "An action an attacker performs before the damage, such as deleting backups or disabling logging."
  }
 ],
 "checklist": {
  "title": "Extending verification to the action",
  "id": "extend",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "List the prerequisite operations.",
    "text": "Around a dozen in a typical estate."
   },
   {
    "name": "Require a fresh bound assertion for each.",
    "text": "Rendering the operation and its blast radius."
   },
   {
    "name": "Enforce at the operation, not at the connection.",
    "text": "In-flight work is already past the gateway."
   },
   {
    "name": "Keep the connection-time controls.",
    "text": "Removing them would be a straightforward regression."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav requires a fresh assertion bound to the specific action, from a credential under the person's sole control. A stolen session reaches the endpoint and cannot produce it.",
  "href": "../docs.html",
  "label": "See step-up gating"
 }
}