In Zero Trust Architecture, which principle is fundamental?

A.  Trust but verify

B.  Always trust internal networks

C.  Never trust, always verify

D.  Perimeter defense is enough

Answer:  C

Explanation:

Never trust, always verify: Zero Trust Architecture operates on the principle that threats can exist both outside and inside the network. Therefore, every request for access, regardless of where it originates from, should be thoroughly verified before granting permissions. There's an inherent assumption that "trust" as a concept is eliminated from the equation.

Here's a breakdown of the other options:

Trust but verify: While this saying is well-known in security, it doesn't align with Zero Trust Architecture. In Zero Trust, there is no initial trust granted that then needs to be verified. Instead, nothing is trusted by default.

Always trust internal networks: This is the opposite of the Zero Trust model. In traditional models, internal networks were generally trusted, but Zero Trust challenges this notion.

Perimeter defense is enough: This is a principle from older security models where the focus was on building strong perimeter defenses. Zero Trust Architecture assumes that the perimeter is porous and can be compromised, so it focuses on securing resources individually.

Therefore, the fundamental principle in Zero Trust Architecture is "Never trust, always verify."