The attack fails
A staff laptop opened a bad attachment and now runs malware. Malware is software that works for an attacker. It will try to reach every other computer it can find, hunting for valuable data.
It tries the database server, 192.168.20.20, on port 5432. That address is in another zone, so the packet must pass the firewall. No rule allows staff to reach that port, so the firewall drops it.
Segmentation
Segmentation splits one network into zones. Each zone is its own VLAN (virtual LAN) and subnet: guests, staff, servers and the DMZ. Inside a zone devices talk directly; between zones every packet goes through the firewall.
The firewall checks each new connection against its rules, top to bottom; the first match wins. Staff may use the staff app and the web. Guests get the internet only. Anything not listed is denied.
The DMZ
A DMZ (demilitarised zone) holds the servers the public must reach, between the internet and the inside. A visitor's HTTPS request to 203.0.113.10 is forwarded to the web server there. Rule 4 allows it.
Public servers are attacked most, so assume one gets taken over. From the web server it tries the database. No rule lets the DMZ start connections inward, so the firewall drops it again.
Zero trust
Now the malware asks the staff app, 192.168.20.10, on port 443. The packet comes from the staff zone, and rule 1 allows staff here. The firewall checks only where a packet comes from, not who sent it.
Zero trust (NIST SP 800-207) gives no trust for being on the right network. An access check in front of the app asks every request: who is the user, is the device healthy, and may they use this app?
The malware's request rides on Adam's real sign-in, so the identity check passes. But the laptop fails its health check: unknown software is running. The access check refuses it, even though it is inside the office.
Sara's laptop sends the same kind of request. She signs in with a second factor, her laptop is healthy, and policy grants her this app. She gets this one app for this session, and nothing more.
The packet and the decision
;; step 1/10 · infected-laptop · local ;; at infected infected laptop 192.168.10.37 (staff zone, VLAN 10) goal of the malware: spread, and find the data the data lives on the database server 192.168.20.20 question for this lesson: how far can it get?
The firewall is stateful: once a connection is allowed, its replies are let back automatically, so the rules only list who may start a connection. The website’s public address 203.0.113.10 belongs to the firewall, which forwards HTTPS on it to the web server in the DMZ (port forwarding, a form of NAT). Zero trust does not throw segmentation away: NIST SP 800-207 lists micro-segmentation as one way to build it. The access check is a policy enforcement point; a policy decision point behind it makes the decision.