Overview
Segmentation is organized around trust zones — groupings of systems by their trust level, with controlled relationships between them. This lesson covers trust zones.
Learning objectives
- Define trust zones and their purpose.
- Describe common trust-zone models.
- Connect trust zones to controlling pivoting.
Core concept
A trust zone is a group of systems that share a trust level and are separated from other zones by controlled boundaries. Organizing a network into trust zones means deciding what level of trust each area warrants and restricting how zones interact accordingly. Common zones include a DMZ (public-facing, lower trust), internal (user/workstation), restricted/sensitive (databases, critical systems, high trust), and untrusted (guest/external). Traffic between zones is limited based on trust — higher-trust zones are shielded from lower-trust ones.
How it works
Trust zones formalize segmentation by trust level: the lower-trust a zone, the more its access to higher-trust zones is restricted. For example, a DMZ (exposed, lower trust) is heavily restricted from reaching the sensitive zone, while the sensitive zone is the most protected. This directly shapes pivoting: an attacker who compromises a lower-trust zone (like the DMZ) should find strict boundaries preventing pivoting into higher-trust zones. Designing trust zones well — assigning appropriate trust and enforcing strict inter-zone rules — is what makes segmentation effective against lateral movement. It embodies the principle of not extending trust further than necessary.
Practical example
In the lab's multi-network environment, the public web server sits in a DMZ (lower trust), workstations in the internal zone, and the database in a restricted (high-trust) zone. Inter-zone rules allow only the specific, necessary flows (e.g. the app server to the database on one port) and block the rest. An attacker compromising the DMZ web server is confined by the trust-zone boundaries — they cannot pivot into the restricted database zone because the trust model forbids that path. The trust zones shaped exactly what the compromise could reach.
Cybersecurity relevance
Trust zones are the organizing concept behind effective segmentation and are central to containing compromise and protecting high-value assets — key to defense in depth and zero-trust architectures. They ensure that compromising a lower-trust area does not grant access to higher-trust ones, directly limiting pivoting. For defenders, defining appropriate trust zones and strict inter-zone rules is a core architectural task; for authorized testers, evaluating whether trust zones genuinely constrain movement assesses resilience. Trust zones connect the networking-path segmentation concepts to real anti-pivoting design.
Common mistakes
- Over-trusting a zone (e.g. giving a DMZ broad access to internal/sensitive zones).
- Not defining clear trust levels, resulting in weak or arbitrary inter-zone rules.
- Allowing unnecessary inter-zone flows, creating pivot paths between trust levels.
Key takeaways
- Trust zones group systems by trust level (e.g. DMZ, internal, restricted, untrusted) with controlled, trust-based boundaries between them.
- Lower-trust zones are strictly restricted from reaching higher-trust ones, so compromising a low-trust area doesn't grant access to sensitive zones.
- Well-designed trust zones with strict inter-zone rules make segmentation effective against pivoting — central to defense in depth and zero trust.
Check your understanding
- What is a trust zone, and how do trust levels shape inter-zone rules?
- How do trust zones limit an attacker's pivoting after compromising a lower-trust area like a DMZ?