Authorization

1.8 Summarize evolving use cases for modern network environments

Zero Trust Architecture (ZTA)

📘CompTIA Network+ (N10-009)

---

1. What is Authorization?

• Authorization is the process of determining what a user, device, or system is allowed to do after they have been authenticated (verified who they are).
• In simpler terms: Authentication says, “Who are you?”, and Authorization says, “What can you do?”

In a Zero Trust Architecture (ZTA) environment, authorization is continuous and dynamic, not just a one-time check.

---

2. Key Principles of Authorization in ZTA

1. Least Privilege Access
   • Users and devices are given only the minimum permissions they need to do their job.
   • Reduces risk: If a device or account is compromised, attackers have limited access.
2. Dynamic Access Control
   • Access rights can change in real time based on conditions such as:
     • User role
     • Device security posture (e.g., up-to-date antivirus, OS patch level)
     • Location or network type
     • Sensitivity of the resource being accessed
3. Context-Aware Authorization
   • ZTA doesn’t just ask “Who is this?”
   • It asks additional questions:
     • Is the device secure?
     • Is the request coming from a trusted network?
     • Is the user performing normal behavior or unusual activity?
4. Policy-Based Access
   • Authorization decisions are made using pre-defined security policies.
   • Example policies might say:
     • Only HR team members can access payroll files.
     • Devices not meeting security requirements cannot access internal servers.
5. Continuous Authorization (Re-Authorization)
   • Access is not permanent.
   • ZTA continuously monitors activity and can revoke access immediately if something suspicious is detected.

---

3. How Authorization Works in a ZTA Environment

1. User/Device Authentication
   • Step 1: A user logs in or a device connects.
   • Authentication is verified via methods like passwords, MFA (multi-factor authentication), or device certificates.
2. Policy Engine Evaluation
   • Step 2: The system checks access policies.
   • The policy engine evaluates the user/device against current conditions.
3. Access Decision
   • Step 3: The system grants or denies access.
   • Access may be full, limited, or temporary, depending on the policy and context.
4. Monitoring & Re-Evaluation
   • Step 4: Access is continuously monitored.
   • If something changes (e.g., device security becomes outdated, suspicious activity is detected), the system can reduce or revoke access immediately.

---

4. Examples in an IT Environment

1. Cloud File Access
   • An employee tries to access sensitive financial files in the cloud.
   • ZTA checks:
     • Is the user authenticated? ✅
     • Is the device patched and compliant? ✅
     • Is the access request coming from an approved location? ✅
   • If all checks pass, the user is allowed to read files.
   • If any check fails, access is denied or limited.
2. Remote Access to Internal Network
   • A contractor needs temporary access to a project server.
   • ZTA grants time-limited, role-specific access.
   • Continuous monitoring ensures that if the contractor starts accessing resources they shouldn’t, the system can revoke access immediately.
3. API Authorization
   • An application needs to communicate with a database.
   • ZTA checks API keys, device posture, and request origin.
   • Only authorized apps can read/write data; all others are blocked.

---

5. Why Authorization is Critical in ZTA

• Prevents insider threats and unauthorized access.
• Reduces risk of data breaches.
• Ensures compliance with security policies.
• Supports granular and flexible access control based on context.
• Enables organizations to operate safely even when devices, users, or networks are untrusted.

---

6. Key Terms to Remember for the Exam

• Least Privilege: Users/devices get only necessary access.
• Policy-Based Access Control: Access decisions made according to rules.
• Continuous Authorization: Access is constantly monitored and re-evaluated.
• Context-Aware Access: Decisions consider device, location, and user behavior.

---

✅ Exam Tip

For CompTIA Network+ (N10-009), understand the difference between authentication and authorization, the concept of least privilege, and that ZTA uses dynamic, context-aware, and policy-driven authorization to control access.

---