Presence on a private network is not proof that a user or a device should be trusted. Each request is checked for identity, for the state of the device, and for the right to that specific resource. The check applies to traffic inside the organization as well as to traffic that arrives from outside.
What Is Checked on Every Request
A network address can be copied, a stolen laptop can still sit on an approved range, and a valid login can be misused. The decision therefore rides with the request, not with the place the request came from.
- Identity: The caller, whether a person or a service, must be known at the time of the request. An earlier login does not stand in for that check.
- Device state: The device is assessed for management, patch level, and signs of compromise. A familiar address does not excuse a device that fails those tests.
- Right to the resource: Permission covers the specific application, record, or action being requested. Access to one resource does not imply access to another.
The U.S. National Institute of Standards and Technology describes this architecture in a special publication. That account treats the network as only a path. Identity, device state, and the right to the resource decide the request.
Keeping One Breach from Opening the Rest
Designs that trust the inside of the network often let systems reach one another once the edge has been passed. An attacker who takes one server, or one set of credentials, can then move toward data and tools that were never the original target.
This architecture assumes that a segment will be breached. Neighboring systems do not inherit trust from that event. The next request has to qualify on its own. A failure in one segment should not open the rest of the network.
Trusted Network Compared with This Architecture
The same environment can be run under two opposite assumptions. One treats the private network as a safe interior. The other repeats the check for every request.
| Practice | Trusted Internal Network | This Architecture |
| Where trust comes from | Being on the private network, or on a tunnel that imitates it | Identity, device state, and the right to that specific resource, checked on the request |
| What one approval covers | Often a wide set of internal systems | Only the resource named in that request |
| After one segment falls | Movement toward the rest of the network is commonly possible | A breach of one segment does not open the rest |
| How place is treated | An office address or a remote tunnel stands in for trust | Place does not replace a new check |