Limiting the Blast Radius
Applying Zero Trust to Modern Identity Attacks, pt. II
Key Takeaways
Zero Trust assumes compromise is inevitable, so, rather than relying on a trusted network perimeter, NIST SP 800-207 continuously evaluates every user, device and workload before granting access.
Identity-based attacks highlight the value of Zero Trust. Public reporting on the Transport for London and Marks & Spencer incidents suggests that attackers prioritised compromising trusted identities and business processes rather than exploiting sophisticated software vulnerabilities.
By enforcing least privilege, evaluating contextual risk and reauthorising access throughout a session, Zero Trust makes lateral movement and privilege escalation significantly more difficult.
Zero Trust improves resilience, not just prevention—so, even if an attacker successfully obtains valid credentials, microsegmentation, behavioural monitoring and granular access controls can reduce the scope and impact of an intrusion.
Successful Zero Trust implementations require strong identity governance, mature operational processes, effective monitoring and well-rehearsed incident response capabilities working together as part of a broader security architecture.
In the first part of this article, we explored the principles behind NIST SP 800-207: Zero Trust Architecture and considered how they apply to the initial stages of identity-based attacks such as those publicly reported against Transport for London (TfL) and Marks & Spencer (M&S). One of the central themes was that Zero Trust does not assume authentication equals trust. Instead, every request for access is evaluated continuously using a combination of identity, device posture, behavioural information and organisational policy.
This philosophy becomes even more significant once an attacker has successfully gained an initial foothold. Public reporting surrounding both incidents suggests that identity compromise and social engineering formed important elements of the attacks, but gaining access is only the beginning of a successful intrusion. Attackers must still discover systems, elevate privileges, move laterally, access sensitive resources and achieve their objectives without being detected. It is during these later stages that a mature Zero Trust Architecture can have the greatest impact.
Rather than attempting to answer the impossible question of whether Zero Trust would have prevented either incident, it is more useful to examine how the architecture is designed to influence the attack lifecycle. Every additional policy decision, verification step and access restriction increases the effort required by an attacker while creating new opportunities for defenders to detect and contain malicious activity.
Lateral Movement Should Become Increasingly Difficult
One of the defining characteristics of many successful enterprise intrusions is lateral movement. Initial access rarely provides everything an attacker needs. A compromised employee account may have legitimate access to email and collaboration tools, but it is unlikely to possess administrative privileges across the organisation. Attackers therefore spend considerable time identifying additional systems, locating privileged accounts and expanding their access until they reach their intended objectives.
Traditional enterprise networks often made this process easier than organisations realised. Once authenticated, users frequently had broad visibility of internal infrastructure, shared services and authentication mechanisms. Even where access controls existed, trust relationships between systems often allowed attackers to progress further than originally intended. Network location itself became a form of implicit trust.
Zero Trust challenges this assumption by treating every resource as individually protected. Access to one application should not automatically imply access to another. Authentication to one service should not create permanent trust across the wider environment. Instead, each interaction requires its own policy evaluation before communication is permitted.
Applied conceptually to incidents such as TfL or M&S, this means that obtaining a legitimate employee account should not automatically provide unrestricted visibility across the enterprise. An attacker attempting to enumerate servers, query administrative systems or access sensitive business applications would encounter repeated policy decisions rather than inheriting broad organisational trust simply because one authentication event had succeeded.
Least Privilege Becomes an Operational Discipline
Least privilege has been discussed within cybersecurity for decades, yet many organisations still struggle to implement it consistently. Users accumulate permissions over time, temporary access becomes permanent and legacy applications often require privileges that nobody fully understands. The result is an environment where compromised accounts frequently possess more authority than necessary.
Zero Trust treats least privilege as a continuous operational process rather than a one-time configuration exercise. Every access decision is based upon the minimum permissions required to complete a specific task. Access is granted for defined purposes, reviewed regularly and withdrawn when it is no longer required.
This approach substantially changes the economics of identity-based attacks. Suppose an attacker successfully compromises an account belonging to a customer service employee. In a traditionally managed environment, that account may possess unnecessary permissions inherited through years of organisational change. Under a mature Zero Trust Architecture, however, the account should only retain the privileges required for its current responsibilities. Opportunities for privilege abuse become correspondingly smaller.
Just-in-time administrative access reinforces this principle. Rather than assigning permanent administrator privileges, organisations grant elevated permissions only when specific tasks require them. Administrative sessions become time-limited, tightly monitored and subject to additional policy evaluation. Even if attackers compromise an administrative identity, the availability of privileged capabilities may be considerably more restricted than under traditional security models.
Microsegmentation Limits Organisational Exposure
Microsegmentation is often discussed alongside Zero Trust because the two concepts complement one another. While Zero Trust governs how trust decisions are made, microsegmentation governs how workloads communicate once those decisions have been reached. Instead of allowing unrestricted communication across broad network segments, organisations create much smaller security boundaries around individual applications, workloads or business functions.
This significantly influences how attackers operate after gaining initial access. Enterprise environments often contain thousands of interconnected systems supporting different business processes. Without segmentation, compromised identities may be able to communicate with many of these resources even if they ultimately lack sufficient privileges to use them. Every visible system becomes another opportunity for reconnaissance, exploitation or privilege escalation.
Microsegmentation reduces this visibility by limiting communication pathways to those explicitly required for legitimate business activity. Applications communicate only with approved services, administrative interfaces remain isolated and sensitive workloads become inaccessible from unrelated parts of the enterprise. Attackers therefore encounter multiple technical barriers even after successfully compromising legitimate credentials.
Neither TfL nor M&S has publicly disclosed the detailed architecture of its production environment, making it impossible to determine precisely how segmentation influenced the progression of either incident. Nevertheless, the architectural principle remains applicable. Organisations that reduce unnecessary communication between workloads inevitably reduce the opportunities available to attackers seeking to expand their access following initial compromise.
Continuous Verification Changes the Nature of Trust
Perhaps the most significant conceptual change introduced by Zero Trust is the rejection of permanent trust. Traditional security architectures frequently established trust during authentication and maintained it until the user logged out or the session expired. Unless obvious malicious activity occurred, relatively little changed throughout the lifetime of that session.
Zero Trust replaces this static model with continuous evaluation. Trust becomes dynamic rather than permanent, allowing organisations to incorporate new information as circumstances evolve. Device posture may change, behavioural anomalies may emerge or threat intelligence may identify previously unknown risks associated with an account or application. Each development provides an opportunity to reassess whether continued access remains appropriate.
This capability is particularly valuable during identity-based attacks because malicious behaviour often becomes more apparent over time. A compromised account may initially behave in a manner consistent with legitimate usage before gradually expanding its activities. Accessing unfamiliar systems, downloading unusually large volumes of information or requesting privileged resources may all indicate that organisational policy should be reconsidered.
Continuous verification therefore reduces the period during which attackers can operate without scrutiny. Rather than relying exclusively upon preventative controls, organisations repeatedly evaluate whether current behaviour remains consistent with expected operational patterns. Trust is earned continuously rather than granted indefinitely.
Detection Becomes Behaviour-Centric
Traditional security monitoring frequently focused on technical indicators such as malware signatures, known exploit techniques or suspicious executable files. These capabilities remain valuable, but identity-based attacks increasingly avoid introducing obvious malicious software into enterprise environments. Attackers operating through legitimate accounts often rely upon standard administrative tools, making conventional detection considerably more challenging.
Zero Trust encourages organisations to broaden their perspective by monitoring behaviour rather than simply identifying malicious code. Authentication frequency, geographic anomalies, privilege usage, application access patterns and resource consumption all contribute towards understanding whether an identity is behaving as expected. Individually, these observations may appear benign. Collectively, however, they can reveal the gradual progression of an intrusion.
For example, an employee account that normally accesses customer records during office hours might suddenly begin requesting administrative resources, authenticating from unfamiliar infrastructure or interacting with systems outside its established responsibilities. None of these activities necessarily proves malicious intent, but together they provide valuable context for automated policy decisions and human investigation.
This behavioural approach also aligns closely with the increasing use of artificial intelligence within security operations. Machine learning systems can identify subtle deviations from established behavioural baselines that would be difficult for analysts to recognise manually. Used appropriately, these capabilities support Zero Trust by providing richer contextual information for policy evaluation rather than replacing human judgement.
Incident Response Becomes More Granular
One of the less frequently discussed advantages of Zero Trust Architecture is its influence on incident response. Historically, organisations often responded to significant compromises by taking broad defensive actions. Entire network segments might be disconnected, remote access disabled or critical systems isolated while investigators determined the extent of the intrusion. Although sometimes necessary, these actions can themselves produce considerable operational disruption.
A mature Zero Trust Architecture supports more targeted responses because trust relationships are already defined at a granular level. Individual sessions can be terminated, specific identities disabled, devices quarantined and access policies updated without necessarily affecting unrelated users or business services. Response becomes proportionate to the observed risk rather than requiring organisation-wide disruption.
This distinction is particularly relevant for organisations delivering essential public or commercial services. Both transport providers and major retailers depend upon maintaining operational continuity while responding to security incidents. The ability to isolate a compromised identity without broadly interrupting legitimate business activity represents a significant operational advantage, even if the initial intrusion could not be prevented.
Zero Trust therefore contributes not only to prevention and detection but also to organisational resilience. By reducing unnecessary trust relationships before an incident occurs, organisations gain greater flexibility when responding under pressure.
What Zero Trust Does Not Solve
Despite its considerable benefits, Zero Trust should not be presented as a universal solution to modern cybersecurity challenges. Organisations occasionally treat Zero Trust as though it guarantees immunity from phishing, insider threats or social engineering. Neither NIST nor experienced practitioners make such claims.
Employees can still be deceived. Help desk personnel may still make mistakes. Software vulnerabilities will continue to exist, while misconfigured cloud services and poorly governed third-party relationships remain significant sources of organisational risk. Zero Trust does not eliminate these problems because they extend beyond architecture alone.
Implementation also presents practical challenges. Mature Zero Trust programmes require accurate asset inventories, well-governed identities, consistent policy management and extensive visibility across enterprise systems. Organisations with fragmented identity infrastructure or poorly documented applications may require substantial preparatory work before Zero Trust principles can be applied effectively.
Finally, security architecture cannot compensate for weak governance. Executive oversight, incident response planning, supplier assurance and organisational security culture remain essential components of effective cyber resilience. Zero Trust strengthens these capabilities but does not replace them.
The Strategic Lesson
The Transport for London and Marks & Spencer incidents should not be viewed solely as examples of successful cyber attacks. They should also be understood as indicators of how enterprise security has evolved. Public reporting suggests that identity compromise and social engineering continue to provide attackers with effective paths into complex organisations, reinforcing the idea that trust itself has become one of the most valuable targets in modern cybersecurity.
Zero Trust Architecture reflects this changing reality. Rather than assuming organisations can prevent every compromise, it accepts that identities, devices and applications may occasionally become compromised. Security therefore shifts from attempting to build perfect defences towards continuously evaluating trust, limiting unnecessary access and reducing the operational freedom available to attackers.
Whether examining the publicly available information surrounding TfL, Marks & Spencer or countless other identity-focused intrusions, the conclusion remains consistent. Modern attackers increasingly succeed by abusing legitimate access rather than defeating technical controls outright. Organisations adopting the principles described in NIST SP 800-207 are not eliminating cyber risk, but they are fundamentally changing the conditions under which attackers must operate. In an era where trust has become the preferred attack surface, that may be one of the most important architectural advantages an organisation can possess.
