kevinferron.comKevin Ferron

T1 · Zero trust · Simulated in your browser

The castle and the moat

Plant an attacker on a small office network and watch them spread, with a perimeter and then without one.

A perimeter defends one line. Once an attacker is past it, everything on a flat network is reachable, so one phished laptop becomes the whole office.

Illustrative office

Click any machine to plant the attacker there. A phished staff laptop is a good place to start.

FIREWALL: EVERYTHING INSIDE IS TRUSTEDcloud accountsfile shareT1021file shareT1021file shareT1021webT1210remote desktopT1021SSHT1021webT1078webT1550webT1550Staff laptopAStaff laptopBAdminlaptopFileserverAccountingappIoTcameraEmailaccountCloud fileshare

Perimeter

Reached – of 8

Rounds –

Zero trust

Reached – of 8

Rounds –

The counts are this model’s output for the machine you planted the attacker on, not a measurement of any real network.

Credentials found so far

None.

Hops, round by round

Plant the attacker first.

Technique labels are this page’s mapping of each link to MITRE ATT&CK techniques (lateral movement, plus Valid Accounts for the stolen-password hop); the links and credentials are illustrative.

The older picture is a castle and a moat: a strong wall around the network and a presumption that anyone inside belongs there. Google’s BeyondCorp paper describes that model, and its problem, when one compromised machine inside the wall gets a view of everything else.

NIST puts the same point in terms of movement: once an attacker is past the perimeter on a network that trusts its inside, lateral movement is unhindered. Plant the attacker on any machine below and press Spread. Each round, they try every link out of the machines they hold, using every credential found so far. Reaching a machine also harvests the credentials stored on it.

The network is a small office made up for this page: two staff laptops, an admin laptop, a file server, an accounting app, an internet-connected camera, an email account and a cloud file share. The links, the credentials stored on each machine and the policy are all illustrative. The numbers “reached” and “rounds” are what this model produces, not a measurement of any real network.

Each hop is labelled with the class of technique an attacker uses. Most are from the lateral-movement tactic in MITRE ATT&CK: Remote Services (T1021), Use Alternate Authentication Material (T1550) and Exploitation of Remote Services (T1210). The one hop that simply signs in with a stolen password is labelled Valid Accounts (T1078), which MITRE files under other tactics. Matching an office link to one of those is this page’s own mapping.

Switch to zero trust and the same graph behaves differently. Every link now passes an enforcement point that asks the policy engine from the previous page, with the identity of the stolen credential, the posture of the machine the attacker stands on, and nothing stronger than a stolen password. The policy lets staff open the file share and nothing else; mail and the cloud share need a second factor, the accounting app needs the finance group on a phishing-resistant factor, and no rule lets one workstation reach another. The spread stops at the file share, the one thing a staff password alone is allowed to reach in this made-up policy.

The UK’s NCSC states the principle in a line: treat every network, including your own, as untrusted. The question stops being whether the wall holds and becomes how little an attacker can reach once it does not.

Exercise

Compute the spread yourself.

  1. Write down a small network as nodes and links, and mark which machine stores which credential.
  2. Write the breadth-first loop: each round, add every node reachable over a link whose requirement is met by the credentials held at the end of the previous round, then harvest the credentials on the new nodes.
  3. Stop when a round adds nothing, then count nodes and rounds, and check one case by hand.

Sources

  1. BeyondCorp (2014) BeyondCorp: A New Approach to Enterprise Security (R. Ward, B. Beyer; ;login: 39(6)). Dec 2014; read 2026-10-22.

    • Page 6: the perimeter model and its weakness

  2. NIST SP 800-207 Zero Trust Architecture (S. Rose, O. Borchert, S. Mitchell, S. Connelly). Aug 2020; read 2026-10-22.

    • Section 1: past the perimeter, lateral movement is unhindered
    • Section 2.2, assumption 1: act as if an attacker is already present; Section 3: every access goes through a policy decision

  3. MITRE ATT&CK, Lateral Movement Lateral Movement, Tactic TA0008 (T1021, T1210 and T1550 among its techniques). v20, tactic modified 11 Aug 2025; read 2026-10-22.

    • Tactic TA0008 and its techniques T1021, T1210 and T1550
    • Tactic TA0008: the behaviours the loop models

  4. MITRE ATT&CK, Valid Accounts Valid Accounts, Technique T1078 (stealing and using existing credentials). It is not a lateral-movement technique itself; it is shown on the hop that uses a stolen password. v20, technique modified 12 May 2026; read 2026-10-23.

    • Technique T1078: using existing credentials

  5. NCSC zero trust principles Zero trust architecture design principles (UK NCSC). Principles 1 to 7 were read; the eighth was not seen. v1.1, reviewed 16 Jan 2026; read 2026-10-22.

    • Principle 7: treat every network, including your own, as untrusted

Everything here is paraphrased from the sources, not quoted at length, and every claim is attributed to one. The NSA’s own zero trust sheets could not be opened, so they are not cited; the CISA alert about them is. Anything illustrative is labelled as such. Where a source is silent or could not be read, the page leaves the fact out.