TechKnowSurge
ISC2 CISSP 3.6 CompTIA Security+ 1.4 CompTIA SecurityX 2.2 NIST 800-53 SC-17 CompTIA SecurityX 3.3 ISC2 CISSP 4.1 NIST CSF PR.AA-03
TechKnowSurge Catalog Videos Trust Models
VideoSecurityFree

Trust Models

Trust models define how devices and systems verify and extend confidence to one another across a network, covering direct trust, third-party trust, hierarchy trust, web of trust, and how these frameworks underpin zero trust architecture.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Every network connection requires some level of trust, and trust models provide the structured frameworks that define how that confidence is established, extended, and verified between entities. Direct trust is the simplest form, where a digital certificate is installed directly on a machine and used to verify a specific resource, but this approach becomes impractical at scale since it would require a separate certificate for every service a user accesses. Third-party trust solves this problem by introducing a certificate authority that both parties recognize, allowing the authority's established credibility to vouch for the resource and remove the burden of individual verification from the end user. Public key infrastructure is the most common real-world application of these models, using certificate authorities to authenticate websites and encrypt communications through digital certificates. Hierarchy trust extends this further by creating a tiered structure where a root authority passes trust downward through one or more subordinate entities, enabling a wide range of trusted relationships to derive from a single trusted core. Web of trust operates differently, building indirect trust between unfamiliar entities through a shared network of mutually trusted parties, so that two entities that have never directly verified each other can still establish a meaningful level of confidence through their common connections. A trust anchor is the specific entity at the top of a hierarchy that holds direct, foundational trust, while a chain of trust refers to the sequence of verified links connecting any trusted entity back to that anchor. Zero trust is often misunderstood as being at odds with these models, but in practice it relies on them to function. Applied primarily to internal networks, zero trust means that physical access to a network never automatically grants access to its resources. Instead, users and devices must be verified before connectivity is established, which can be accomplished using an internal certificate authority and public key infrastructure to authenticate each request. The result is a never-trust, always-verify posture that uses the same trust model principles to enforce stricter, more deliberate access control within an organization's own environment.

What you'll learn

What's covered

Trust Models in Security

Aligned to

ISC2 CISSP
3.6 Select and determine cryptographic solutions
4.1 Apply secure design principles in network architectures
CompTIA Security+
1.4 Explain the importance of using appropriate cryptographic solutions
CompTIA SecurityX
2.2 Given a scenario, implement appropriate PKI infrastructure solutions
3.3 Given a scenario, implement the appropriate PKI solutions
NIST 800-53
SC-17 Public Key Infrastructure Certificates
NIST CSF
PR.AA-03 Users, services, and hardware are authenticated

Key terms

Public Key Infrastructure
PKI
A framework of hardware, software, policies, and standards used to create, manage, and distribute digital certificates.
Certificate Authority
CA
A trusted entity that issues digital certificates used to verify the identity of individuals, organizations, or devices.
Digital Certificate
An electronic document that uses a digital signature to bind a public key with an identity.
Public Key
A cryptographic key that can be shared openly and is used to encrypt data or verify digital signatures.
Private Key
A secret cryptographic key used in asymmetric encryption to decrypt data or create digital signatures.
Zero Trust
A security model that assumes no user or device is trusted by default and requires continuous verification.
Direct Trust
A trust model in which two entities establish trust directly with each other, such as by installing a certificate directly onto a machine.
Third-Party Trust
A trust model in which a mutually trusted third party, such as a certificate authority, vouches for and extends trust to other entities.
Hierarchy Trust
A trust model in which a top-level trust anchor delegates trust down through subordinate entities, forming a layered chain of authority.
Web of Trust
A trust model in which entities establish indirect trust through a network of direct peer-to-peer trust relationships rather than a central authority.
Chain of Trust
The linked sequence of trust relationships that connects an entity back to a trusted anchor, validating each step in the hierarchy.

Topics

Trust Models Public Key Infrastructure Zero Trust Cryptography Certificate Management Network Security

Transcript

The most secure that I can make any network or any resource is to unplug them and never have any kind of connectivity. Of course, this isn't really reasonable in today's age; we need that level of connectivity. So at some point in time I'm going to need to extend some trust to different devices to make that level of connectivity. But how do I do that in a secure manner? There are different trust models.

There are a lot of different applications for these trust models. For instance, public key infrastructure is an example that we would apply some sort of trust model to. That is, we want to make it to different websites and we want a certain amount of verification that it's the actual website we're trying to reach, and so we do that with public key infrastructure using digital certificates and certificate authorities. Somehow we identify this trust that we have of a website, or the traffic that's getting to us, through a certificate authority, some other entity that we are going to trust.

Direct trust

One of the models is a direct trust. A direct trust is when there's a trust directly between two entities. In this case right here, we have a user that has a direct trust to the TechKnowSurge website. What that would look like is that the digital certificate would be installed directly onto the machine, and then any information that machine would receive from the TechKnowSurge website it would decrypt with that public key. As long as it's able to decrypt it with the public key, it knows that it was encrypted with a private key. So that's a direct trust.

Direct trusts don't really work on a large scale. That is, for every website we visit, we're not going to download and install a separate certificate. Those are extra steps that a user has to do.

Third-party trust

So instead we developed something like a third-party trust, where a third party is going to be trusted to do the verification steps to trust something like the TechKnowSurge website. By us trusting this certificate authority, and them extending that trust now to the TechKnowSurge website, now users can go to the TechKnowSurge website and verify and trust this website right here. So that's third party: we're using a third party to do that trust.

Hierarchy trust

Public key infrastructure also utilizes a hierarchy trust. There is some sort of top level trust that gets passed down to a subordinate, which also can get passed down again, and so it creates a hierarchy of trust, and from here we can create a lot of different trusts based off of the core of that.

Web of trust

A web of trust is quite a bit different. Let's say that each one of these is an entity. One of them happens to be me, and another one over here happens to be a stranger. I'm not going to immediately trust this stranger, but what I do have is trust with these other entities that are part of this web. Since I have a direct trust with the other entities, and these other entities have a direct trust with the stranger, then I'll create an indirect trust with this stranger, and there is a certain amount of trust there that I can have even though I haven't created a direct trust.

Trust anchors and the chain of trust

A trust anchor is not a model. It's actually an entity that we have a direct trust with that will pass on that trust to other entities. It's at the top, so it's the root. That is a trust anchor.

A chain of trust is not a model either. Instead, it's this concept of the link between all of the trusts. An example here is that we have the anchor of trust here at the top, and we also trust this entity down here. We trust this entity because of this chain of trust, so this would be the chain of trust for this entity that we trust right here.

Zero trust

One thing I did want to address here is this idea behind zero trust. It may sound like it's contradictory to these other trust models, but in fact it's actually very complementary to them, in that we actually use these different trust models to enforce zero trust.

The first thing you should probably understand is that zero trust is commonly associated with our internal network. That is, we are not going to trust a user that just plugs into our network and has physical access to our network. We're not going to just automatically assume that they should have access to the resources on that network. Instead, we're going to do some double checks before we give them access to resources on that network.

What we could do is we could actually set up things like a certificate authority on our local network, so this is actually a trusted source because we have set that up, and then we do a verification with this user before we give them access to the rest of those resources on that network. So it's still this never trust, always verify: we're actually verifying this user before they make some sort of connectivity to our resources. And we could actually use public key infrastructure, but just an internal public key infrastructure, to do those verification steps.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →