TechKnowSurge
CompTIA Security+ 1.2 ISC2 CISSP 4.1 NIST 800-53 AC-3 NIST CSF PR.AA-05
TechKnowSurge Catalog Videos Zero Trust’s Data and Control Plane
VideoSecurityFree

Zero Trust’s Data and Control Plane

Zero trust networks separate traffic handling and access decision-making into two distinct planes: the data plane and the control plane. The data plane enforces access at the policy enforcement point, while the control plane evaluates requests through a policy engine and policy administrator before returning an allow or deny decision.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Zero trust networks are built on a clear architectural separation between the data plane and the control plane, each serving a distinct role in controlling access to resources. The data plane is where traffic flows and where access is physically enforced. When a subject attempts to reach a resource, the policy enforcement point intercepts that request and escalates it to the control plane for a decision rather than making that determination independently. The control plane is responsible for all access decision-making and contains two key components: the policy engine and the policy administrator. The policy engine holds the organization's defined access rules — the full set of conditions that determine whether a subject should be granted access to a given resource. Once the policy engine evaluates the request against those rules, it passes its findings to the policy administrator, which issues the final allow or deny determination. That decision is then returned to the policy enforcement point in the data plane, which either grants the subject access to the resource or blocks it entirely. This separation of enforcement from decision-making is fundamental to zero trust architecture, ensuring that access control is centrally governed, consistently applied, and not dependent on implicit trust at any point in the network.

What you'll learn

What's covered

Zero Trust Data & Control Plane

Aligned to

CompTIA Security+
1.2 Summarize fundamental security concepts.
ISC2 CISSP
4.1 Apply secure design principles in network architectures
NIST 800-53
AC-3 Access Enforcement
NIST CSF
PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties.

Key terms

Zero Trust
A security model that assumes no user or device is trusted by default and requires continuous verification.
Policy Enforcement Point
PEP
The component in a Zero Trust architecture that intercepts a subject's request for a resource and enforces the access decision returned by the control plane.
Policy Engine
The component within the Zero Trust control plane that evaluates requests against defined rules and policies to determine whether access should be granted.
Policy Administrator
The control plane component that communicates the policy engine's access decision to the policy enforcement point, issuing a grant or deny instruction.
Control Plane
The part of a network device responsible for making routing and policy decisions, such as running routing protocols to build and maintain the routing table, which the data plane then uses to forward traffic. The control plane handles the intelligence of the network while the data plane handles the actual packet forwarding.
Data Plane
The part of a network device responsible for actually forwarding packets toward their destinations based on rules and tables built by the control plane. In a router, the data plane looks up each packet's destination in the forwarding table and sends it out the correct interface at high speed.

Topics

Zero Trust Network Security Policy Enforcement Point Policy Engine Control Plane Data Plane Cybersecurity

Transcript

A zero trust network utilizes this concept of a data plane and a control plane.

Subject, Resource and Policy Enforcement Point

Let's just jump into the control plane and data plane. First of all, we have what is known as the subject. The subject is the one that's requesting a resource. And then we have the resource; that's what they're trying to gain access to.

Then what happens is we have a policy enforcement point. This is the point which determines, is this subject going to be allowed to this resource or not. Then what happens is that this policy enforcement point raises this to the control plane, and the control plane needs to make a decision. So this is the policy decision point.

The Policy Decision Point

So what is it that goes into making that decision point? First of all, we have the policy engine. This is what we set up with the rules on what's allowed and what's not allowed, and what is going to determine whether this subject gets access to the resource or not. So that's the policy engine. It's all the policies that we have determining how to make this decision right here.

And then the policy engine passes this off to the policy administrator, which gives the yay or nay. So the policy enforcement point speaks directly to this policy administrator, who looks at the policy engine, determines yay or nay, and then it comes back with a yay or nay to the policy enforcement point, and then the subject either gets access to the resource or does not.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →