Topic
Cybersecurity Fundamentals
Access models, enforcement points, and the difference between tools that describe risk and tools that issue an allow or deny at the data object.
22 posts
Cybersecurity is the discipline of protecting systems, networks, and data from unauthorized access, disruption, and disclosure. Its controls fall into three groups: preventive controls that stop an action, detective controls that observe one, and architectural choices that decide where enforcement lives. Where enforcement lives determines what survives when a perimeter control fails.
Most programs enforce at the network and identity layers and only describe risk everywhere else. Posture tools inventory exposure but issue no allow or deny, data loss prevention inspects traffic at egress and stops at the download boundary, and a valid session token satisfies the identity layer whether or not the human behind it is legitimate. NIST SP 800-207 names the fix as a policy decision point (PDP) paired with a policy enforcement point (PEP); data-centric zero trust puts that pair around the object.
Posts under this hub separate the concepts practitioners have to keep straight: attribute-based access control (ABAC) against RBAC and ReBAC, what DLP, DRM, DSPM, and data-centric security each enforce, provenance against lineage against chain of custody, cross-domain solutions, and persistent data protection after a file leaves the environment.
Frequently asked questions
What is the difference between DLP and data-centric security?
Data loss prevention inspects content in motion and blocks transfers matching a rule, which works only while traffic passes a chokepoint it controls. Data-centric security encrypts the object and binds policy to it, so every later access requires an authorization decision regardless of where the file sits. DLP watches the exit; data-centric security governs the object itself.
What is a policy decision point?
A policy decision point (PDP) is the component that evaluates an access request against policy and returns an allow or deny. It consumes subject, object, action, and environment attributes, then produces a decision that a policy enforcement point (PEP) sitting in the data path applies. NIST SP 800-207 defines this split as the core of zero trust architecture.
What is data-centric zero trust?
Data-centric zero trust applies zero trust principles at the data object rather than the network segment. Each object carries encryption and attached policy, every access triggers a fresh authorization decision, and the system stays fail-closed when policy cannot be evaluated. It removes the assumption that reaching a network or holding a session grants a right to read what is stored there.
How do you revoke access to a file someone already downloaded?
Cryptographic enforcement is the only mechanism that makes this work. If the file was encrypted at the object level and its key is released per access by a key service bound to policy, revocation means refusing to unwrap the key, and the local copy becomes unreadable bytes. A plaintext copy cannot be recalled, so the decision precedes distribution.
