Section 06

Zero Trust Architecture

Zero Trust is a security model based on the principle "never trust, always verify." It assumes that threats exist both outside and inside the network, and every access request must be authenticated, authorized, and encrypted.

The End of Perimeter Security

Traditional security assumed everything inside the network was trusted. Zero Trust recognizes that attackers breach perimeters—the internal network is not safe.

Core Principles

1. Verify Explicitly

Always authenticate and authorize based on all available data points: identity, location, device health, service, data classification, anomalies.

2. Use Least Privilege Access

Limit user access with just-in-time (JIT) and just-enough-access (JEA). Risk-based adaptive policies that respond to context.

3. Assume Breach

Minimize blast radius with segmentation. Verify end-to-end encryption. Use analytics to detect threats and improve defenses.

Zero Trust Pillars

👤

Identities

  • • Strong authentication (MFA)
  • • Passwordless when possible
  • • Conditional access policies
  • • Identity governance
💻

Devices

  • • Device inventory
  • • Compliance checking
  • • Endpoint detection
  • • Mobile device management
📱

Applications

  • • Shadow IT discovery
  • • In-app permissions
  • • Runtime monitoring
  • • API security
📊

Data

  • • Data classification
  • • Encryption everywhere
  • • DLP policies
  • • Access tracking
🏗️

Infrastructure

  • • JIT VM access
  • • Micro-segmentation
  • • Threat detection
  • • Config management
🌐

Networks

  • • Network segmentation
  • • Encrypt all traffic
  • • Real-time threat protection
  • • No implicit trust zones

Zero Trust Network Access (ZTNA)

ZTNA replaces VPNs with identity-aware, context-aware access to specific applications rather than entire network segments.

❌ Traditional VPN

  • • Full network access after auth
  • • Implicit trust of VPN users
  • • Lateral movement possible
  • • Performance bottlenecks
  • • Binary access model

✓ ZTNA

  • • App-specific access only
  • • Continuous verification
  • • No lateral movement
  • • Cloud-native scaling
  • • Granular policies

Policy Engine Architecture

Zero Trust Policy Engine Architecture

graph LR Subject["👤 Subject (User / App)"] subgraph PDP["Policy Engine (PDP)"] IdP["🔑 Identity Provider (Entra ID / Okta)"] PolicyAdmin["📋 Policy Decision Point • Evaluate policy • Risk score • Device trust • User behavior"] Threat["🔍 Threat Intel Feeds"] DataPolicy["📊 Data Access Policy"] end PEP["🛡️ Policy Enforcement Point (PEP)"] Resource["🖥️ Resource (Data / App)"] Signals["📡 Signals • Identity • Device health • Location • Behavior • Data sensitivity"] Subject --> PDP Signals --> PDP PDP -->|"Allow / Deny + Context"| PEP Subject --> PEP PEP --> Resource

Implementation Steps

1

Identify Protected Surfaces

Map critical data, applications, assets, and services (DAAS).

2

Map Transaction Flows

Understand how users and apps access protected surfaces.

3

Architect Zero Trust Network

Deploy micro-perimeters around each protected surface.

4

Create Zero Trust Policies

Define who/what/when/where/why/how for access (Kipling Method).

5

Monitor and Maintain

Continuous logging, analytics, and policy refinement.

NIST SP 800-207

NIST Special Publication 800-207 defines the authoritative Zero Trust Architecture reference. It describes three deployment approaches: Enhanced Identity Governance, Micro-Segmentation, and Software Defined Perimeters (SDP). Most enterprises blend all three.

Practical: OPA Policy for Zero Trust Access

zero-trust-policy.rego
rego 
package zerotrust.access

import rego.v1

default allow := false

# Require ALL conditions for access (never trust, always verify)
allow if {
    identity_verified
    device_compliant
    context_acceptable
    permission_granted
}

# Identity must be authenticated with MFA
identity_verified if {
    input.identity.authenticated == true
    input.identity.mfa_verified == true
    time.now_ns() < input.identity.token_expiry_ns
}

# Device must meet compliance baseline
device_compliant if {
    input.device.managed == true
    input.device.os_patched == true
    input.device.encryption_enabled == true
    input.device.edr_running == true
    input.device.risk_score < 50
}

# Context checks: location, time, behavior
context_acceptable if {
    not input.context.impossible_travel
    input.context.risk_score < 70
}

# RBAC + resource-level check
permission_granted if {
    required_role := data.resource_roles[input.resource.path][input.method]
    required_role == input.identity.roles[_]
}
package zerotrust.access

import rego.v1

default allow := false

# Require ALL conditions for access (never trust, always verify)
allow if {
    identity_verified
    device_compliant
    context_acceptable
    permission_granted
}

# Identity must be authenticated with MFA
identity_verified if {
    input.identity.authenticated == true
    input.identity.mfa_verified == true
    time.now_ns() < input.identity.token_expiry_ns
}

# Device must meet compliance baseline
device_compliant if {
    input.device.managed == true
    input.device.os_patched == true
    input.device.encryption_enabled == true
    input.device.edr_running == true
    input.device.risk_score < 50
}

# Context checks: location, time, behavior
context_acceptable if {
    not input.context.impossible_travel
    input.context.risk_score < 70
}

# RBAC + resource-level check
permission_granted if {
    required_role := data.resource_roles[input.resource.path][input.method]
    required_role == input.identity.roles[_]
}

CISA Zero Trust Maturity Model

Pillar Traditional Advanced Optimal
Identity Passwords, basic MFA Phishing-resistant MFA Continuous validation, passwordless
Devices Inventory exists Compliance enforced Real-time risk scoring, auto-remediation
Networks Macro-segmentation Micro-segmentation Encrypted everywhere, no implicit trust
Applications Some cloud integration SSO + context-aware access Per-request authz, runtime monitoring
Data Basic classification Auto-classification, DLP Granular controls per datum, full lineage

Migration Strategy: VPN to Zero Trust

Phase 1: Foundation (Months 1-3)

  • • Inventory all users, devices, and applications
  • • Deploy centralized identity provider with MFA
  • • Map application access patterns and dependencies
  • • Start with low-risk applications (e.g., SaaS apps)

Phase 2: Expand (Months 4-8)

  • • Deploy ZTNA proxy for internal web apps
  • • Implement device compliance checking
  • • Add conditional access policies (location, risk)
  • • Run VPN and ZTNA in parallel — migrate app by app

Phase 3: Optimize (Months 9-12)

  • • Decommission VPN for migrated apps
  • • Enable micro-segmentation in production
  • • Deploy continuous verification and adaptive policies
  • • Measure: mean time to detect (MTTD), mean time to contain (MTTC)

Zero Trust Tools & Platforms

Identity Providers

Okta, Azure AD, Google Workspace, Ping Identity

ZTNA Solutions

Zscaler, Cloudflare Access, Palo Alto Prisma, Akamai EAA

Micro-Segmentation

Illumio, VMware NSX, Guardicore, Cisco Tetration

Policy Engines

Open Policy Agent (OPA), AWS Cedar, Styra DAS

Framework Alignment

NIST SP 800-207: Zero Trust Architecture reference standard
NIST CSF 2.0: PR.AC (Access Control), PR.DS (Data Security), DE.CM (Continuous Monitoring)
CISA: Zero Trust Maturity Model v2.0 (5 pillars: Identity, Devices, Networks, Applications, Data)
CIS Controls v8.1: 6 (Access Control), 12 (Network), 13 (Monitoring)
Related: Security Frameworks → | Reference Architectures →
← Previous: Secure by Design Next: Cloud-Native Security →