Section 06

Zero Trust Architecture

Zero Trust is a security model based on the principle "never trust, always verify." It assumes that threats exist both outside and inside the network, and every access request must be authenticated, authorized, and encrypted.

The End of Perimeter Security

Traditional security assumed everything inside the network was trusted. Zero Trust recognizes that attackers breach perimeters—the internal network is not safe.

Core Principles

1. Verify Explicitly

Always authenticate and authorize based on all available data points: identity, location, device health, service, data classification, anomalies.

2. Use Least Privilege Access

Limit user access with just-in-time (JIT) and just-enough-access (JEA). Risk-based adaptive policies that respond to context.

3. Assume Breach

Minimize blast radius with segmentation. Verify end-to-end encryption. Use analytics to detect threats and improve defenses.

Zero Trust Pillars

👤

Identities

  • • Strong authentication (MFA)
  • • Passwordless when possible
  • • Conditional access policies
  • • Identity governance
💻

Devices

  • • Device inventory
  • • Compliance checking
  • • Endpoint detection
  • • Mobile device management
📱

Applications

  • • Shadow IT discovery
  • • In-app permissions
  • • Runtime monitoring
  • • API security
📊

Data

  • • Data classification
  • • Encryption everywhere
  • • DLP policies
  • • Access tracking
🏗️

Infrastructure

  • • JIT VM access
  • • Micro-segmentation
  • • Threat detection
  • • Config management
🌐

Networks

  • • Network segmentation
  • • Encrypt all traffic
  • • Real-time threat protection
  • • No implicit trust zones

Zero Trust Network Access (ZTNA)

ZTNA replaces VPNs with identity-aware, context-aware access to specific applications rather than entire network segments.

❌ Traditional VPN

  • • Full network access after auth
  • • Implicit trust of VPN users
  • • Lateral movement possible
  • • Performance bottlenecks
  • • Binary access model

✓ ZTNA

  • • App-specific access only
  • • Continuous verification
  • • No lateral movement
  • • Cloud-native scaling
  • • Granular policies

Policy Engine Architecture

+---------------+      +----------------------+      +---------------+
|    Subject    |----->|    Policy Engine     |----->|   Resource    |
|   (User/App)  |      |                      |      |   (Data/App)  |
+---------------+      |  +----------------+  |      +---------------+
                       |  | Policy         |  |
     Signals --------->|  | Decision       |  |
                       |  | Point (PDP)    |  |
  * Identity           |  +----------------+  |
  * Device health      |         |           |
  * Location           |         v           |
  * Behavior           |  +----------------+  |
  * Data sensitivity   |  | Policy         |  |
                       |  | Enforcement    |  |
                       |  | Point (PEP)    |  |
                       |  +----------------+  |
                       +----------------------+

Implementation Steps

1

Identify Protected Surfaces

Map critical data, applications, assets, and services (DAAS).

2

Map Transaction Flows

Understand how users and apps access protected surfaces.

3

Architect Zero Trust Network

Deploy micro-perimeters around each protected surface.

4

Create Zero Trust Policies

Define who/what/when/where/why/how for access (Kipling Method).

5

Monitor and Maintain

Continuous logging, analytics, and policy refinement.

Zero Trust Tools & Platforms

Identity Providers

Okta, Azure AD, Google Workspace, Ping Identity

ZTNA Solutions

Zscaler, Cloudflare Access, Palo Alto Prisma, Akamai EAA

Micro-Segmentation

Illumio, VMware NSX, Guardicore, Cisco Tetration

Policy Engines

Open Policy Agent (OPA), AWS Cedar, Styra DAS

← Previous: Secure by Design Next: Cloud-Native Security →