8.1 Zero Trust Architecture
Zero Trust Architecture replaces the perimeter model with continuous verification. Every request - even inside the network - is authenticated, authorised, and encrypted.
8.1 The Evolution to Zero Trust
The model before Zero Trust
Castle and moat. Strong perimeter; soft inside. Once an attacker is past the firewall, lateral movement is easy.
Zero Trust core flow
NIST 800-207 components
| Component | Role |
|---|---|
| Policy Engine (PE) | Decides access |
| Policy Administrator (PA) | Enforces decisions |
| Policy Enforcement Point | Sits in the data path |
Signals fed in: identity, device posture, location, behaviour, threat intelligence.
Practical building blocks
| Layer | Modern realisation |
|---|---|
| Identity | IdP + strong MFA + passkeys |
| Device posture | MDM + EDR feed |
| Service-to-service | mTLS + workload identity (SPIFFE / OIDC) |
| Network | Segmentation; private endpoints; no flat L2 |
| Data | DLP + attribute-based encryption |
| Observability | Every decision logged + SIEM correlation |
Worked example - small bank Zero Trust rollout
| Step | Action |
|---|---|
| 1 | IdP consolidation; one MFA model; passkeys for staff |
| 2 | Device posture (MDM + Defender for Endpoint) |
| 3 | Conditional access (managed device + compliant) |
| 4 | Replace VPN with ZTNA (Zscaler, Cloudflare Access) |
| 5 | Internal services behind ZTNA; legacy SSH via bastion |
| 6 | Workload identity for service-to-service mTLS |
What Zero Trust does NOT mean
- Throw away your firewalls; they still defend network bandwidth.
- No internal network at all; segmentation still matters.
- One tool; ZT is a programme, not a product.
Mentor’s tip: Never trust, always verify. Identity + device + workload identity are the three substrates. ZT is a programme, not a product - run it over multiple years against a maturity model.
Discussion
Loading…