Zero
Trust

Zero Trust Architecture (ZTA) is a security model, not a product. It eliminates the concept of a trusted internal network — the assumption that everything inside the corporate perimeter is safe. Coined by John Kindervag at Forrester in 2010 and formalized by NIST in SP 800-207, ZTA mandates continuous verification of every request, regardless of origin.

The traditional perimeter model assumed a trusted interior separated from an untrusted exterior by firewalls and VPNs. This model has fundamentally collapsed. The attack surface now spans cloud workloads, remote users, SaaS applications, and third-party supply chains — none of which sit inside a definable perimeter.

The Forces That Killed the Perimeter

CISA's Zero Trust Maturity Model organizes ZTA across five interdependent pillars. Progress in each pillar compounds — strong identity makes micro-segmentation policies more precise; device health data enriches authentication decisions; visibility across all pillars enables automation.

In a Zero Trust model, identity is the control plane. Every access decision — user to app, service to service, workload to data store — flows through an identity provider (IdP). The IdP becomes the authoritative source of truth for who (or what) is requesting access, enriched by contextual signals from device, network, and behavioral analytics.

Identity Provider Architecture

Contextual Access Policy Signals

Multi-factor authentication is necessary but not sufficient. SMS OTP and TOTP codes are vulnerable to real-time phishing (AiTM — Adversary-in-the-Middle attacks). Evilginx, Modlishka, and similar proxy frameworks can intercept and relay valid MFA codes in real time. Zero Trust requires phishing-resistant MFA as the baseline for privileged access.

Privileged accounts are the crown jewels. Domain admins, root accounts, service principals with broad permissions — these are the accounts attackers pivot to after initial compromise. Zero Trust mandates eliminating standing privileged access entirely and replacing it with just-in-time (JIT) and just-enough-access (JEA) models.

Micro-segmentation replaces flat network architecture with granular, policy-enforced zones — down to individual workload or process level. Even if an attacker compromises one workload, east-west (lateral) movement to other workloads is blocked. The goal: a breach in web tier cannot reach the database tier without explicit policy permission.

Segmentation Tiers

Policy Model: Allowlist, Not Denylist

Legacy firewalls operate on denylist logic — block known bad, allow everything else. Micro-segmentation inverts this: deny all by default, allow only explicitly declared flows. Every permitted communication path is intentional and documented.

Zero Trust Network Access (ZTNA) replaces VPN tunnels with identity-aware, application-level access brokers. Instead of granting network access, ZTNA grants application access — only after verifying identity, device posture, and policy, and only to the specific application requested.

ZTNA Deployment Models

A Software-Defined Perimeter (SDP) implements the "need to know" principle at the network layer. Applications and infrastructure are invisible — they do not respond to unauthenticated connection attempts. Only after mutual authentication through a controller does the infrastructure reveal itself and allow connectivity.

Zero Trust protects data, not networks. You cannot apply appropriate controls without knowing what data you have, where it lives, and how sensitive it is. Data classification is the prerequisite to data-aware access policy.

Data-Loss Prevention Integration

DLP policies enforce data classification at the enforcement point — intercepting uploads, emails, and clipboard operations that attempt to move RESTRICTED data to unauthorized destinations. In a ZT model, DLP is a session control layer integrated with the ZTNA/SSE platform.

Device health is a critical signal in ZTA access decisions. A compromised endpoint authenticating with valid credentials should be denied access to sensitive resources. Device posture — MDM enrollment status, patch level, EDR presence, disk encryption — is evaluated continuously, not just at login.

Human users are only half the access problem. Workloads — microservices, functions, pipelines, VMs — communicate constantly, and each communication is an opportunity for lateral movement. Workload identity issues cryptographic identities to every workload and enforces mutual authentication on service-to-service communication.

Secret Management — No Hardcoded Credentials

Zero Trust generates more telemetry than any other security architecture — every access decision, every policy evaluation, every denied request is a data point. This telemetry feeds analytics platforms that detect anomalies, drive policy tuning, and provide the forensic record needed for incident response.

Log Sources — Required for ZTA Baseline

ZTA policies must respond to risk signals faster than human operators can act. Automated policy enforcement closes the gap between detection and response — revoking access, quarantining devices, and isolating workloads in seconds, not hours.

CISA's ZT Maturity Model defines four stages across all five pillars. Organizations rarely advance all pillars simultaneously — focus on achieving ADVANCED across Identity first, as it provides the most immediate risk reduction and enables higher maturity in other pillars.

ZTA is a multi-year journey, not a product purchase. Organizations that try to boil the ocean — rearchitecting everything simultaneously — fail. The most successful implementations use a phased approach that delivers quick wins in identity (highest ROI) while progressively modernizing network and data controls.