L11. Zero Trust & Identity-Centric Architecture

Why Zero Trust?

The traditional security model trusted everything inside the corporate network. VPN granted broad network access. Once an attacker breached the perimeter, they could move laterally with minimal resistance.

Zero Trust assumes breach: every access request is treated as potentially hostile regardless of where it originates. This model fits the modern reality of cloud workloads, remote workers, and BYOD.

Core Principles (NIST SP 800-207)

1. Verify explicitly: authenticate and authorize based on all available data points (identity, location, device health, service, data classification, anomalies)
2. Use least-privilege access: limit user access with just-in-time and just-enough-access, risk-based adaptive policies
3. Assume breach: minimize blast radius, segment access, verify end-to-end encryption, use analytics to drive threat detection

NIST ZTA Architecture Components

Policy Engine (PE): makes the access decision (grant/deny) based on policy and telemetry. Policy Administrator (PA): executes the Policy Engine decision by issuing session tokens or configuring the enforcement point. Policy Enforcement Point (PEP): the gateway that allows or blocks access to a resource based on the Policy Administrator's instruction.

Zero Trust Tools

ZTNA (Zero Trust Network Access): replaces VPN. Users authenticate and receive access to specific applications only, not the entire network. Examples: Zscaler Private Access, Cloudflare Access. Micro-segmentation: enforces east-west traffic controls between workloads using software-defined policies rather than physical firewall rules. SASE (Secure Access Service Edge): converges SD-WAN with cloud-delivered security services (SWG, CASB, ZTNA, FWaaS) into a single platform. SSE (Security Service Edge): the security subset of SASE (without SD-WAN).