Lesson 2.4: Zero Trust Architecture | CCP

Introduction: The Death of the Perimeter

"The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards." — Gene Spafford, Purdue University

For decades, network security followed the "castle and moat" model: build strong walls (firewalls), dig a deep moat (DMZ), and trust everyone inside. But this model has a fatal flaw: once attackers get past the perimeter, they have free reign.

The 2009 Operation Aurora attack on Google changed everything. Sophisticated attackers (allegedly state-sponsored) bypassed perimeter defenses and moved laterally through internal networks for months. Google's response? Build a new security architecture that assumed the network was already compromised.

They called it BeyondCorp. The industry now calls it Zero Trust.

🎯 Lesson Objectives

By the end of this lesson, you will be able to:

Explain Zero Trust principles and the NIST SP 800-207 framework
Design micro-segmentation strategies for enterprise networks
Implement identity-centric security controls
Evaluate SASE (Secure Access Service Edge) architectures
Develop a Zero Trust implementation roadmap

1. Zero Trust Fundamentals

1.1 The Core Philosophy

Zero Trust Mantra

"Never trust, always verify."

No user, device, or network should be trusted by default—regardless of location. Every access request must be verified, validated, and authorized before granting access.

1.2 The Three Pillars of Zero Trust

1️⃣ Verify Explicitly

Always authenticate and authorize based on all available data points: identity, location, device health, service/workload, data classification, and anomalies.

Example: Don't just check username/password. Also verify: Is this the user's usual device? Location? Time of day? Is the device patched and compliant?

2️⃣ Use Least Privilege Access

Limit access to only what's needed, only when needed, with just-in-time (JIT) and just-enough-access (JEA) policies.

Example: A developer gets access to production for 4 hours to debug an issue—not permanent access "just in case."

3️⃣ Assume Breach

Design security controls assuming attackers are already inside. Minimize blast radius, segment access, verify end-to-end encryption, use analytics to detect threats.

Example: Even if someone has valid credentials, monitor for lateral movement, unusual data access, or privilege escalation.

1.3 Zero Trust vs. Traditional Security

Traditional "Castle & Moat"

Trust based on network location
Once inside, mostly trusted
Perimeter-focused security
Static access policies
VPN for remote access
Implicit trust within network

Zero Trust Architecture

Trust based on verified identity
Continuous verification required
Identity and data-focused
Dynamic, risk-adaptive policies
Identity-aware proxy for access
No implicit trust anywhere

2. NIST SP 800-207: The Zero Trust Blueprint

In August 2020, NIST released Special Publication 800-207, "Zero Trust Architecture"—the definitive government guidance on implementing Zero Trust. It's essential reading for any security professional.

2.1 NIST Zero Trust Tenets

1

All data sources and computing services are considered resources

Not just servers—every device, user, and data flow is a potential access point that needs protection.

2

All communication is secured regardless of network location

Encrypt everything. Internal network ≠ trusted network. The Starbucks Wi-Fi and the office LAN get the same treatment.

3

Access to individual enterprise resources is granted on a per-session basis

Just because you accessed the file server 5 minutes ago doesn't mean you can now. Each request is evaluated independently.

4

Access is determined by dynamic policy

Policies consider identity, application, device health, behavior, and threat intelligence—not just static rules.

5

Enterprise monitors and measures integrity and security posture of all assets

Continuous monitoring, not point-in-time audits. Devices without updated patches don't get access.

6

All resource authentication and authorization are dynamic and strictly enforced

Re-authentication may be required when risk increases (e.g., accessing sensitive data, unusual behavior).

7

Enterprise collects as much information as possible about network infrastructure and communications

Use this data to improve security posture. Analytics and machine learning identify anomalies.

2.2 NIST Zero Trust Architecture Components

Core Components

Policy Engine (PE)

Brain of the system. Makes access decisions based on policy and input from various data sources.

Policy Administrator (PA)

Executes decisions from PE. Establishes or terminates communication paths.

Policy Enforcement Point (PEP)

Gatekeeper that enables/disables access. Could be a gateway, proxy, or agent on endpoint.

💡 Zero Trust Flow Example

Scenario: Employee Priya wants to access the HR database from her laptop.

Request: Priya's laptop contacts the PEP (identity-aware proxy)
Identity Verification: PEP requests authentication; Priya provides password + MFA
Device Assessment: PEP checks: Is laptop enrolled? Patched? Encrypted? Compliant?
Context Evaluation: PE assesses: Priya's role (HR)? Normal location? Usual time?
Policy Decision: PE grants access to HR database (not finance, not engineering)
Session Established: PA instructs PEP to allow connection, encrypted end-to-end
Continuous Monitoring: If Priya's behavior becomes anomalous (bulk download), session may be terminated

3. Micro-segmentation: Shrinking the Blast Radius

"If you can't prevent a breach, at least contain it. Micro-segmentation turns your network into a submarine—compartmentalized so that flooding one area doesn't sink the whole vessel."

3.1 What is Micro-segmentation?

Micro-segmentation divides the network into small, isolated segments at the workload level. Unlike VLANs (which segment at the network level), micro-segmentation can control traffic between individual applications, containers, or even processes.

3.2 Micro-segmentation vs. Traditional Segmentation

Aspect	Traditional (VLANs/Firewalls)	Micro-segmentation
Granularity	Network/subnet level	Workload/application level
Policy Basis	IP addresses, ports	Identity, tags, attributes
East-West Traffic	Limited visibility	Full control and visibility
Cloud Compatibility	Difficult to implement	Cloud-native support
Dynamic Workloads	Manual updates needed	Policies follow workloads

3.3 Implementing Micro-segmentation

Step 1

Discover and Map

Use network discovery tools to map all communication flows. You can't protect what you don't know exists.

Step 2

Classify Workloads

Tag workloads by application, environment (dev/prod), sensitivity, compliance requirements.

Step 3

Define Policies

Create allow-list policies: "Web tier can talk to app tier on port 8080; app tier can talk to database on 3306."

Step 4

Enforce Gradually

Start in monitoring mode. Review alerts for false positives. Then enforce—first on non-critical systems.

Step 5

Monitor Continuously

New workloads, changed communication patterns, policy violations—all need ongoing attention.

💡 Micro-segmentation in Action: Preventing Lateral Movement

Without Micro-segmentation: Attacker compromises web server → pivots to app server → reaches database → exfiltrates data.

With Micro-segmentation: Attacker compromises web server → tries to reach app server → BLOCKED (web server only allowed to receive requests, not initiate connections to app tier) → attack contained.

The breach still happened, but the damage is limited to one server instead of the entire infrastructure.

4. Identity-Centric Security

In Zero Trust, identity is the new perimeter. Instead of trusting users because they're on the corporate network, we trust users because we've verified who they are, what device they're using, and whether their behavior is normal.

4.1 Key Identity Components

🆔 Identity Provider (IdP)

Central source of truth for user identities. Authenticates users and issues tokens.

Examples: Azure AD, Okta, Google Workspace, Ping Identity

🔐 Multi-Factor Authentication (MFA)

Something you know (password) + something you have (phone/token) + something you are (biometrics).

Phishing-Resistant: FIDO2/WebAuthn, hardware keys (YubiKey)

🔑 Single Sign-On (SSO)

One authentication for all applications. Reduces password fatigue and attack surface.

Protocols: SAML 2.0, OpenID Connect, OAuth 2.0

👤 Privileged Access Management (PAM)

Special controls for admin accounts: vaulting, session recording, just-in-time access.

Tools: CyberArk, BeyondTrust, HashiCorp Vault

4.2 Conditional Access Policies

Conditional access evaluates context to make dynamic access decisions:

Conditional Access Policy Example (Azure AD):

IF:
    User: Any
    Application: Sensitive Finance App
    Device Platform: Any
    Location: Outside corporate network
    Device State: Not compliant OR Not managed
    
THEN:
    Grant: Require MFA + Compliant device
    Session: Force re-authentication every 4 hours
    
ELSE IF:
    Location: Corporate network
    Device State: Compliant AND Managed
    
THEN:
    Grant: Allow access
    Session: Standard 8-hour session

⚠️ The SolarWinds Wake-Up Call

In the SolarWinds attack, attackers used compromised credentials to move laterally. They specifically targeted identity infrastructure—forging SAML tokens (Golden SAML attack) to impersonate any user.

Lesson: Identity infrastructure is a critical target. Apply Zero Trust principles to the identity system itself: monitor IdP logs, require MFA for admins, detect anomalous token usage.

5. SASE: Converging Network and Security

Secure Access Service Edge (SASE, pronounced "sassy") is Gartner's framework for converging network and security services into a unified, cloud-delivered service.

5.1 What is SASE?

SASE = WAN Edge + Security Edge

Combines SD-WAN capabilities with cloud-native security (SWG, CASB, ZTNA, FWaaS) delivered as a single service.

5.2 SASE Components

Component	Function	Replaces
SD-WAN	Intelligent routing, WAN optimization, direct cloud access	MPLS, traditional WAN
ZTNA (Zero Trust Network Access)	Identity-based application access, no VPN needed	Traditional VPN
SWG (Secure Web Gateway)	URL filtering, malware scanning, SSL inspection	On-prem web proxies
CASB	Cloud app visibility, DLP, compliance	Point CASB solutions
FWaaS (Firewall as a Service)	Cloud-delivered firewall, IPS	Branch firewalls

5.3 Why SASE Matters

💡 The Traditional vs. SASE Architecture

Traditional: Remote employee → VPN to HQ → through firewall/proxy → to cloud app (Salesforce)

Result: High latency, backhauling all traffic through HQ, poor user experience.

SASE: Remote employee → nearest SASE PoP → security applied in cloud → direct to Salesforce

Result: Low latency, consistent security regardless of location, better experience.

6. Zero Trust Implementation Roadmap

Zero Trust isn't a product you buy—it's a journey. Here's a practical roadmap:

Phase 1: Foundation (3-6 months)

Inventory all users, devices, applications, data flows
Implement strong identity (MFA everywhere)
Deploy endpoint detection and response (EDR)
Enable comprehensive logging

Phase 2: Segmentation (6-12 months)

Classify data and applications by sensitivity
Implement network segmentation for critical assets
Deploy micro-segmentation for crown jewels
Establish baseline behaviors for anomaly detection

Phase 3: Zero Trust Access (12-18 months)

Replace VPN with ZTNA for application access
Implement conditional access policies
Deploy just-in-time privileged access
Automate security response to threats

Phase 4: Optimization (Ongoing)

Continuously refine policies based on data
Integrate threat intelligence
Measure and improve security posture
Extend Zero Trust to OT/IoT environments

⚖️ Regulatory Push for Zero Trust

US Executive Order 14028 (May 2021): Mandates federal agencies to adopt Zero Trust Architecture within 2 years. This is driving global adoption.

India: While no specific Zero Trust mandate exists, RBI's cyber security framework for banks emphasizes "defense in depth" and "least privilege"—core Zero Trust principles. CERT-In guidelines also recommend similar approaches.

📝 Key Takeaways

1

Zero Trust core: Never trust, always verify—regardless of network location

2

NIST 800-207 provides the architectural framework: Policy Engine, Policy Administrator, PEP

3

Micro-segmentation limits blast radius by controlling workload-to-workload communication

4

Identity is the new perimeter—strong authentication + conditional access are essential

5

SASE converges networking and security for distributed workforce and cloud-first organizations

📚 Further Reading

NIST SP 800-207: Zero Trust Architecture (August 2020)
Google BeyondCorp: A New Approach to Enterprise Security (research papers)
Gartner: Market Guide for Zero Trust Network Access (2023)
CISA: Zero Trust Maturity Model (US Cybersecurity Agency)
Forrester: The Zero Trust eXtended (ZTX) Ecosystem