EDUCATION, ZERO TRUST, ARCHITECTURE

🛡️ Zero Trust Guide - Zero Trust Architecture

Six sections on Zero Trust in International Practice: Basic Principles (NIST SP 800-207), Architecture Components (PEP, PDP), CISA five pillars, maturity levels, gradual transition model and relation to the requirements of Article 21 of the NIS2. Examples are fictional, designed for training.

Seven basic principles

NIST SP 800-207 §2.1 - do not trust, always check

Zero Trust Paradigma From the perimeter model to Zero Trust: there is no longer a presumption that the internal network is secure - every access request is re-examined. Paradise Change: Perimeter → Zero Trust OLD MODEL perimeter (castle & moat) Internal Network = Reliable VPN/firewall → "all inside is safe" EVOLUTION ZERO TRUST never trust, always verify POLICY each request is checked
01
All resources

A resource is considered to be everything that contains or processes data: servers, databases, API, SaaS, employees' personal devices (BYOD) and IoT.

02
Encrypted compounds

All connections are encrypted (TLS, mTLS) regardless of location on the network - the internal network is not more reliable than the Internet.

03
Access to one session

Access to each resource is given for one session: the user is checked before each session, not once for all.

04
Decision after context

The decision shall take into account who requires a device from where, when and whether there are suspicious signs - not just username and password.

05
Continuous monitoring

The organisation shall continuously monitor the integrity and reliability of its resources (CDM, EDR, equipment condition check).

06
Every inspection

Identity and rights shall be verified before each access - each time again, without exception.

07
Telemetry collection

The organisation shall collect and use data on devices, networks and connections to improve safety.

In practice

These seven principles are also the definition of Zero Trust. If the architecture does not follow them, it is not Zero Trust, but the marketing name.

Reference

NIST SP 800-207 §2.1 (2020) - "Tenets of Zero Trust," Identity as new perimeter.

Safety Note

Zero Trust is not a product you can buy. It is a strategy that has to put identities, devices, networks and data together over several years.

Logical components

PEP / EDP - how policy becomes a decision

Zero Trust Architecture PDP centre with PE and PA, contextual data sources on the side (CDM, ID Mgmt, PCI, Threeat Intel, Data Policy, SIEM). Data plane (Subject → PEP → Resource) under the PDP. Control plane between PEP and PDP. Architecture components of Zero Trust NIST SP 800-207 §3 - Control plane (top) and data plane (lower) CDM asset position posture, patches ID Management IdP, MFA, DSO RAC, ABAC CCI certificates mTLS, identity PDP - Policy Decision Point control plane PE - Policy Engine take a decision (allow / deny) trust algorithm PA - Policy Administrator create / demolish session tokens, accreditations Threeat Intel threat signals IoC, KEV Directory Data Policy not known DLP, Markings SIEM / Window audit records analysis of activities Subject user, device service account PEP Policy Enforcement Point proxy, gateway, sidecar Resource app, API database, file request allow / token query decision Signals from the side go to the PDP, data go through the PEP - the PDP itself does not see the data

One demand through PEP and PDP

How the decision is made for every request - and why the resource itself is not visible.

Access request

  1. 1
    User → PEPdemand for a wage system

    User wants to open the salary system. The demand first goes to the gate (PEP) - it is not for the resource.

  2. 2
    PEP → PDPdo i allow?what, device, place, time

    PEP asks the EDP and conveys the context.

  3. 3
    PDPMFA out? device updated and with EDR? country or time not used?

    PDP evaluates multiple signals, not just password. The decision is for this session, not forever.

  4. 4
    PDP → PEPto allow this session

    Alternatively, the answer may be 'prohibit' or 'request for an additional test'.

  5. 5
    PEP → Resourcerequest transmitted

    Only now demand reaches the resource. The resource itself is not visible from the network.

  6. 6
    NoteIf the device becomes inadequate during the session, the PDP session shall be closed.

    Checking is not unique at the entrance - it continues the entire session.

In practice

PEP is the gate through which every demand passes. The PDP is the point where the decision is made: 'yes', 'no' or 'yes, but with an additional check'.

Reference

NIST SP 800-207 §3 - "Logical Components of ZTA," CDM = Continued Diagnostics & Mitigation.

Safety Note

If the PDP does not work, nothing (single point of file) does work. It therefore needs duplicate nodes and an emergency access (break-glass) procedure that works without it.

CISA Zero Trust Matfulness Model v2

Five pillars and three common foundations

CISA Zero Trust five pillars Five pillars (Identity, Devices, Networks, Applications, Data) and three common foundations (Visibility, Automation, Management). CISA ZTMM v2 - pillars and common foundations 1. Identity Identity MFA, FIDO2, DSO IdP, JIT access privileged ID risk-based auth PE signal #1 2. Devices Devices EDR, MDM posture: patch, OS device certificates BYOD Policy PE signal #2 3. Networks Networks microsegmentation ZTNA, SDP encrypted flow SEE/CASB PE signal #3 4. Applications Applications & Workloads CI/CD safety workload identity RASP, WAF SBOM, Secure dev PE signal #4 5. Data Data classification, markings DLP, encryption rights management data lineage PE signal #5 Common Basis #1: Visibility & Analytics Common basis #2: Automation & Orchestration Joint Foundation #3: Governance

In practice

Five pillars are the technical basis. Each of them gives a signal to the PDP, so that the decision is based on a full picture rather than one characteristic, such as a password.

Reference

CISA Zero Trust Stability Model v2 (2023), DoD Zero Trust Reference Architecture (2022) - a similar approach with seven pillars.

Rapid inspection

If a pillar does not give a PDP signal, it is not yet Zero Trust - only part of it, such as identity or network.

Four levels of maturity

Traditional → Initial → Advanced → Optimal

Zero Trust maturity levels Four levels of maturity - from a traditional perimeter to a fully automated Zero Trust. CISA ZTMM v2 maturity levels Each pillar is valued separately - it can be at different levels Traditional Traditional Perimeter + static - VPN + passwords - Manual access governance - Individual tools - Low visibility - Incidents addressed by fact starta punkts Initial Baseline MFA + segmentation - MFA for all - Network segmentation - Central IdP/SSO - EDR devices - Manual policy - Central magazines ~12-18 months Advanced Advanced Decision after context - Risk-based MFA - Microsegmentation - Device posture - DLP + classification - SEM + SOAR - JIT/JEA access ~2-3 gadi Optimal Optimum Full automation - Passwordless - Continued auth - Dynamic decisions - ML/AI signals - Automated answer - Encrypted data everywhere strategic objective Time limits shall be indicative. Each pillar is valued separately - identity can be Advanced while data is still Initial

In practice

The sedition table helps to honestly assess where the organization is now and choose what to do in the next 12-24 months. Each pillar shall be assessed separately.

Reference

CISA ZTMM v2 (2023), M-22-09 (OMB for ZT Memoranda), DoD Zero Trust Strategy (2022).

Safety Note

From Traditional immediately to Optimal don't go - each step needs to change processes, train the team and anticipate the budget. A real road is 3-5 years.

Phase-in

From the perimeter to Zero Trust - a realistic road map

Zero Trust Transition Model The transition from the perimeter to Zero Trust in seven steps. Phased transition model - NIST SP 800-207 §7 1. Inventory the flows of assets, entities and business process CMDB, SBOM, datu kart. 2-4 months 2. Identity + MFA central IdP, FIDO2 all (including services) passwordless path 3-6 months 3. State of the devices EDR, MDM, updates device certificates posture → PE signal 6-12 months 4. Microsegmentation isolation of applications ZTNA replaces VPN least privatege network 12-18 months 5. Data classification markings, DLP encrypted data stored data-aware politika 12-18 months 6. Policy engine PDP centralised decisions by context trust algorithm 18-24 months 7. Automation SOAR, continuous auth ML/AI risk signals self-healing politika 24-36 months ∞ Continuously measure, improve, restore maturity ratings safety condition all time Phases overlap - Step 2 will continue also when the 3rd "Quick win" projects start giving a visible result already in the first year First benefit: MFA and central IdP closes the most frequent intrusion path - stolen passwords

In practice

The plan helps to anticipate budget and team workload. The first steps (MFA inventory) improve safety already in the first year - do not wait until everything is ready.

Reference

NIST SP 800-207 §7 - "Migrating to a Zero Trust Architecture', NIST SP 1800-35 (2025, practical implementation), M-22-09 (OMB deadlines for US federal authorities).

Step one

Start by counting devices, systems and accounts. You can't protect what you don't know about.

Eligibility Framework

Zero Trust as a way to comply with Article 21 of the NIS2

The relationship between Zero Trust and NIS2 Article 21 (2) of the NIS2 Directive and the corresponding controls of Zero Trust. Which controls of Zero Trust cover the requirements of Article 21 of the NIS2 Zero Trust is optional - this is one recognised way to comply with Article 21 of the NIS2 21(2)(a) risk analysis + security policy 21 (2) (b) incident management 21 (2) (d) supply chain security 21 (2) (e) secure acquisition and development of the network/systems. 21(2)(f) evaluation of the effectiveness of measures 21(2)(i) asset and personnel security 21 (2) (j) MFA and continuous authentication EDP Policy + Risk-based Decisions dynamic risk analysis at each session SIEM + SOAR + withdrawal of session PA immediately withdraws the token at the abnormality Workload identity + SBOM + supply chain ZT third parties also pass through the PEP Secure dev + CI/CD policy + RASP/WAF application pillar CDM + posture measurements + audit records continuous verification of compliance Inventory + JIT/JEA + privileged ID least privatege for all assets FIDO2 + passwordless + continuous auth direct implementation of NIS2 21(2)(j)

In practice

The NIS2 Zero Trust is not directly required, but parts of it cover well the risk management measures of Article 21. The same architecture can demonstrate compliance without individual 'NIS2 tools'.

Reference

Directive (EU) 2022/2555 (NIS2), Article 21 of Commission Implementing Regulation (EU) 2024/2690 (technical requirements for providers of digital infrastructure and managed services).

Safety Note

Compliance is not yet safety. Also formally fulfilled NIS2 requirements can leave holes - use this table as a plan, not as a list of ticks.

Abbreviations

Abbreviations used in the Roadmap: the original name and what it means.

ABAC
Attribute-Based Access Control - access by attributes - roles, devices, time, data class.
BYOD
Bring Your Own Device - the employee's personal device used for the job.
CDM
Continuous Diagnostics and Mitigation - U.S. program for continuous monitoring of devices and configurations.
CISA
Cybersecurity and Infrastructure Security Agency - US Cyber Security and Infrastructure Agency.
CMDB
Configuration Management Database - IT equipment, systems and their liability accounting database.
DLP
Data Loss Prevention - tools to stop the transmission of sensitive data outside the organisation.
EDR
Endpoint Detection and Response - monitoring of computers and servers that detect and stop suspicious activities.
FIDO2
Standard for login keys (also pisskey) - persistent authentication for phishing.
IdP
Identity Provider - a system that checks the user and confirms his/her identity for other systems (e.g. Entra ID, Octa).
IoC
Indicator of Compromise - a sign that the system is cracked - address, fileprint, domain.
JIT / JEA
Just-In-Time / Just-Enough-Access - right only for a short time and only as much as the job needs.
KEV
Known Exploited Vulnerabilities - CISA catalog with injuries already used by attackers.
MDM
Mobile Device Management - central management of devices - settings, encryption, remote deletion.
MFA
Multi-Factor Authentication - login with at least two factors (password and code or key).
OMB
Office of Management and Budget - the US authority; its memorandum M-22-09 sets the terms of Zero Trust for the federal authorities.
PA
Policy Administrator - open or close a session following a PE decision.
PDP
Policy Decision Point - the place where the access decision is taken (PE and PA together).
PE
Policy Engine - engine of the decision: to allow, refuse or require additional verification.
PEP
Policy Enforcement Point - the gate that executes the decision - proxy, gateway, sidecar.
PKI
Public Key Infrastructure - the system of issuing and checking certificates.
RASP
Runtime Application Self-Protection - the protection which operates within the app during its operation.
RBAC
Role-Based Access Control - access by role (accountant, administrator).
SASE
Secure Access Service Edge - a cloud service that combines network access and security checks.
CASB
Cloud Access Security Broker - an intermediary supervising and restricting the use of cloud services.
SBOM
Software Bill of Materials - list of software components and addictions.
SDP
Software-Defined Perimeter - the network resource is not visible until the user has been checked.
SIEM
Security Information and Event Management - central collection of magazines, correlation and warnings.
SOAR
Security Orchestration, Automation and Response - automatic response to alerts in a pre-established scenario.
SSO
Single Sign-On - one application that fits several systems.
TLS / mTLS
Transport Layer Security / mutual TLS - encrypted connection; mTLS - certificate presented by both parties.
WAF
Web Application Firewall - a firewall that filters attacks on web applications.
ZTA
Zero Trust Architecture - Zero Trust Architecture (NIST SP 800-207).
ZTMM
Zero Trust Maturity Model - CISA Zero Trust maturity model.
ZTNA
Zero Trust Network Access - post-test access to a specific application, at the VPN site that opens the whole network.