Zero Trust Architecture

A remote employee opens a payroll application from a company laptop. Traditional perimeter thinking may trust the connection because it came through a corporate VPN.

A zero trust design asks whether this user, device and requested action meet current policy for payroll access. NIST SP 800-207 says location or asset ownership alone does not create implicit trust.

Authentication and authorisation are distinct checks before a session to a resource. The emphasis is on protecting resources rather than merely guarding a network boundary.

Inventory resources first, identifying applications, data sets, service accounts and systems that matter, since a business cannot apply focused policy to payroll records if it does not know where they live or which services use them. Map identities and roles, because employees, contractors, customers and automated services need different entitlements, and a shared administrator account makes it hard to know who performed a sensitive action and when access should end.

Use strong authentication appropriate to risk, since multifactor checks and resistant credentials can reduce account takeover, but recovery routes and support processes also need protection because an attacker may target the weaker reset flow. Assess devices where relevant, as a patched managed laptop and an unknown personal device may pose different risks, and device signals are imperfect, so policies need a route for legitimate users whose devices are misclassified.

Apply least privilege by giving an employee access to the data and functions needed for the job, not every system in the department, and review permissions when a role changes or a contract ends. Segment access to sensitive resources, so that if one account is compromised the attacker does not automatically move from email to finance databases, with network design, application permissions and data controls working together.

The CISA Zero Trust Maturity Model describes a progression across identity, devices, networks, applications and data, with cross-cutting visibility and automation, as a roadmap for agencies rather than a rule that a small business must buy five products at once. Make access decisions using current context where practical, so a sign-in from a new device or unusual location may trigger an extra check, without relying on one signal or making every ordinary action so difficult that users seek workarounds, and log decisions and activity so security teams can investigate an unexpected access or false block, protecting logs from tampering and limiting retention to legitimate needs.

Design policy enforcement near the resource, because a gateway that checks only the initial connection cannot necessarily stop a later unauthorised API call, and include machine identities, since an automated integration with broad permanent credentials can bypass the spirit of least privilege even when employees use multifactor authentication, so rotate secrets and scope service access. Plan for outages: if the identity provider fails, ask what critical work continues and under what controlled emergency procedure, since an unsafe universal bypass can undo the security design while no recovery path can stop operations.

An illustrative coverage measure is critical resources with documented access policies divided by all critical resources inventoried, so if 45 of 50 qualify, coverage is 90%, though it does not prove the policies are effective or the inventory complete; test scenarios such as a departed employee, compromised device, third-party contractor and stolen session, check whether access is refused, logged and recoverable for legitimate users, and review the results rather than declaring a vendor deployment finished. Treat zero trust as gradual change, starting with high-value resources and broken access paths, because replacing a VPN label with a new label without narrowing access changes little; for owners, the goal is to reduce the damage a misplaced credential or device can cause while keeping work possible, so prioritise evidence of actual controls over a product badge or maturity score.