Zero Trust
Zero Trust
ZTNA · SASE · Microsegmentation
1. What Zero Trust Actually Means2. Core Principles (NIST 800-207)3. The Acronym Family4. ZTNA vs VPN5. Microsegmentation for Network Engineers6. Identity Is the New Perimeter7. Pragmatic Adoption Path
1. What Zero Trust Actually Means
"Never trust, always verify." No implicit trust from network location — being on the corporate LAN or VPN grants nothing. Every request is authenticated, authorized, and encrypted, every time, based on identity + device posture + context.
| Old model (castle-and-moat) | Zero Trust |
|---|---|
| Trusted inside, untrusted outside | No trusted network — verify everything |
| VPN grants broad network access | Per-application, least-privilege access |
| Auth once at the perimeter | Continuous verification, short-lived sessions |
| Lateral movement easy after breach | Microsegmentation limits blast radius |
| IP address = identity | User + device + context = identity |
2. Core Principles (NIST 800-207)
- •All data sources and services are resources
- •All communication secured regardless of location
- •Access granted per-session, least privilege
- •Access decided by dynamic policy — identity, device health, behavior
- •Integrity and posture of all assets continuously monitored
- •Authentication and authorization strictly enforced before access
- •Collect telemetry, improve posture
3. The Acronym Family
| Term | What it is |
|---|---|
| ZTNA | Zero Trust Network Access — per-app access broker, the VPN replacement |
| SASE | Secure Access Service Edge — SD-WAN + cloud security stack (SWG, CASB, ZTNA, FWaaS) as one cloud service |
| SSE | Security Service Edge — SASE minus the SD-WAN (just the security half) |
| SWG | Secure Web Gateway — inspects/filters user web traffic |
| CASB | Cloud Access Security Broker — visibility/control over SaaS usage |
| FWaaS | Firewall as a Service — cloud-delivered NGFW |
Vendor reality
Zscaler, Cloudflare (Access/WARP), Palo Alto Prisma, Netskope, Fortinet — all sell the same shape: connector agents + cloud policy enforcement points.
4. ZTNA vs VPN
| Aspect | VPN | ZTNA |
|---|---|---|
| Access scope | Whole network segment | One application per policy |
| Exposure | Open inbound port (attack surface) | Outbound-only connectors; apps invisible |
| Trust | IP/credential at connect time | Identity + device posture, continuously |
| Lateral movement | Possible once in | Blocked by design |
| User experience | Backhaul, slow | Direct-to-cloud, closer to the app |
5. Microsegmentation for Network Engineers
- •Segment by workload/application, not just VLAN/subnet
- •East-west enforcement: host firewalls, NSX/ACI contracts, K8s NetworkPolicy
- •Start with visibility — map real flows before writing policy
- •Default-deny between tiers; allow only documented flows
- •Tags/labels replace IP addresses as the policy language
ACI tie-in
Cisco ACI EPGs + contracts and Kubernetes NetworkPolicy are both microsegmentation — same concept, different layer.
6. Identity Is the New Perimeter
| Building block | Role |
|---|---|
| IdP (Entra ID, Okta) | Single source of user identity, SSO |
| MFA / passkeys | Phishing-resistant authentication |
| Device posture | Disk encryption, EDR present, OS patched — checked before access |
| Conditional access | Policy engine: who + what device + where + risk score |
| PAM | Privileged access with just-in-time elevation and recording |
7. Pragmatic Adoption Path
- •1. MFA everywhere (biggest single win)
- •2. Inventory apps and who actually needs them
- •3. Put critical internal apps behind ZTNA; retire broad VPN scopes gradually
- •4. Device posture checks as an access condition
- •5. Microsegment the crown-jewel systems first
- •6. Log everything centrally; feed detections back into policy
Interview framing
"How would you migrate off VPN?" — run ZTNA alongside VPN, move apps one at a time, shrink VPN scope as each app moves, kill it when the list is empty.