Zero Trust Architecture Design

You are a Zero Trust Architecture expert and CCIE Security architect. Design a practical Zero Trust implementation roadmap based on NIST SP 800-207 for this organization.

## Organization Profile
- Size: [Organization size]
- Current architecture: [Current architecture]
- Primary concern: [Primary security concern]
- Platform preference: [Platform preference]

---

## Zero Trust Architecture Design

### 1. Zero Trust Principles (applied to this environment)

- **Never trust, always verify**: no implicit trust based on network location — being on the corporate LAN grants nothing; every access request is verified
- **Least privilege**: users, devices, and services get minimum necessary access; no standing privileges
- **Assume breach**: design as if the attacker is already inside; limit blast radius via micro-segmentation
- **Verify explicitly**: authenticate and authorize based on all available data: identity, device posture, location, time, behavior

### 2. NIST SP 800-207 Pillars — Current State vs Target State

For each pillar, assess the current state from [Current architecture] and define the target:

**Pillar 1: Identity**
- Current gaps: VPN without MFA? Password-only auth? No conditional access?
- Target: MFA for all access (hardware key or TOTP minimum; phishing-resistant FIDO2/WebAuthn preferred)
- Privileged Access Management (PAM): just-in-time access, session recording, approval workflows for admin accounts
- Federation: SAML 2.0 / OIDC federation between IdP (Okta, Azure AD/Entra, Ping) and all applications
- Service accounts: eliminate static service account passwords; use managed service identities or vaulted credentials

**Pillar 2: Device**
- Device registration: only managed, compliant devices get access to sensitive resources
- Compliance checks before access: OS version, patch level, endpoint protection installed and running, disk encryption, screen lock
- Certificate-based device identity: device certificate issued by internal PKI; presented during authentication
- MDM/UEM: Intune, Jamf, or equivalent; enforce compliance policies
- BYOD: separate trust tier — more restricted access than corporate managed devices

**Pillar 3: Network**
- Micro-segmentation: eliminate flat trusted LAN; segment by function (servers, workstations, IoT, printers, guest)
- East-west inspection: internal firewall policy (Palo Alto NGFW, NSX-T, Cisco TrustSec) for inter-segment traffic
- Software-Defined Perimeter (SDP): no implicit access to the network; access to specific application only
- Network access control (NAC): Cisco ISE, Aruba ClearPass, or Forescout for device posture at network join

**Pillar 4: Application**
- ZTNA vs VPN: ZTNA grants access to a specific application, not the network; VPN grants access to the entire network segment
- ZTNA how it works: user authenticates to identity provider; agent or browser checks device posture; if compliant, encrypted tunnel to app proxy (not to network); app proxy connects to internal app on behalf of user
- Application inventory: catalog all applications; classify by sensitivity; define who/what should access each
- Web application: WAF + bot protection in front of public applications

**Pillar 5: Data**
- Data classification: public / internal / confidential / restricted; apply access controls by classification
- DLP (Data Loss Prevention): inspect outbound traffic for sensitive data patterns (SSN, PAN, PHI)
- Encryption at rest and in transit: TLS 1.3 for transit; AES-256 for storage
- Cloud data: CASB (Cloud Access Security Broker) for SaaS data governance

**Pillar 6: Visibility and Analytics**
- SIEM: collect logs from all pillars; correlate for anomaly detection
- UEBA (User and Entity Behavior Analytics): baseline normal behavior; alert on deviations
- Continuous trust scoring: every session has a trust score that can trigger step-up authentication or session termination
- SOC integration: Zero Trust events feed into SOC playbooks

### 3. ZTNA vs Traditional VPN — Why ZTNA Wins

| Aspect | Traditional VPN | ZTNA |
|---|---|---|
| Network access | Full network segment access after auth | Application-specific access only |
| Lateral movement | Attacker can move freely once inside | Confined to authorized apps |
| Device posture | Often not checked | Checked before every session |
| User experience | Slow, hair-pin routing | Direct-to-app, lower latency |
| Scale | Hub-and-spoke, single bottleneck | Cloud-delivered, distributed PoPs |
| Visibility | Limited (encrypted tunnel) | Full session visibility |

### 4. Platform Recommendations for [Platform preference]

**Palo Alto Prisma Access (SASE)**:
- Prisma Access: cloud-delivered ZTNA + CASB + SWG (Secure Web Gateway)
- Prisma SD-WAN: replaces branch VPN with app-aware WAN
- GlobalProtect: agent provides device posture to Prisma Access
- Integration: works with Okta/Azure AD for identity; Cortex XDR for endpoint
- Best for: Palo Alto NGFW customers wanting unified SASE platform

**Zscaler (ZIA + ZPA)**:
- ZIA (Zscaler Internet Access): SWG + CASB + DLP for internet traffic
- ZPA (Zscaler Private Access): ZTNA for internal applications — no network access, app proxy model
- Zero Trust Exchange: cloud fabric connecting users, apps, and data
- Best for: large enterprises with heavy SaaS usage; excellent cloud-delivered scale
- Integration: native integration with Azure AD/Entra, Okta, CrowdStrike

**Fortinet ZTNA (FortiClient + FortiGate)**:
- FortiClient with ZTNA: agent enforces device posture; FortiGate as ZTNA access proxy
- EMS (Endpoint Management Server): manages FortiClient policies and device compliance
- Tight integration with FortiGate NGFW and FortiAnalyzer for logging
- Best for: existing Fortinet customers; on-prem or hybrid deployment

**Cisco (Duo + Umbrella + ISE)**:
- Duo: MFA + device trust (phishing-resistant MFA, SSO, device health checks)
- Umbrella: DNS-layer security + SWG + CASB
- ISE: on-prem NAC for network access control and TrustSec micro-segmentation
- Best for: Cisco-heavy environments; strong on-prem NAC capabilities

**Microsoft Entra (Azure AD) + Defender**:
- Entra Conditional Access: identity-based access control; blocks access if device non-compliant
- Entra Private Access: ZTNA for on-prem apps (replaces VPN for M365 shops)
- Intune: MDM/UEM for device compliance enforcement
- Defender for Endpoint: device risk signals fed into Conditional Access
- Best for: Microsoft 365 / Azure-heavy organizations; lowest TCO if already licensed

### 5. Migration Roadmap (Phased Approach)

Start from [Current architecture] and migrate gradually to avoid disruption:

**Phase 1 (Month 1-3) — Identity foundation**:
- Deploy MFA for all remote access users (Duo, Okta, Entra)
- Enable phishing-resistant MFA (FIDO2) for privileged accounts
- Integrate existing AD with cloud IdP via SAML federation
- Audit privileged accounts: remove standing admin rights

**Phase 2 (Month 3-6) — Device posture**:
- Deploy MDM/UEM (Intune or Jamf); enroll all corporate devices
- Configure conditional access: block access from non-compliant devices
- Deploy device certificates (PKI) for strong device identity
- Segment BYOD from corporate devices at network level

**Phase 3 (Month 6-12) — Application access (ZTNA)**:
- Inventory all internal applications; prioritize by user count and sensitivity
- Deploy ZTNA proxy for top 10 most-used internal apps; retire VPN for those apps
- Enable application-level access logging
- Migrate remaining VPN users to ZTNA over 6-month period

**Phase 4 (Month 12-18) — Network micro-segmentation**:
- Map all internal communication flows (use firewall logs / NetFlow)
- Implement micro-segmentation: separate server, workstation, IoT segments
- Enable east-west inspection on inter-segment traffic
- Decomission flat trusted LAN

**Phase 5 (Month 18+) — Continuous monitoring and optimization**:
- Deploy UEBA for anomaly detection
- Tune conditional access policies based on observed behavior
- Implement continuous trust scoring with automated response (block, step-up auth)
- Quarterly Zero Trust maturity assessment

### 6. Quick Wins (do these first)

For [Primary security concern], the highest ROI actions are:
1. MFA on all user accounts: eliminates 99% of password-based account takeover
2. Privileged access management: contain admin credential theft
3. Endpoint detection and response (EDR): detect post-exploitation activity
4. Network segmentation: limit lateral movement blast radius
5. ZTNA for remote access: eliminate VPN full-network-access risk

### 7. Zero Trust Maturity Model

| Level | Description | Key Capabilities |
|---|---|---|
| Traditional (Level 0) | Perimeter-based, implicit trust | VPN, flat LAN, password-only auth |
| Initial (Level 1) | MFA deployed, basic device checks | MFA, MDM enrollment, log collection |
| Advanced (Level 2) | ZTNA, micro-segmentation | App-level access, segmented network, SIEM |
| Optimal (Level 3) | Continuous verification, automation | UEBA, dynamic trust scoring, automated response |

Current state assessment for [Current architecture]: [provide level with justification]
Target state based on [Primary security concern]: [recommend target level and timeline]