Topic
Zero Trust Architecture
How zero trust works, what the standards require, and why enforcement usually stops before it reaches the data itself.
63 posts
Zero trust is a security model that grants no implicit trust to any user, device, network, or workload, and verifies every access request against policy at the moment it is made. NIST SP 800-207 defines the architecture: a policy decision point (PDP) evaluates the request, and a policy enforcement point (PEP) carries out the verdict. The default answer is deny, and a correct implementation stays fail-closed when the PDP is unreachable.
Most programs implement zero trust at the identity and network layers and stop there. That leaves the data plane governed by whatever the receiving system chooses to do, and once a file is decrypted and downloaded, every enforcement point sits behind it. The CISA Zero Trust Maturity Model 2.0 scores data as its own pillar, and it is the pillar where maturity ratings fall furthest.
Posts under this hub cover the standards that define the model, including NIST SP 800-207, NIST SP 1800-35, CISA Zero Trust Maturity Model 2.0, and the DoD Zero Trust Overlays. Others work through attribute-based access control (ABAC), data-centric zero trust, and breach analyses where identity controls held and the data layer did not.
Frequently asked questions
What is zero trust architecture?
Zero trust architecture verifies every access request against policy instead of trusting anything inside a network perimeter. NIST SP 800-207 describes the logical components: a policy decision point evaluates identity, device, and context attributes, and a policy enforcement point grants or denies the request. Decisions happen per request rather than per session, and the system denies by default when policy cannot be evaluated.
What does NIST SP 800-207 actually require?
NIST SP 800-207 is a reference architecture rather than a compliance checklist, so it mandates no specific product. It defines the components of a zero trust deployment: a policy engine, a policy administrator, a policy enforcement point, and the data sources that feed access decisions. NIST SP 1800-35 adds implementation guidance built from working demonstrations of those components.
How is zero trust different from a VPN?
A VPN authenticates a user once and then grants network reachability, which is implicit trust at scale. Zero trust makes an authorization decision for each request using current attributes about the subject, device, and resource. Compromise a VPN concentrator and an attacker inherits the tunnel; under zero trust, every subsequent request still faces a policy decision evaluated against attributes the attacker does not control.
Why do zero trust programs stall at the data layer?
Identity and network controls end at the moment of release. Once a user is authorized and a file is decrypted, nothing stands between that copy and its next recipient. The CISA Zero Trust Maturity Model 2.0 treats data as a separate pillar for this reason, and organizations reporting advanced identity maturity routinely report traditional maturity on data.
