Zero Trust Architect

Zero Trust Architect Skill

Drives Zero Trust Architecture (ZTA) and SASE design, evaluation, and documentation.

Ryan's context: CCNA (2003–2006), CCNP R&S (full track), Applied Computer Science degree. Currently designing a SASE solution for employer. Transitioning into network solutions architecture.

Shared skills referenced:

• Network architecture fundamentals → ../network-architect/SKILL.md
• Network security controls → ../network-security/SKILL.md

Zero Trust Principles (NIST SP 800-207)

SASE Component Map

┌─────────────────────────────────────────────────────────────┐
│                    SASE Cloud Fabric                        │
│                                                             │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐      │
│  │  SWG          │  │  CASB        │  │  ZTNA        │      │
│  │ (web policy)  │  │ (SaaS DLP)   │  │ (app access) │      │
│  └──────────────┘  └──────────────┘  └──────────────┘      │
│  ┌──────────────┐  ┌──────────────┐  ┌──────────────┐      │
│  │  FWaaS        │  │  DNS Sec     │  │  DLP         │      │
│  │ (L4-L7 FW)   │  │ (DNS filter) │  │ (data egress)│      │
│  └──────────────┘  └──────────────┘  └──────────────┘      │
│                                                             │
│              SD-WAN Underlay / IPsec Tunnels                │
└─────────────────────────────────────────────────────────────┘
         ↑                     ↑                    ↑
   Branch (CPE)         Remote User           Cloud App
   SD-WAN edge          Endpoint agent        (SaaS/IaaS)

Component Definitions

SASE Deployment Models

Model 1: Single-Vendor SASE

All SSE + SD-WAN from one vendor (Palo Alto Prisma SASE, Fortinet SASE).

• Pro: single console, native integration, simplified licensing
• Con: vendor lock-in; best-of-breed gaps possible
• Choose when: org prioritises operational simplicity

Model 2: Dual-Vendor (SSE + SD-WAN)

Best-of-breed SSE (Zscaler/Netskope) + separate SD-WAN (Fortinet/Viptela).

• Pro: flexibility; independent scaling
• Con: integration complexity; two support relationships
• Choose when: existing SD-WAN investment exists; security maturity is high

Model 3: Hybrid Transition

Existing MPLS/VPN retained; SASE PoPs added in parallel for new workloads.

• Best for: phased migration with legacy branches that cannot immediately move

ZTA Policy Engine Design

Request (user + device + app + context)
       ↓
[Identity Check]   ← IdP: Entra ID / Okta / Keycloak
       ↓
[Device Posture]   ← MDM / EDR signal (compliant / managed / health score)
       ↓
[Risk Score]       ← UEBA, time-of-day, geo, anomaly
       ↓
[Resource Policy]  ← least-privilege; app segment; data classification
       ↓
[PEP Enforcement]  ← ZTNA broker / inline proxy / microseg agent
       ↓
Allow / Deny / Step-up MFA / Quarantine

Policy Decision Point (PDP) vs Policy Enforcement Point (PEP)

• PDP: decides (IdP + SIEM + posture signals) — often Okta/Entra conditional access or a PAM platform
• PEP: enforces at the network/app edge — ZTNA connector, SWG proxy, CASB inline

Microsegmentation Approaches

CISA Zero Trust Maturity Model — Pillar Checklist

Vendor Evaluation Scorecard

When evaluating SASE/SSE vendors, score on:

Common Pitfalls

ZERO_TRUST_KNOWLEDGE

Append discoveries here. Format: YYYY-MM-DD: <note>