Step 3: Build A Zero Trust Architecture

This document provides guidance for iteratively, incrementally and nondisruptively executing the third step in the five step Zero Trust implementation process (Build a Zero Trust Architecture) described in the NSTAC Report to the President on Zero Trust and Trusted Identity Management, originally formulated and socialized by John Kindervag, the creator of Zero Trust.. Separate CSA research documents are being developed to elaborate detailed guidance for each of the five steps. This step in the process is the key bridge between the initial assessment and planning steps (Define the Protect Surface and Map the Transaction Flows) and the operational steps (Create a Zero Trust Policy and Monitor and Maintain the Network). Zero trust aims to reduce breaches by authenticating entities before granting access requests to access resources. This verification is addressed by using zero trust architecture which includes but is not limited to a policy definition point, a policy information point, a policy enforcement point (PEP). Depending on the complexity of the business processes and ancillary requirements like resources, an organization may choose to use one each of these components or use several in tandem to achieve identified use case goals. This whitepaper reviews several common Zero Trust architectures, introduces a capability model, and examines the operational considerations of Zero Trust architectures. Readers will obtain a better understanding of different Zero Trust architectures, be able to derive their functional and operational requirements from their set of Protect Surfaces, and be able to make informed decisions about selecting PDPs and PEPs, their capabilities, and optimal deployments.

Key Takeaways