A Zero Trust Architecture (ZTA) is built on continuous verification of every access request, strict micro‑segmentation, and least‑privilege enforcement across identity, device, network, and application layers.
Core components
1. Identity & Access Management (IAM) – OIDC/SAML for federation, Azure AD Conditional Access, Okta Adaptive MFA. Enforce MFA when risk_score > 70 and require session_duration <= 8h.
2. Device Trust – Endpoint posture via Microsoft Defender for Endpoint or CrowdStrike. Require device_health_score >= 80 and OS version ≥ 2022‑01.
3. Network Micro‑segmentation – Software‑defined perimeters (Cisco SD‑WAN, Palo Alto Prisma Access). Use VLAN tags and Zero‑Trust Network Access (ZTNA) policies that deny all traffic by default.
4. Application & Data Security – Service‑mesh mTLS (Istio), secret management (HashiCorp Vault). Set tls.min_version = TLS1.3 and rotate secrets every 30 days.
5. Security Analytics & Automation – Real‑time risk scoring with Elastic SIEM + Falco. Correlate login_failed > 5 within 10 min to trigger isolate_endpoint.
6. Policy Decision Point (PDP) & Enforcement Point (PEP) – Open Policy Agent (OPA) as PDP; Envoy as PEP.
Comparison table
| Component | Typical Tool | Key Config Flag |
|-----------|--------------|-----------------|
| IAM | Okta | mfa_required = true |
| Device | CrowdStrike | health_score >= 80 |
| Network | Prisma Access | default_deny = true |
| App | Istio | mtls.mode = STRICT |
| Analytics | Elastic SIEM | risk_threshold = 75 |
| PDP/PEP | OPA/Envoy | policy_path = /etc/opa/policies |
OPA policy example
package zt.access
default allow = false
allow {
input.identity.mfa == true
input.device.health_score >= 80
input.network.segment == "trusted"
}Gotcha: Legacy on‑prem applications that only support NTLM often break when placed behind a ZTNA proxy; you must deploy a protocol‑translation gateway or keep a separate trust zone to avoid authentication loops.