Zero Trust architecture and threat modelling
Lesson 1 of 5
1Zero Trust architecture and threat modelling
The big pictureA senior is not asked "is this machine infected?" but "how do we build the company so one infected machine is not enough to bring it down?". The modern answer is an architecture that assumes the attacker is already inside: no trusted network, no permanent session, and every access a small decision made now from who you are, what your device is, what you ask for and where from. And the cheapest time to fix a design flaw is before the design exists in code.
What the picture shows: No request reaches the resource directly. The enforcement point stops it and asks the policy engine, the engine decides from live signals, and the decision is re-checked whenever a signal changes.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Picture a modern government building. Passing the main gate is not enough: at every door a card reader (the enforcement point) asks the control room (the policy engine): does this person work here? Is it their working hours? Has the card not been reported lost? May they enter this floor? Permission is for this door, now. If the card is reported a minute later, every door closes to it at once.
NIST SP 800-207 defines: the policy engine (PE) makes the allow, deny or step-up decision, the policy administrator (PA) carries it out by opening or closing the session, together called the policy decision point (PDP), and the policy enforcement point (PEP) stands in front of the resource (an access proxy, a ZTNA gateway or an API gateway). The inputs: the identity provider and MFA, device posture from MDM and EDR, threat intelligence, SIEM logs and data classification. The CISA maturity model v2.0 (April 2023) has five pillars: identity, devices, networks, applications and workloads, and data, three cross-cutting capabilities (visibility and analytics, automation and orchestration, governance), and four stages: traditional, initial, advanced and optimal. Threat modelling with its four questions: what are we working on? What can go wrong? What are we going to do about it? Did we do a good job? And STRIDE (Microsoft): spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege; each letter matches a security property it breaks.
Before You Start
🧱Systems and network security
You met the idea of Zero Trust and segmentation.
🪪Identity and access
MFA and least privilege.
The Core Idea
1The parts of the architecture
Read the drawing from the top: signals feed the policy engine, the engine decides, the administrator tells the enforcement point, and only the enforcement point opens the way to the resource. There is no direct line from the user to the resource, and that is the whole idea.
The enforcement point takes many forms: an access proxy for internal apps (ZTNA instead of a VPN), an API gateway, an internal firewall splitting workloads, or even an agent on the server itself. What matters is that it cannot be bypassed: if the app has an address anyone on the network can reach without passing it, the architecture has a hole.
2The access decision: signals, not location
On a traditional network the decision was "you are in the office, so you are trusted". In Zero Trust the decision combines signals and weighs them against how sensitive the resource is: the wiki accepts more risk than payroll. And the answer is not only yes or no; it can be "ask for MFA now" (step-up). Run this small engine and change the requests.
A real engine takes more signals and is tuned with data, but the idea is the same: risk against the resource's sensitivity, and the decision is for this request, now.
SENSITIVITY = {"wiki": 1, "hr-portal": 2, "payroll-admin": 3}
BUDGET = {1: 2, 2: 1, 3: 0} # how much risk each sensitivity level accepts
def decide(user, resource, mfa, managed, patch_age, country):
risk, why = 0, []
if not mfa:
risk += 2; why.append("no MFA yet")
if not managed:
risk += 2; why.append("unmanaged device")
if patch_age > 30:
risk += 1; why.append(f"patches {patch_age} days old")
if country != "SA":
risk += 1; why.append(f"sign-in from {country}")
budget = BUDGET[SENSITIVITY[resource]]
if risk <= budget:
verdict = "ALLOW"
elif not mfa and risk - 2 <= budget:
verdict = "STEP-UP: ask for MFA"
else:
verdict = "DENY"
print(f"{user:<6} -> {resource:<14} risk {risk} / budget {budget}: {verdict:<20} {', '.join(why)}")
decide("sara", "wiki", False, True, 3, "SA")
decide("sara", "payroll-admin", False, True, 3, "SA")
decide("omar", "hr-portal", True, False, 3, "SA")
decide("omar", "wiki", True, True, 45, "SA")
decide("nora", "payroll-admin", True, True, 2, "AE")Continuous evaluation: a decision does not stay valid forever. If EDR reports the device is now infected, or the country suddenly changes, the administrator revokes the session at once. The OpenID CAEP standard is used to send these signals between systems.
A request's trip through a Zero Trust architecture
Sara opens the HR system from a company laptop at home. No VPN, no trusted network.
The idea: every step adds a signal, the decision is built from all of them, then stays under watch. If any signal fails during the session, it closes.
1 · Identity
She signs in through the identity provider with a FIDO2 key, which is phishing-resistant MFA. Signal: a confirmed identity and a strong sign-in method.
2 · Device
MDM confirms the laptop is managed, encrypted and patched, and EDR says it is clean. Signal: a device trusted right now.
3 · Enforcement
The request reaches the access proxy, not the app. The app itself has no internet address. Signal: exactly what she asks for.
4 · Decision
The policy engine combines the signals with Sara's role, the app's sensitivity and the time: allow, for this app only, for a set time.
5 · Session
The administrator opens a session to this app only. Sara sees no other server, so if her laptop were compromised the attacker would see no network to roam.
6 · Watch
An hour later EDR flags a suspicious process on the laptop. The signal reaches the engine, which revokes the session at once and asks for the device to be checked.
3The maturity model: where do you start?
Nobody builds Zero Trust in a year. The CISA model splits the road into five pillars and four stages, so you measure where you are in each pillar and pick the next step with the best effect for its cost. A common practical order: identity first (phishing-resistant MFA for everyone), then devices (no access from unmanaged devices), then sensitive apps behind a proxy, then micro-segmentation, then data.
| Pillar | Traditional | Advanced | Optimal |
|---|---|---|---|
| Identity | Passwords, MFA for some accounts | Phishing-resistant MFA for most accounts | Continuous checks by behaviour and risk |
| Devices | A manual inventory | Access depends on device posture | Every device assessed in real time |
| Networks | A flat network and VPN | Segmentation by application | Micro-segmentation, all traffic encrypted |
| Applications | Trust inside the network | Behind an access proxy | Authorisation per request |
| Data | No classification | Classified, sensitive data encrypted | Controls that follow the data wherever it goes |
4Threat modelling with STRIDE
Before building any new system: draw the data flow diagram (who talks to whom, and where the borders between trust zones are), then walk every element and every arrow asking the six STRIDE questions. Every "yes, possible" becomes a written threat with a cure and an owner. One hour of this before building saves weeks of fixing afterwards.
| Letter | Threat | Property broken | Example and cure |
|---|---|---|---|
| S | Spoofing | Authentication | One service poses as another → mTLS between services |
| T | Tampering | Integrity | Changing a request in transit → signing and encryption |
| R | Repudiation | Non-repudiation | "I never approved the transfer" → a tamper-proof audit log |
| I | Information disclosure | Confidentiality | An error message reveals the query → generic messages and encryption |
| D | Denial of service | Availability | Requests flood the service → rate limits |
| E | Elevation of privilege | Authorisation | A user reaches an admin function → a server-side check |
Worked example
The task: a mid-sized company of 600 staff, one VPN everyone uses into a flat network, and MFA for managers only. Management wants "Zero Trust" on a limited budget. What do you propose for year one?
The answer: start with the most effect for the least cost, in order. Quarter 1, identity: MFA for everyone, FIDO2 keys for managers and admin accounts, and switch off old protocols that bypass MFA. Quarter 2, devices: every device that connects must be managed and run EDR, and access depends on it. Quarter 3, apps: move the three most important apps (payroll, HR and finance) behind an access proxy instead of the VPN, each with its own policy. Quarter 4, network: separate the sensitive servers with an internal firewall, and measure progress with the CISA model. Before each quarter: a threat model of what will change. After a year: an attacker who steals a password does not get in, and someone who compromises a laptop sees only one app.
Myth vs Reality
| Myth | Reality |
|---|---|
| Zero Trust means we do not trust our staff. | It means we do not trust the location. Staff get what they need quickly, but after a check, because their account might be stolen. |
| Zero Trust is a product we buy. | It is an architecture and a multi-year plan. Products are only parts of it. |
| Threat modelling is for experts only and needs complex tools. | A whiteboard, a simple diagram and the STRIDE questions are enough to start, and developers take part themselves. |
Where you meet it at work
🏠Remote work
Safe access to apps without a VPN that opens the whole network.
🏛️Government bodies
Zero Trust plans are now required by many government policies.
🧑💻Design review
A threat model is part of the start of every new project.
Test your understanding
In NIST SP 800-207, who makes the allow or deny decision?
The engine decides, the administrator carries it out, and the enforcement point opens or closes the way.
Which of these is not one of the five CISA pillars?
The pillars: identity, devices, networks, applications and workloads, and data.
A user says "I never approved this operation" and no log proves otherwise. Which STRIDE letter?
Repudiation is cured by a trustworthy audit log that cannot be changed.
What does step-up mean in an access decision?
Instead of denying, stronger proof is asked for when risk is above the resource's budget.
What is usually the highest-impact first step on the Zero Trust road?
Most breaches start with a stolen identity, so strong identity is the first stone.
Quick review cards
Check Your Understanding
Why is being inside the company network not enough to be allowed?
Because the attacker may be inside with a compromised device or stolen account; the decision rests on identity, device and context, not location.
What makes an enforcement point useless?
A path to the resource that does not pass through it.
What are the four questions of threat modelling?
What are we working on? What can go wrong? What are we going to do about it? Did we do a good job?
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
reference3
Done with this lesson?
Sign in to save your progress.