Guide
What Is Zero Trust? A Network Engineer's Explanation
Behind the slogan is a written-down architecture: a policy decision point, enforcement points in the path to every protected resource, and access authorized per session by identity, device posture, and context rather than granted by network location.
“Never trust, always verify” fits on a slide. Building it does not. Zero trust is what the industry converged on once the castle-and-moat model — hard perimeter, soft interior — stopped matching where laptops and applications actually live. The useful starting point is that zero trust is not a product or a feature but an architecture, and it is written down: NIST SP 800-207 is the reference document, and it describes the model in terms an engineer can build against.
The Architecture NIST Wrote Down
SP 800-207 reduces the slogan to components. A policy engine evaluates every access request against dynamic policy — who is asking, on what device, in what state, for which resource — and renders the verdict. A policy administrator acts on it, establishing or shutting down the communication path through the enforcement points. Together they form the policy decision point. In the path to each protected resource sit policy enforcement points: the components that actually permit, monitor, and terminate connections to it, and that consult the decision point before allowing one.
Two properties do most of the work. Access is granted per session and per resource, not per network: a grant to one application at nine o’clock says nothing about a different application at ten. And policy is dynamic — identity and device posture are first-class inputs, so the same user on the same account can be allowed from a healthy managed laptop and denied from an unpatched one. Being on the corporate LAN, by itself, earns nothing.
Identity and Posture: The Inputs
Strong authentication anchors the whole model — in practice multi-factor as the workforce baseline, phishing-resistant methods where the assurance requirement rises — because a policy engine deciding on identity is only as good as the proof of identity it receives. The second input is the device. A valid user on a compromised laptop is still a threat, so posture — is the device managed, patched, encrypted, running its protections — feeds the decision alongside identity, and device trust becomes a condition that can be re-evaluated during a session rather than checked once at login. Trust decays; the architecture assumes it.
The Grant: Per-Application Access
Zero trust network access applies the model to application access — most visibly as the successor to remote access, though the same brokered decision works wherever the user sits. Instead of a VPN placing a user on the network, a broker connects the user to one authorized application, with applications commonly published through connectors that dial outbound to the broker rather than listening for inbound connections from the internet. What a stolen credential buys shrinks accordingly: brokered sessions to the applications that user could reach — if device and risk checks pass at all — rather than a routable position to explore. The narrowing is real but not absolute; a resource defined as a broad subnet rebuilds the network-shaped grant under a new name, and the VPN-to-ZTNA transition has its own sequencing discipline.
Segmentation: The Same Skepticism, East-West
Traffic already inside the network gets the same treatment. On Cisco infrastructure that can take complementary forms: TrustSec classifies users and devices into Security Group Tags and enforces role-based policy in the network path, while Cisco Secure Workload enforces microsegmentation at the workload — principally through its agents — discovering application dependencies and generating candidate allow-list policy an engineer validates before enforcement. Where classification and policy actually cover a flow, the effect is the same — a compromised device is denied paths to systems its role never needed, because policy never permitted them.
Measuring Progress: CISA’s Maturity Model
Nobody deploys zero trust in a quarter, which is why the CISA Zero Trust Maturity Model v2.0 grades it instead. It organizes the work into five pillars — identity, devices, networks, applications and workloads, and data — supported by three cross-cutting capabilities: visibility and analytics, automation and orchestration, and governance. Each pillar advances through four stages, from traditional through initial and advanced to optimal. The model’s practical value is honesty: an enterprise can be advanced on identity and traditional on data, and the gap is the roadmap.
Where the Exams Pick This Up
SCOR 350-701 v2.0 carries the foundation: objective 1.8 is “Describe zero trust architecture.” The concentration that turns it into configuration is SCAZT 300-740, whose v2.0 blueprint names SP 800-207 and the CISA maturity model in objective 1.1, endpoint posture policy in 2.4, microsegmentation and lateral movement prevention with Secure Workload in 3.7, and zero-trust access — clientless and client-based, using Secure Access and Cisco Secure Client — in 4.6. The buzzword era of zero trust is ending; the implementation era needs engineers who can read the architecture and build it.
Frequently Asked Questions
Is zero trust a product I can buy?
No. Zero trust is an architecture assembled from capabilities: strong authentication, device posture assessment, per-application access, segmentation, and a policy engine that evaluates every request. Vendors sell components — Cisco's portfolio spans Duo, ISE, Secure Workload, and Secure Access — but the architecture is a design discipline, and NIST SP 800-207 describes it without naming a single product.
Does zero trust replace my VPN?
Zero trust network access replaces network-level reach — broad by default in a classic, broadly routed remote-access VPN — with brokered, per-application connections. Enterprises commonly run both through a long transition: the VPN for applications that still assume a network path, ZTNA for everything migrated to identity-based access, with the VPN's user population and route scope shrinking release by release.
Which Cisco exam covers zero trust?
SCOR 350-701 v2.0 carries the foundation — objective 1.8 is 'Describe zero trust architecture.' The depth lives in SCAZT 300-740, the CCNP Security concentration built around zero-trust access to cloud and private resources: its blueprint names NIST SP 800-207 and the CISA Zero Trust Maturity Model v2.0 directly, and its Access domain covers configuring zero-trust access with Cisco Secure Access.