CSA CCZT cheat sheet

Core principle: no implicit trust is granted based on network location; every request is authenticated and authorized before access is granted.

NIST SP 800-207 defines the architecture around a Policy Engine (PE), Policy Administrator (PA), and Policy Enforcement Point (PEP); PE decides, PA establishes/tears down the session, PEP enforces.

PDP (Policy Decision Point) = PE + PA combined; PEP is logically separate and may be split into client-side and resource-side components.

Trust algorithm inputs: subject identity, device posture, resource sensitivity, behavioral attributes, environmental factors, and threat intelligence.

Three deployment variants: enhanced identity governance, micro-segmentation, and software-defined perimeter (SDP) - all rely on a PDP.

A Zero Trust Architecture assumes the network is hostile; the enterprise perimeter shifts to the identity of the subject and the resource itself.

Signals feed the PE continuously: CDM/system logs, threat intel feeds, activity logs, data access policies, and industry compliance rules.

ZT is not a single product; NIST describes it as a set of architectural principles plus a migration strategy from perimeter-based security.

SDP creates a logical boundary around resources so assets are 'dark' (non-discoverable) until the client is authenticated and authorized.

Cloud Security Alliance SDP has two planes: the Control Plane (controllers) and the Data Plane (gateways); the client connects to the controller first, never directly to the resource.

SPA (Single Packet Authorization) is the recommended pre-authentication mechanism; the gateway drops unauthenticated packets, defeating port scanning and DDoS probes.

Sequence: client authenticates to controller (mutual auth, device attestation), controller issues an authorized connection, then client connects to gateway which proxies to the resource.

SDP gateways can be client-to-gateway, client-to-server, server-to-server, or gateway-to-gateway; each enforces dynamic, per-session policy.

Because the gateway proxies traffic, it can hide resource IPs entirely and terminate or inspect sessions before they reach the protected asset.

SDP complements ZTNA: SDP is a technical implementation pattern, ZTNA is the broader access model; SDP is one of NIST's ZT deployment variants.

Strategy starts with a protect-surface analysis: identify DAAS (data, applications, assets, services) and rank by criticality to the business.

Define a 'protect surface' and a 'business process' view; ZT strategy must map security controls to business outcomes, not to network topology.

Choose a trust algorithm (criteria-based or score-based) and document its inputs before selecting products.

Executive sponsorship and a cross-functional steering group (security, IT, app owners, business) are prerequisites; ZT is a program, not a project.

Set a phased roadmap: identify, then quick wins (MFA, identity governance), then micro-segmentation and SDP, then continuous monitoring and automation.

Define success metrics: reduced implicit trust paths, percent of resources behind a PEP, MFA coverage, time-to-detect lateral movement attempts.

Align strategy with CISA's Zero Trust Maturity Model tiers (Traditional, Initial, Advanced, Optimal) across pillars to communicate progress.

Inventory all DAAS and map data flows; you cannot protect what you have not catalogued.

Identify candidate PEPs already in place (VPN gateways, reverse proxies, API gateways, IAM) and reuse them rather than rip-and-replace.

Classify resources by sensitivity and define per-resource access policies; policy is per-session and per-resource, not per-network.

Assess identity infrastructure: IdP, MFA, device inventory, PKI/certificate authority, and logging/SIEM readiness.

Model the migration: pilot a single business process, measure, then expand; document dependencies and rollback paths.

Plan for continuous monitoring and analytics (SIEM, UEBA) because ZT requires ongoing evaluation of trust signals, not one-time checks.

Budget for user experience and change management; ZT controls (MFA prompts, device checks) affect productivity and need stakeholder buy-in.

Implement identity as the primary control plane: strong MFA, phishing-resistant authenticators (FIDO2/passkeys), and continuous session evaluation.

Deploy SDP or ZTNA gateways to replace broad VPN access; enforce least-privilege, per-application access rather than network-level access.

Micro-segment workloads with host-based firewalls or service mesh; east-west traffic should be authenticated and authorized, not implicitly trusted.

Enforce device posture checks (patch level, EDR present, encryption) as a condition of access; noncompliant devices get limited or no access.

Log every PEP decision and feed to SIEM; detect anomalies and revoke sessions dynamically when trust signals degrade.

Automate policy as code where possible; manual policy drift is a common implementation failure.

Measure and iterate: track denied requests, false positives, and user friction; tune the trust algorithm rather than loosening policy.

NIST SP 800-207 is the foundational ZT reference: it defines ZT principles, the PE/PA/PEP model, trust algorithms, and deployment variants.

NIST SP 800-207A extends ZT to cloud-native, multi-cloud environments, focusing on micro-segmentation and service-to-service trust.

CISA's Zero Trust Maturity Model (ZTMM) organizes ZT into pillars: Identity, Devices, Networks, Applications/Workloads, Data, plus Visibility/Analytics, Automation/Orchestration, and Governance.

CISA ZTMM tiers: Traditional, Initial, Advanced, Optimal - used to assess current state and plan progression, not as a compliance checklist.

NIST and CISA both emphasize: assume breach, verify explicitly, and use least privilege - the three core ZT tenets popularized by CISA/NSA guidance.

CISA's 'Zero Trust Security Model' and related guidance stress continuous verification and the elimination of implicit trust from network location.

Use NIST CSF functions (Identify, Protect, Detect, Respond, Recover) as a complementary framing for ZT program governance.

Implicit trust = trust granted because a request originates inside the corporate network; ZT eliminates this.

Least privilege: subjects get only the access needed for the task, for the minimum time (just-in-time access).

Assume breach: design as if adversaries are already inside; limit blast radius via segmentation and monitoring.

Verify explicitly: every access request is authenticated and authorized using all available signals (identity, device, context).

PDP/PEP separation: policy decision is centralized and logical; enforcement is distributed and close to the resource.

Trust is a continuous, dynamic score, not a binary state; it can be revoked mid-session.

Identity is the new perimeter: user, device, and workload identity all require strong authentication and lifecycle management.