OWASP Cheat Sheet Series: Zero Trust Architecture Cheat Sheet

# Zero Trust Architecture Cheat Sheet

## Introduction

This cheat sheet will help you implement Zero Trust Architecture (ZTA) in your organization. Zero Trust means "never trust, always verify" - you don't trust anyone or anything by default, even if they're inside your network.

Traditional security works like a castle with walls. Once you're inside, you can access everything. Zero Trust is different - it checks every person and device every time they try to access something, just like having security guards at every door. This approach prevents attackers who get inside your network from moving around and stealing data.

## Core Zero Trust Principles

These principles come from [NIST SP 800-207](https://csrc.nist.gov/publications/detail/sp/800-207/final):

### 1. All Data Sources and Computing Services are Resources

Everything in your network is a resource that needs protection - servers, databases, cloud services, IoT devices, and user devices. Don't assume anything is safe just because it's "internal" to your network. Each resource needs its own security controls.

### 2. All Communication is Secured Regardless of Network Location

Every connection must be encrypted and authenticated, whether it's between your office and the cloud, between internal systems, or from home to work. Network location doesn't determine trust level. Use [strong encryption](https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html) (TLS 1.3 or better) for everything.

### 3. Access to Resources is Granted on a Per-Session Basis

Don't give permanent access to anything. Each time someone tries to access a resource, evaluate whether they should be allowed. [Sessions](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) should be short-lived and require re-authentication when they expire. No "set it and forget it" access.

### 4. Access is Determined by Dynamic Policy

Access decisions consider multiple factors: who's asking, what device they're using, where they're connecting from, what time it is, and how they normally behave. These policies change based on risk. Someone accessing payroll during work hours from their work laptop is low risk. The same person downloading lots of data at 2 AM from a coffee shop is high risk.

### 5. Monitor and Measure the Security Posture of All Assets

Continuously check the health and security of all devices and systems. If you can't see it, you can't protect it. This includes monitoring for patches, antivirus status, configuration changes, and suspicious behavior. Assets that fall out of compliance lose access.

### 6. All Authentication and Authorization is Dynamic and Strictly Enforced

Security decisions happen in real-time for every access request. Don't rely on static rules or permanent permissions. The system should automatically adjust access based on current risk levels, revoke access for compromised accounts, and isolate suspicious devices.

### 7. Collect Information to Improve Security Posture

Gather as much security data as possible about users, devices, network traffic, and system behavior. Use this information to detect threats, improve policies, and make better security decisions. This data is essential for compliance and incident investigation.

## Core Zero Trust Architecture Components

Zero Trust uses three main parts that work together:

**Policy Engine** - This makes decisions about whether to allow or block access. It looks at user identity, device health, location, behavior, and risk scores. The tricky part is making policies that are secure but don't make work impossible.

**Policy Administrator** - This takes the decision from the Policy Engine and tells the enforcement systems what to do. When the Policy Engine says "allow access but require extra verification," the Policy Administrator figures out the details and sends commands to the right systems.

**Policy Enforcement Point** - These actually block or allow access attempts. This includes firewalls, proxy servers, application gateways, and API gateways. The important thing is that enforcement happens everywhere, not just at your network edge.

These three parts work together on every access request in real time, creating security that adapts to changing situations.

## How Zero Trust Addresses Modern Security Challenges

Zero Trust tackles security problems that traditional approaches can't handle effectively. Here's how it works in practice:

### Traditional vs. Zero Trust Responses

| Attack Scenario | Traditional Security Response | Zero Trust Response |
|----------------|------------------------------|-------------------|
| **Stolen credentials** | Reset password, add basic MFA | Continuous risk assessment, device verification, behavioral analysis - access denied even with valid credentials if risk is high |
| **Insider threat** | Trust employees inside network perimeter | Verify every action regardless of user location, role, or tenure - no implicit trust |
| **Lateral movement** | Perimeter security with flat internal network | Micro-segmentation blocks movement between systems, each connection verified |
| **Compromised device** | VPN access grants network access | Device health continuously monitored, access immediately revoked if compromise detected |
| **Privileged account abuse** | Permanent admin rights with periodic reviews | Just-in-time access with automatic expiration and continuous monitoring |
| **Data exfiltration** | Network monitoring and DLP at perimeter | Data-level access controls with real-time behavior analysis |

### Modern Threats That Require Zero Trust

Some contemporary attack patterns are specifically designed to bypass traditional security. Zero Trust provides the advanced capabilities needed to defend against them:

**Supply Chain Attacks** - Malicious code hidden in trusted software (like SolarWinds) bypasses perimeter security completely. Zero Trust responds with application-level identity verification, runtime behavior monitoring, and micro-segmentation to limit damage.

**Cloud Configuration Drift** - Misconfigured cloud resources expose data outside traditional network boundaries. Zero Trust uses policy-as-code, continuous compliance monitoring, and resource-level access controls to prevent unauthorized data access.

**API-First Attacks** - Direct attacks on APIs bypass network security entirely. Zero Trust requires authentication and authorization for every API call, validates request schemas, and uses behavioral analysis to detect abuse patterns.

**Identity-Based Attacks** - Sophisticated attacks like Pass-the-Hash and Golden Ticket steal identity tokens to impersonate legitimate users. Zero Trust uses short-lived tokens with continuous validation, device binding, and behavioral analysis to detect unusual access patterns.

### ZTA Decision-Making in Action

Here are three examples that show how Zero Trust actually works when it's set up correctly:

#### Case Study 1: Worki