# Zero Trust Architecture

## NIST SP 800-207

The canonical document. Three core components:
- **Policy Engine (PE)**: makes access decisions
- **Policy Administrator (PA)**: translates decisions into action
- **Policy Enforcement Point (PEP)**: enforces decisions

Seven tenets. Three deployment models: enhanced identity governance, micro-segmentation, SDP.

- Page: https://csrc.nist.gov/pubs/sp/800/207/final
- PDF: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
- Implementation project: https://pages.nist.gov/zero-trust-architecture/

## DoD/DISA Zero Trust Reference Architecture v2.0

152 zero trust activities across seven pillars. Thunderdome hit 152/152 by May 2025. All defense components must achieve target ZTA by FY2027.

- Strategy PDF: https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTStrategy.pdf
- Architecture v2.0: https://www.dmi-ida.org/knowledge-base-detail/Zero-Trust-Reference-Architecture-v2.0
- DTM 25-003: https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dtm/DTM%2025-003.PDF
- CSA overview: https://cloudsecurityalliance.org/resources/dod-zero-trust-reference-architecture

## CISA Zero Trust Maturity Model v2.0

Five pillars: Identity, Devices, Networks, Apps/Workloads, Data
Three cross-cutting: Visibility/Analytics, Automation/Orchestration, Governance
Four stages: Traditional, Initial, Advanced, Optimal

- URL: https://www.cisa.gov/zero-trust-maturity-model

## Google BeyondCorp

Core architecture: Device Inventory DB, Device Identity, SSO, Access Control Engine, Access Proxy, Trust Inferrer. No VPN required. All internal apps through access proxy.

- Overview: https://cloud.google.com/beyondcorp
- Paper: https://research.google.com/pubs/archive/44860.pdf
- USENIX: https://www.usenix.org/publications/loginonline/beyondcorp-and-long-tail-zero-trust

## Tailscale as ZT Overlay

WireGuard-based mesh VPN through NAT/firewalls. Zero-config encrypted networking.
- Homelab use: https://tailscale.com/use-cases/homelab
- ZT definition: https://tailscale.com/kb/1123/zero-trust
- Manual: https://dev.to/chaithuchowdhary/the-zero-trust-homelab-manual-macvlan-private-pki-and-tailscale-46gj

Headscale: open-source self-hosted control server alternative.

## Home Lab ZT Implementation

Practical approach:
1. Tailscale/WireGuard mesh for all inter-host communication
2. OPNsense firewall with default-deny + VLAN segmentation
3. mTLS for service-to-service communication
4. fwknop SPA for any exposed services
5. Certificate-based device identity (step-ca or cfssl)
6. Centralized logging and monitoring