#Zero Trust Architecture

#NIST SP 800-207

The canonical document. Three core components:

• Policy Engine (PE): makes access decisions
• Policy Administrator (PA): translates decisions into action
• Policy Enforcement Point (PEP): enforces decisions

Seven tenets. Three deployment models: enhanced identity governance, micro-segmentation, SDP.

• Page: https://csrc.nist.gov/pubs/sp/800/207/final
• PDF: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
• Implementation project: https://pages.nist.gov/zero-trust-architecture/

#DoD/DISA Zero Trust Reference Architecture v2.0

152 zero trust activities across seven pillars. Thunderdome hit 152/152 by May 2025. All defense components must achieve target ZTA by FY2027.

• Strategy PDF: https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTStrategy.pdf
• Architecture v2.0: https://www.dmi-ida.org/knowledge-base-detail/Zero-Trust-Reference-Architecture-v2.0
• DTM 25-003: https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dtm/DTM%2025-003.PDF
• CSA overview: https://cloudsecurityalliance.org/resources/dod-zero-trust-reference-architecture

#CISA Zero Trust Maturity Model v2.0

Five pillars: Identity, Devices, Networks, Apps/Workloads, Data Three cross-cutting: Visibility/Analytics, Automation/Orchestration, Governance Four stages: Traditional, Initial, Advanced, Optimal

• URL: https://www.cisa.gov/zero-trust-maturity-model

#Google BeyondCorp

Core architecture: Device Inventory DB, Device Identity, SSO, Access Control Engine, Access Proxy, Trust Inferrer. No VPN required. All internal apps through access proxy.

• Overview: https://cloud.google.com/beyondcorp
• Paper: https://research.google.com/pubs/archive/44860.pdf
• USENIX: https://www.usenix.org/publications/loginonline/beyondcorp-and-long-tail-zero-trust

#Tailscale as ZT Overlay

WireGuard-based mesh VPN through NAT/firewalls. Zero-config encrypted networking.

• Homelab use: https://tailscale.com/use-cases/homelab
• ZT definition: https://tailscale.com/kb/1123/zero-trust
• Manual: https://dev.to/chaithuchowdhary/the-zero-trust-homelab-manual-macvlan-private-pki-and-tailscale-46gj

Headscale: open-source self-hosted control server alternative.

#Home Lab ZT Implementation

Practical approach:

1. Tailscale/WireGuard mesh for all inter-host communication
2. OPNsense firewall with default-deny + VLAN segmentation
3. mTLS for service-to-service communication
4. fwknop SPA for any exposed services
5. Certificate-based device identity (step-ca or cfssl)
6. Centralized logging and monitoring