Skip to content
kevinferron.com

Interactive tutorials · Simulated in your browser

Zero trust, one request at a time

The old model trusted the network: get past the firewall and you were inside, and inside was safe. Zero trust drops that. Each request to each resource is decided on its own, at the moment it is made, from what can be verified. Interactive tutorials, simulated in your browser, each with a diagram to push on and the sources behind every claim.

Zero trust is not a product you buy. It moves the checkpoint from the edge of the network to the front of every resource. The tutorial where you become the policy engine shows that move on screen, and every later tutorial feeds that engine one more signal.

One request, one decision

Policy says
POLICY DECISION POINTPolicy enginePE · decidesPolicy administratorPA · carries it outCONTROL PLANEDATA PLANESubjectperson + laptopPEPResourceapp or dataCDMComplianceThreat intelActivity logsData access policyEnterprise PKIID managementSIEM

Data sourceHover, focus or tap a chip around the policy engine to see what it supplies.

The requestIdle. Press “Send a request”.

After NIST SP 800-207, Figure 2. The chips are the data sources the standard lists; the request and its decision are a drawing, not a measurement.

The idea

The old model trusted the network: get past the firewall and you were “inside”, and inside was safe. Zero trust drops that assumption.

Where a request comes from earns it nothing. Each request to each resource is decided on its own, at the moment it is made, from what can be verified: who is asking and how strongly they proved it, what device they are on and whether it is healthy, the context of the request, and what the resource requires. The answer grants only what the task needs, for as long as it needs it, and is re-checked as things change.

Every part of the design also assumes an attacker may already be inside, so the question is how little one stolen laptop or password can reach. Google’s 2014 BeyondCorp paper started from the same place: treat the internal network as being as dangerous as the internet.

The learning map

Arrows mean “builds on”, and the dashed ones are signals into the policy engine. Every decision is made there, so the policy decision is the hinge: read that one if you read only one. Colours are the CISA pillar a tutorial mainly serves.

  1. The idea

  2. The signals

  3. The plumbing

    • T6 · Least privilege and microsegmentationcoming · feeds the policy engine: privilege
    • T7 · Sessions that end, and evaluation that never stopscoming · feeds the policy engine: session
    • T8 · Machines need identity toocoming · feeds the policy engine: workload

  4. The journey

    • T9 · How mature are you?coming

If you run a small business

Start at T3 · Phishing-resistant MFASB · If you run a small business →

CISA’s small-business guidance does not mention zero trust, so mapping its steps onto CISA’s maturity model is this site’s own work, and the page says so.

  • Networks
  • Cross-cutting
  • Identity
  • Devices
  • Applications and workloads
  • Dashed: coming

The tutorials

What this series is not

  • A product. No page here names a vendor; the tools are described by category, and the sources are standards and public guidance.
  • A sales pitch. No page sells a product, and there are no breach statistics, small-business attack rates or dollar figures: none had a primary source that could be opened. The one exception is a short note at the end of the small-business page on how I can help.
  • A model of any real network. The offices, people, device tiers and score weights are made up for the diagrams, and each page says so where they appear.

Sources

  1. NIST SP 800-207 Zero Trust Architecture (S. Rose, O. Borchert, S. Mitchell, S. Connelly). Aug 2020; read 2026-10-22.

    • Section 3 and Figure 2: the policy decision point, the policy enforcement point and the data sources the engine consults
    • Section 2.1, tenets 2, 3, 4 and 6: no trusted network location; access per session; decided by dynamic policy; authentication and authorisation re-checked
    • Section 2.2, assumption 1: the enterprise network is not implicitly trusted and an attacker may be present

  2. CISA Zero Trust Maturity Model Zero Trust Maturity Model, Version 2.0. Apr 2023 (the cover date); read 2026-10-22; Tables 2, 3, 5, 6 and 7 read again 2026-10-23 for the small-business page.

    • Section 3: the pillars and the capabilities that run across them

  3. BeyondCorp (2014) BeyondCorp: A New Approach to Enterprise Security (R. Ward, B. Beyer; ;login: 39(6)). Dec 2014; read 2026-10-22.

    • Page 6: the internal network treated as no safer than the internet

  4. CISA alert on NSA guidance NSA Releases Guidance on Zero Trust Security Model (CISA, archived alert). Says the NSA sheet exists and frames zero trust as assuming breach. 26 Feb 2021; read 2026-10-22.

    • The alert says the NSA’s sheet frames zero trust as assuming a breach is inevitable or has happened

Everything here is paraphrased from the sources, not quoted at length, and every claim is attributed to one. The NSA’s own zero trust sheets could not be opened, so they are not cited; the CISA alert about them is. Anything illustrative is labelled as such. Where a source is silent or could not be read, the page leaves the fact out.