Zero Trust Architecture: Strategy and Implementation

Course overview

Course outline

1. 1Day One: Zero Trust Principles and the Changing Threat Landscape

   • Why the Perimeter Has Failed: Cloud adoption, remote work, supply chain access and modern attack paths
   • Core Zero Trust Principles: Verify explicitly, use least privilege access and assume breach
   • Reference Models: Overview of widely used public Zero Trust frameworks and maturity models
   • Logical Components: Policy engine, policy administrator and policy enforcement points
   • Trust Signals: Identity, device posture, location, behaviour and data sensitivity
   • Common Misconceptions: Why Zero Trust is a strategy and architecture rather than a product
   • Case Study: Tracing a lateral-movement breach and identifying where Zero Trust controls would have stopped it
2. 2Day Two: Identity as the New Control Plane

   • Identity Foundations: Directories, identity governance and the joiner-mover-leaver lifecycle
   • Strong Authentication: Phishing-resistant multi-factor authentication and passwordless approaches
   • Conditional and Risk-Based Access: Building policies that adapt to context and risk signals
   • Least Privilege in Practice: Role design, just-in-time access and privileged access management
   • Machine and Workload Identities: Service accounts, APIs and secrets management
   • Identity Threats: Credential theft, token abuse and session hijacking
   • Workshop: Designing conditional access policies for employees, contractors and administrators
3. 3Day Three: Devices, Networks and Micro-Segmentation

   • Device Trust: Inventory, health attestation, endpoint protection and compliance checks
   • Unmanaged and Personal Devices: Secure access options for contractors and bring-your-own-device users
   • Micro-Segmentation Concepts: Reducing blast radius by isolating workloads and data flows
   • Software-Defined Perimeter and Secure Access Service Edge: Replacing broad VPN access
   • Securing Operational and Legacy Systems: Practical approaches where agents cannot be installed
   • Encryption Everywhere: Protecting traffic within the internal network
   • Practical Exercise: Defining segmentation zones and allowed flows for a hybrid enterprise
4. 4Day Four: Applications, Data, Visibility and Automation

   • Application Access: Per-application access, secure web gateways and API protection
   • Data-Centric Security: Classification, labelling, rights management and data loss prevention
   • Continuous Monitoring: Logging, telemetry and behaviour analytics as inputs to access decisions
   • Security Orchestration and Automation: Automated responses to changing risk signals
   • Cloud and Multi-Cloud Considerations: Shared responsibility and consistent policy enforcement
   • Measuring Effectiveness: Metrics and indicators for Zero Trust controls
   • Workshop: Mapping data flows and designing data protection policies for sensitive information
5. 5Day Five: Roadmap, Governance and Adoption

   • Maturity Assessment: Evaluating current capabilities across identity, devices, networks, applications and data
   • Prioritising Use Cases: Selecting early wins that reduce risk and build momentum
   • Building the Business Case: Costs, risk reduction, operational benefits and funding options
   • Phased Migration Planning: Coexistence with legacy architecture and avoiding disruption
   • Governance and Operating Model: Ownership, policy management, supplier coordination and change control
   • People and Culture: Communicating change, user experience and stakeholder support
   • Capstone Exercise: Presenting a three-year Zero Trust roadmap for executive review