My Skill Lab
CybersecurityAdvanced

Zero Trust Architecture

Design and roll out zero trust: identity, devices, segmentation, policy.

Taught by Kiran Basnet · Security Engineer

What you'll learn

  • Explain the NIST SP 800-207 tenets and how they change day-to-day access decisions
  • Design a control plane with a policy engine, policy administrator, and enforcement points
  • Make identity, device posture, and context the inputs to every access request
  • Plan microsegmentation that contains lateral movement without breaking apps
  • Replace remote-access VPNs with a ZTNA broker and per-application access
  • Produce a phased migration roadmap mapped to a zero trust maturity model

About this course

This advanced course is for security architects, senior engineers, and infrastructure leads who need to move an organisation from a flat, perimeter-based network to a working zero trust architecture. You will learn the tenets of NIST SP 800-207, design a policy engine and the decision and enforcement points around it, make identity and device posture the basis for every access decision, and replace legacy VPNs with ZTNA. You will plan microsegmentation that limits lateral movement without breaking applications, and build a phased migration roadmap tied to a maturity model. Prerequisites are solid networking, identity, and cloud fundamentals. By the end you can defend architectural choices to stakeholders and produce a realistic rollout plan that improves security without stalling the business.

Course content

7 lessons
  1. 1What Zero Trust Really MeansThe core idea, the NIST 800-207 tenets, and the myths worth discarding early.Preview
  2. 2Identity as the New PerimeterStrong authentication, phishing-resistant MFA, and conditional access as the first control plane.
  3. 3Device Posture and Endpoint TrustFeeding device health signals into access decisions so only healthy endpoints reach resources.
  4. 4Policy Decision and Enforcement PointsSeparating where decisions are made from where they are enforced, and keeping policy as code.
  5. 5Microsegmentation and Network DesignLimiting lateral movement with identity-aware segmentation that does not break applications.
  6. 6ZTNA: Replacing the VPNBrokered, per-application access that removes the flat network a VPN hands out.
  7. 7A Migration Roadmap and Maturity ModelSequencing a realistic zero trust rollout and measuring progress against a maturity model.