CyArt Academy
Unlock ProSign in
CYART // SCHEMA · ZERO-TRUST-GATEWAY8 NODES · 7 LINKSWHAT WE DESIGNPOSTUREREQUESTALLOW?ALLOWEDACTOR · Device — agent postureACTOR01Deviceagent postureACTOR · User — browser / CLIACTOR02Userbrowser / CLIEDGE · Edge PoP — TLS, DDoS, anycastEDGE03Edge PoPTLS, DDoS, anycastSERVICE · Policy enforcement — proxy per requestSERVICE04Policy enforcementproxy per requestSERVICE · Policy decision — OPA / Cedar, 1 to 3 msSERVICE05Policy decisionOPA / Cedar, 1 to 3 msDATA · Identity — OIDC, MFA, groupsDATA06IdentityOIDC, MFA, groupsDATA · Signals — device, geo, risk scoreDATA07Signalsdevice, geo, risk scoreSTREAM · Private app — mTLS from PEP onlySTREAM08Private appmTLS from PEP only

Zero trust reference architecture

Putting identity, device, policy, network and telemetry together into one architecture you can defend in a staff-level review.

● Must know for interviews🔒 PROLesson·14 min read·Advanced → Staff
zero trustarchitectureBeyondCorp

01The seven components

✓What you will learn
  • Name the components of a zero trust architecture and the data flowing between them
  • Walk one request end to end and say what is checked where
  • Write policy that combines identity, device and context
  • Sequence a migration from VPN without a big bang, and argue the trade-offs

Zero trust means network location grants nothing: being on the office Wi-Fi or the VPN does not make a request trustworthy. Every request is authenticated, authorised against current signals and logged. NIST SP 800-207 gives the vocabulary: a policy decision point (PDP) decides, a policy enforcement point (PEP) enforces, and the PDP draws on identity, device and threat data.

FigReference architecture
CYART // SCHEMA · ZERO-TRUST-GATEWAY8 NODES · 7 LINKSWHAT WE DESIGNPOSTUREREQUESTALLOW?ALLOWEDACTOR · Device — agent postureACTOR01Deviceagent postureACTOR · User — browser / CLIACTOR02Userbrowser / CLIEDGE · Edge PoP — TLS, DDoS, anycastEDGE03Edge PoPTLS, DDoS, anycastSERVICE · Policy enforcement — proxy per requestSERVICE04Policy enforcementproxy per requestSERVICE · Policy decision — OPA / Cedar, 1 to 3 msSERVICE05Policy decisionOPA / Cedar, 1 to 3 msDATA · Identity — OIDC, MFA, groupsDATA06IdentityOIDC, MFA, groupsDATA · Signals — device, geo, risk scoreDATA07Signalsdevice, geo, risk scoreSTREAM · Private app — mTLS from PEP onlySTREAM08Private appmTLS from PEP only
  • ACTOR
  • EDGE
  • SERVICE
  • DATA
  • STREAM
  • Live flow
  • Lookup / async
//Users and devices reach an edge PoP. A policy enforcement point proxies every request and asks a decision service, which combines identity, device posture and risk signals. Private applications trust only the enforcement point, over mTLS.
  1. Identity provider with phishing-resistant MFA (WebAuthn passkeys or security keys) and authoritative group data from HR.
  2. Device inventory and posture: managed, disk encrypted, EDR healthy, OS patched, with the device proven by a hardware-bound certificate rather than a self-reported agent value.
  3. Policy decision point: evaluates identity + device + context + resource sensitivity in a few milliseconds.
  4. Policy enforcement points: identity-aware proxies for HTTP, TCP and SSH gateways for the rest, a service mesh for service to service.
  5. Private connectivity: apps are not on the internet; connectors inside the network dial out to the PoPs, so there is no inbound port to scan.
  6. Telemetry: every decision logged with its inputs; feeds detection and policy tuning.
  7. Continuous evaluation: sessions re-checked when signals change, not only at login.

This is an advanced module

Advanced: Security Architecture at Scale is part of the Pro pass. 5 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.

Enter access codeSee Pro pass

Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.

Related lessons