March, 2020 • 14 min read
Introduction
By March 2020, Zero Trust is no longer just a security buzzword—it’s a
practical architectural goal for organizations of all sizes. With the
rapid rise of remote work, the proliferation of SaaS, and the increasing
complexity of hybrid networks, the concept of a trusted perimeter
collapses. Instead, enterprises are turning to Zero Trust Network
Architectures (ZTNA) to enforce least privilege, identity-aware access
control, and continuous trust evaluation. This post explores how Zero
Trust evolved into real deployments by 2020, unpacking the
architectures, policy engines, enforcement layers, and operational
challenges of implementation. By March 2020, Zero Trust is no longer
just a security buzzword—it’s a practical architectural goal for
organizations of all sizes. With the rapid rise of remote work, the
proliferation of SaaS, and the increasing complexity of hybrid networks,
the concept of a trusted perimeter By March 2020, Zero Trust is no
longer just a security buzzword—it’s a practical architectural goal for
organizations of all sizes. With the rapid rise of remote work, the
proliferation of SaaS, and the increasing complexity of hybrid networks,
the concept of a trusted perimeter collapses. Instead, enterprises are
turning to Zero Trust Network Architectures (ZTNA) to enforce least
privilege, identity-aware access control, and continuous trust
evaluation. This
The Core Tenets of Zero Trust
The foundation of Zero Trust lies in a simple but powerful principle:
never trust, always verify. Access is not granted based on location
(inside or outside the network) but on identity, context, and policy
compliance. The five pillars of Zero Trust in network security are: The
foundation of Zero Trust lies in a simple but powerful principle: never
trust, always verify. Access is not granted based on The foundation of
Zero Trust lies in a simple but powerful principle: never trust, always
verify. Access is not granted based on location (inside or outside the
network) but on identity, context, and
User and Device Identity – Authentication must validate the user and ensure the device meets posture requirements.
Least Privilege Access – Users and services get only the access they require, no more.
Microsegmentation – The network is divided into zones, and communication is explicitly allowed between them.
Continuous Monitoring – Sessions are evaluated throughout their lifespan, not just at the start.
Policy Enforcement – Access policies are centrally managed and enforced at the edge or application layer.
Architectural Models for ZTNA
There are several ways to implement Zero Trust, depending on the
organization’s maturity and technical constraints: There are several
ways to implement Zero Trust, There are several ways to implement Zero
Trust, depending on the organization’s
Software-Defined Perimeter (SDP): Logical
perimeter where devices must authenticate before application access is
granted. Solutions like Zscaler Private Access and Google BeyondCorp use
this model. - **Software-Defined Perimeter (SDP)**: Logical perimeter
where devices must authenticate before application access -
**Software-Defined Perimeter (SDP)**: Logical perimeter where devices
must authenticate before application access is granted. Solutions like
Zscaler Private
Network-Based Microsegmentation: Using L4-L7
firewalls or SDN controllers to segment networks based on zones and
identity. - **Network-Based Microsegmentation**: Using L4-L7 firewalls
or SDN - **Network-Based Microsegmentation**: Using L4-L7 firewalls or
SDN controllers to segment networks
Identity-Aware Proxying: Applications are
fronted by access gateways that validate sessions against policy and
identity before forwarding traffic. - **Identity-Aware Proxying**:
Applications are fronted by access gateways - **Identity-Aware
Proxying**: Applications are fronted by access gateways that validate
sessions against policy
Agent-Based Models: Devices install endpoint
agents that perform posture checks and enforce access based on risk
signals. Examples include Illumio and Palo Alto Prisma Access. -
**Agent-Based Models**: Devices install endpoint agents that perform
posture checks and enforce - **Agent-Based Models**: Devices install
endpoint agents that perform posture checks and enforce access based on
risk signals. Examples
Overlay Network Models: Abstract the network
layer entirely with secure tunnels and routing based on identity and
context, e.g., NetFoundry or Twingate. - **Overlay Network Models**:
Abstract the network layer entirely with secure - **Overlay Network
Models**: Abstract the network layer entirely with secure tunnels and
routing based on identity
Policy Design and Enforcement
The success of Zero Trust depends on how well the policies are
crafted. Policies need to be granular but manageable. Most mature
implementations rely on attribute-based access control (ABAC), which
considers multiple inputs: The success of Zero Trust depends on how well
the policies are crafted. Policies need to The success of Zero Trust
depends on how well the policies are crafted. Policies need to be
granular but manageable. Most mature implementations rely
User Role – Sourced from AD, Okta, or other identity platforms.
Device Posture – Checked via EDR, MDM, or posture validation services.
Location and Time – Conditional access based on geolocation or business hours.
Application Sensitivity – Policies vary based on the data classification of the target app.
Policies are often encoded using policy-as-code tools like Open
Policy Agent (OPA), HashiCorp Sentinel, or embedded into network policy
engines. Enforcement can happen at the firewall, proxy, or application
level. In 2020, many enterprises begin enforcing policies inside
Kubernetes clusters using Cilium or Calico, combining service identity
with pod metadata. Policies are often encoded using policy-as-code tools
like Open Policy Agent (OPA), HashiCorp Sentinel, or embedded into
network policy engines. Enforcement can happen at the Policies are often
encoded using policy-as-code tools like Open Policy Agent (OPA),
HashiCorp Sentinel, or embedded into network policy engines. Enforcement
can happen at the firewall, proxy, or application level. In 2020, many
enterprises begin enforcing policies
Authentication, MFA, and Identity Federation
At the heart of Zero Trust is identity. Without robust, federated
identity systems, Zero Trust cannot scale. In 2020, most enterprises
standardize on SAML 2.0 or OpenID Connect for SSO. Multi-Factor
Authentication (MFA) becomes table stakes—SMS-based options are phased
out in favor of push-based MFA or hardware tokens like YubiKeys.
Federation across business units, partners, and clouds is enabled via
identity brokers like Azure AD, PingFederate, or Okta Universal
Directory. These brokers issue tokens that are short-lived and scoped,
enabling tight access boundaries. Passwordless authentication starts to
gain traction using device biometrics and certificate-based flows. At
this point, centralized identity is not optional—it’s the control plane
for the entire trust model. At the heart of Zero Trust is identity.
Without robust, federated identity systems, Zero Trust cannot scale. In
2020, most enterprises standardize on SAML 2.0 or OpenID Connect for
SSO. Multi-Factor Authentication (MFA) becomes table stakes—SMS-based
options are phased out in favor of push-based MFA or hardware tokens
like YubiKeys. Federation across business units, partners, At the heart
of Zero Trust is identity. Without robust, federated identity systems,
Zero Trust cannot scale. In 2020, most enterprises standardize on SAML
2.0 or OpenID Connect for SSO. Multi-Factor Authentication (MFA) becomes
table stakes—SMS-based options are phased out in favor of push-based
MFA or hardware tokens like YubiKeys. Federation across business units,
partners, and clouds is enabled via identity brokers like Azure AD,
PingFederate, or Okta Universal Directory. These brokers issue tokens
that are short-lived and scoped, enabling tight access boundaries.
Device and Endpoint Posture
User identity is only half the equation. Devices must also be
evaluated continuously. Endpoint Detection and Response (EDR) tools such
as CrowdStrike, SentinelOne, and Microsoft Defender ATP provide risk
scores and signals that feed into access decisions. MDM platforms
enforce policies like disk encryption, OS version compliance, or app
whitelisting. In mature setups, devices that drift out of compliance are
automatically quarantined or pushed into remediation workflows. In
early 2020, COVID-19 lockdowns accelerate BYOD and remote access
adoption, creating a surge in demand for posture-aware access control.
VPNs are increasingly replaced by cloud-based ZTNA agents that check
both identity and device before allowing any lateral movement. User
identity is only half the equation. Devices must also be evaluated
continuously. Endpoint Detection and Response (EDR) tools such as
CrowdStrike, SentinelOne, and Microsoft Defender ATP provide risk scores
and signals that feed into access decisions. MDM platforms enforce
policies like disk encryption, OS version compliance, or app
whitelisting. In mature setups, User identity is only half the equation.
Devices must also be evaluated continuously. Endpoint Detection and
Response (EDR) tools such as CrowdStrike, SentinelOne, and Microsoft
Defender ATP provide risk scores and signals that feed into access
decisions. MDM platforms enforce policies like disk encryption, OS
version compliance, or app whitelisting. In mature setups, devices that
drift out of compliance are automatically quarantined or pushed into
remediation workflows. In early 2020, COVID-19 lockdowns accelerate BYOD
and remote access adoption, creating
Network Enforcement and Microsegmentation
Segmentation is a critical piece of Zero Trust. Without it, a single
compromised device can pivot across the environment. In 2020, many
organizations shift from VLAN-based segmentation to identity-based
segmentation. Solutions like Cisco Tetration, VMware NSX, and Illumio
enable enforcement based on application context, user roles, and
workload identity. For cloud-native environments, Kubernetes Network
Policies and service meshes like Istio help enforce L4-L7 segmentation
between services. The biggest challenge remains visibility: mapping
dependencies before writing policies. This is often achieved through
passive traffic analysis, flow monitoring, or deploying in “monitor
mode” before switching to enforce. Organizations that rush enforcement
without adequate visibility often trigger outages and policy conflicts.
Segmentation is a critical piece of Zero Trust. Without it, a single
compromised device can pivot across the environment. In 2020, many
organizations shift from VLAN-based segmentation to identity-based
segmentation. Solutions like Cisco Tetration, VMware NSX, and Illumio
enable enforcement based on application context, user roles, and
workload identity. For cloud-native environments, Kubernetes Network
Segmentation is a critical piece of Zero Trust. Without it, a single
compromised device can pivot across the environment. In 2020, many
organizations shift from VLAN-based segmentation to identity-based
segmentation. Solutions like Cisco Tetration, VMware NSX, and Illumio
enable enforcement based on application context, user roles, and
workload identity. For cloud-native environments, Kubernetes Network
Policies and service meshes like Istio help enforce L4-L7 segmentation
between services. The biggest challenge remains visibility: mapping
dependencies before writing policies. This is often achieved through
Challenges in Implementation
While the theory of Zero Trust is elegant, the reality is complex.
Challenges include: While the theory of Zero Trust is While the theory
of Zero Trust is elegant, the reality
Policy Sprawl – Too many policies managed across different systems become brittle.
Tool Overload – Multiple vendors with overlapping capabilities increase cost and confusion.
Skill Gaps – Not all IT teams have experience with identity federation, policy-as-code, or microsegmentation.
User Experience – Poorly designed policies create friction and drive users to bypass controls.
Legacy Applications – Some systems don’t support modern auth standards or break under strict segmentation.
To succeed, Zero Trust programs require not just tools, but alignment
between InfoSec, networking, identity, and application teams.
Governance is key, as is leadership sponsorship. To succeed, Zero Trust
programs require not just tools, but alignment between To succeed, Zero
Trust programs require not just tools, but alignment between InfoSec,
networking, identity, and application teams.
Case Study Snapshots
Global Healthcare Provider – Rolled out Zscaler
Private Access across 12,000 users during COVID-19. Used Okta for
identity, CrowdStrike for posture validation, and integrated policy
enforcement at the application layer.
FinTech Startup – Designed from scratch using
cloud-native Zero Trust. All applications proxied behind Cloudflare
Access with SSO, device posture, and geolocation gating.
Government Entity – Migrated legacy VPN to SDP
model using Palo Alto Prisma Access. Integrated with Microsoft Defender
ATP and used Azure AD Conditional Access to enforce policies.
Each of these cases shows a different maturity level, but all
emphasize staged deployment, visibility-first approaches, and identity
as the cornerstone. Each of these cases shows a different maturity
level, but Each of these cases shows a different maturity level, but all
emphasize staged deployment, visibility-first
Conclusion
Zero Trust in 2020 moves from aspiration to execution. Fueled by
global events and cloud transformation, organizations begin rethinking
access not as a binary perimeter but as a continuous decision process.
Identity, posture, context, and policy all work together to ensure that
only the right entity accesses the right resource under the right
conditions. As tooling matures and architectural patterns solidify, Zero
Trust is no longer reserved for elite tech companies—it becomes a
roadmap for all organizations seeking security in a perimeter-less
world. Zero Trust in 2020 moves from aspiration to execution. Fueled by
global events and cloud transformation, organizations begin rethinking
access not as a binary perimeter but as a continuous decision process.
Identity, posture, context, and policy all work together to ensure Zero
Trust in 2020 moves from aspiration to execution. Fueled by global
events and cloud transformation, organizations begin rethinking access
not as a binary perimeter but as a continuous decision process.
Identity, posture, context, and policy all work together to ensure that
only the right entity accesses the right resource under the right
conditions. As tooling matures and architectural patterns solidify, Zero
ZTNA vs Traditional VPNs
A common misconception in 2020 is that Zero Trust is just a more
secure VPN. In reality, ZTNA represents a fundamental shift in access
architecture. Traditional VPNs extend the network perimeter to the user,
which often results in overprivileged access. Once connected, users can
often see and reach internal systems beyond their intended scope. ZTNA,
on the other hand, operates on the principle of application
segmentation. Users authenticate and are granted access to specific
applications—not the entire network. This distinction becomes critical
during large-scale remote work rollouts. ZTNA solutions don’t require
users to be placed on a flat internal IP space. They also offer better
scalability, audit logging, and dynamic policy enforcement. In 2020, as
VPN concentrators buckle under user load and split-tunneling introduces
risk, ZTNA emerges as the modern alternative that enables fine-grained
control and better user experience simultaneously. A common
misconception in 2020 is that Zero Trust is just a more secure VPN. In
reality, ZTNA represents a fundamental shift in access architecture.
Traditional VPNs extend the network perimeter to the user, which often
results in overprivileged access. Once connected, users can often see
and reach internal systems beyond their intended scope. ZTNA, on the
other hand, operates on the principle of application segmentation. Users
authenticate and are
Eduardo Wnorowski is a network infrastructure consultant and Director.
With over 25 years of experience in IT and consulting, he helps
organizations maintain stable and secure environments through proactive
auditing, optimization, and strategic guidance.
LinkedIn Profile