Zero Trust Networking in Practice: Architectures, Policies, and Deployment Lessons

March, 2020 • 14 min read

Introduction

By March 2020, Zero Trust is no longer just a security buzzword—it’s a practical architectural goal for organizations of all sizes. With the rapid rise of remote work, the proliferation of SaaS, and the increasing complexity of hybrid networks, the concept of a trusted perimeter collapses. Instead, enterprises are turning to Zero Trust Network Architectures (ZTNA) to enforce least privilege, identity-aware access control, and continuous trust evaluation. This post explores how Zero Trust evolved into real deployments by 2020, unpacking the architectures, policy engines, enforcement layers, and operational challenges of implementation. By March 2020, Zero Trust is no longer just a security buzzword—it’s a practical architectural goal for organizations of all sizes. With the rapid rise of remote work, the proliferation of SaaS, and the increasing complexity of hybrid networks, the concept of a trusted perimeter By March 2020, Zero Trust is no longer just a security buzzword—it’s a practical architectural goal for organizations of all sizes. With the rapid rise of remote work, the proliferation of SaaS, and the increasing complexity of hybrid networks, the concept of a trusted perimeter collapses. Instead, enterprises are turning to Zero Trust Network Architectures (ZTNA) to enforce least privilege, identity-aware access control, and continuous trust evaluation. This

The Core Tenets of Zero Trust

The foundation of Zero Trust lies in a simple but powerful principle: never trust, always verify. Access is not granted based on location (inside or outside the network) but on identity, context, and policy compliance. The five pillars of Zero Trust in network security are: The foundation of Zero Trust lies in a simple but powerful principle: never trust, always verify. Access is not granted based on The foundation of Zero Trust lies in a simple but powerful principle: never trust, always verify. Access is not granted based on location (inside or outside the network) but on identity, context, and

1. User and Device Identity – Authentication must validate the user and ensure the device meets posture requirements.

2. Least Privilege Access – Users and services get only the access they require, no more.

3. Microsegmentation – The network is divided into zones, and communication is explicitly allowed between them.

4. Continuous Monitoring – Sessions are evaluated throughout their lifespan, not just at the start.

5. Policy Enforcement – Access policies are centrally managed and enforced at the edge or application layer.

Architectural Models for ZTNA

There are several ways to implement Zero Trust, depending on the organization’s maturity and technical constraints: There are several ways to implement Zero Trust, There are several ways to implement Zero Trust, depending on the organization’s

• Software-Defined Perimeter (SDP): Logical perimeter where devices must authenticate before application access is granted. Solutions like Zscaler Private Access and Google BeyondCorp use this model. - **Software-Defined Perimeter (SDP)**: Logical perimeter where devices must authenticate before application access - **Software-Defined Perimeter (SDP)**: Logical perimeter where devices must authenticate before application access is granted. Solutions like Zscaler Private

• Network-Based Microsegmentation: Using L4-L7 firewalls or SDN controllers to segment networks based on zones and identity. - **Network-Based Microsegmentation**: Using L4-L7 firewalls or SDN - **Network-Based Microsegmentation**: Using L4-L7 firewalls or SDN controllers to segment networks

• Identity-Aware Proxying: Applications are fronted by access gateways that validate sessions against policy and identity before forwarding traffic. - **Identity-Aware Proxying**: Applications are fronted by access gateways - **Identity-Aware Proxying**: Applications are fronted by access gateways that validate sessions against policy

• Agent-Based Models: Devices install endpoint agents that perform posture checks and enforce access based on risk signals. Examples include Illumio and Palo Alto Prisma Access. - **Agent-Based Models**: Devices install endpoint agents that perform posture checks and enforce - **Agent-Based Models**: Devices install endpoint agents that perform posture checks and enforce access based on risk signals. Examples

• Overlay Network Models: Abstract the network layer entirely with secure tunnels and routing based on identity and context, e.g., NetFoundry or Twingate. - **Overlay Network Models**: Abstract the network layer entirely with secure - **Overlay Network Models**: Abstract the network layer entirely with secure tunnels and routing based on identity

Policy Design and Enforcement

The success of Zero Trust depends on how well the policies are crafted. Policies need to be granular but manageable. Most mature implementations rely on attribute-based access control (ABAC), which considers multiple inputs: The success of Zero Trust depends on how well the policies are crafted. Policies need to The success of Zero Trust depends on how well the policies are crafted. Policies need to be granular but manageable. Most mature implementations rely

• User Role – Sourced from AD, Okta, or other identity platforms.

• Device Posture – Checked via EDR, MDM, or posture validation services.

• Location and Time – Conditional access based on geolocation or business hours.

• Application Sensitivity – Policies vary based on the data classification of the target app.

Policies are often encoded using policy-as-code tools like Open Policy Agent (OPA), HashiCorp Sentinel, or embedded into network policy engines. Enforcement can happen at the firewall, proxy, or application level. In 2020, many enterprises begin enforcing policies inside Kubernetes clusters using Cilium or Calico, combining service identity with pod metadata. Policies are often encoded using policy-as-code tools like Open Policy Agent (OPA), HashiCorp Sentinel, or embedded into network policy engines. Enforcement can happen at the Policies are often encoded using policy-as-code tools like Open Policy Agent (OPA), HashiCorp Sentinel, or embedded into network policy engines. Enforcement can happen at the firewall, proxy, or application level. In 2020, many enterprises begin enforcing policies

Authentication, MFA, and Identity Federation

At the heart of Zero Trust is identity. Without robust, federated identity systems, Zero Trust cannot scale. In 2020, most enterprises standardize on SAML 2.0 or OpenID Connect for SSO. Multi-Factor Authentication (MFA) becomes table stakes—SMS-based options are phased out in favor of push-based MFA or hardware tokens like YubiKeys. Federation across business units, partners, and clouds is enabled via identity brokers like Azure AD, PingFederate, or Okta Universal Directory. These brokers issue tokens that are short-lived and scoped, enabling tight access boundaries. Passwordless authentication starts to gain traction using device biometrics and certificate-based flows. At this point, centralized identity is not optional—it’s the control plane for the entire trust model. At the heart of Zero Trust is identity. Without robust, federated identity systems, Zero Trust cannot scale. In 2020, most enterprises standardize on SAML 2.0 or OpenID Connect for SSO. Multi-Factor Authentication (MFA) becomes table stakes—SMS-based options are phased out in favor of push-based MFA or hardware tokens like YubiKeys. Federation across business units, partners, At the heart of Zero Trust is identity. Without robust, federated identity systems, Zero Trust cannot scale. In 2020, most enterprises standardize on SAML 2.0 or OpenID Connect for SSO. Multi-Factor Authentication (MFA) becomes table stakes—SMS-based options are phased out in favor of push-based MFA or hardware tokens like YubiKeys. Federation across business units, partners, and clouds is enabled via identity brokers like Azure AD, PingFederate, or Okta Universal Directory. These brokers issue tokens that are short-lived and scoped, enabling tight access boundaries.

Device and Endpoint Posture

User identity is only half the equation. Devices must also be evaluated continuously. Endpoint Detection and Response (EDR) tools such as CrowdStrike, SentinelOne, and Microsoft Defender ATP provide risk scores and signals that feed into access decisions. MDM platforms enforce policies like disk encryption, OS version compliance, or app whitelisting. In mature setups, devices that drift out of compliance are automatically quarantined or pushed into remediation workflows. In early 2020, COVID-19 lockdowns accelerate BYOD and remote access adoption, creating a surge in demand for posture-aware access control. VPNs are increasingly replaced by cloud-based ZTNA agents that check both identity and device before allowing any lateral movement. User identity is only half the equation. Devices must also be evaluated continuously. Endpoint Detection and Response (EDR) tools such as CrowdStrike, SentinelOne, and Microsoft Defender ATP provide risk scores and signals that feed into access decisions. MDM platforms enforce policies like disk encryption, OS version compliance, or app whitelisting. In mature setups, User identity is only half the equation. Devices must also be evaluated continuously. Endpoint Detection and Response (EDR) tools such as CrowdStrike, SentinelOne, and Microsoft Defender ATP provide risk scores and signals that feed into access decisions. MDM platforms enforce policies like disk encryption, OS version compliance, or app whitelisting. In mature setups, devices that drift out of compliance are automatically quarantined or pushed into remediation workflows. In early 2020, COVID-19 lockdowns accelerate BYOD and remote access adoption, creating

Network Enforcement and Microsegmentation

Segmentation is a critical piece of Zero Trust. Without it, a single compromised device can pivot across the environment. In 2020, many organizations shift from VLAN-based segmentation to identity-based segmentation. Solutions like Cisco Tetration, VMware NSX, and Illumio enable enforcement based on application context, user roles, and workload identity. For cloud-native environments, Kubernetes Network Policies and service meshes like Istio help enforce L4-L7 segmentation between services. The biggest challenge remains visibility: mapping dependencies before writing policies. This is often achieved through passive traffic analysis, flow monitoring, or deploying in “monitor mode” before switching to enforce. Organizations that rush enforcement without adequate visibility often trigger outages and policy conflicts. Segmentation is a critical piece of Zero Trust. Without it, a single compromised device can pivot across the environment. In 2020, many organizations shift from VLAN-based segmentation to identity-based segmentation. Solutions like Cisco Tetration, VMware NSX, and Illumio enable enforcement based on application context, user roles, and workload identity. For cloud-native environments, Kubernetes Network Segmentation is a critical piece of Zero Trust. Without it, a single compromised device can pivot across the environment. In 2020, many organizations shift from VLAN-based segmentation to identity-based segmentation. Solutions like Cisco Tetration, VMware NSX, and Illumio enable enforcement based on application context, user roles, and workload identity. For cloud-native environments, Kubernetes Network Policies and service meshes like Istio help enforce L4-L7 segmentation between services. The biggest challenge remains visibility: mapping dependencies before writing policies. This is often achieved through

Challenges in Implementation

While the theory of Zero Trust is elegant, the reality is complex. Challenges include: While the theory of Zero Trust is While the theory of Zero Trust is elegant, the reality

• Policy Sprawl – Too many policies managed across different systems become brittle.

• Tool Overload – Multiple vendors with overlapping capabilities increase cost and confusion.

• Skill Gaps – Not all IT teams have experience with identity federation, policy-as-code, or microsegmentation.

• User Experience – Poorly designed policies create friction and drive users to bypass controls.

• Legacy Applications – Some systems don’t support modern auth standards or break under strict segmentation.

To succeed, Zero Trust programs require not just tools, but alignment between InfoSec, networking, identity, and application teams. Governance is key, as is leadership sponsorship. To succeed, Zero Trust programs require not just tools, but alignment between To succeed, Zero Trust programs require not just tools, but alignment between InfoSec, networking, identity, and application teams.

Case Study Snapshots

1. Global Healthcare Provider – Rolled out Zscaler Private Access across 12,000 users during COVID-19. Used Okta for identity, CrowdStrike for posture validation, and integrated policy enforcement at the application layer.

2. FinTech Startup – Designed from scratch using cloud-native Zero Trust. All applications proxied behind Cloudflare Access with SSO, device posture, and geolocation gating.

3. Government Entity – Migrated legacy VPN to SDP model using Palo Alto Prisma Access. Integrated with Microsoft Defender ATP and used Azure AD Conditional Access to enforce policies.

Each of these cases shows a different maturity level, but all emphasize staged deployment, visibility-first approaches, and identity as the cornerstone. Each of these cases shows a different maturity level, but Each of these cases shows a different maturity level, but all emphasize staged deployment, visibility-first

Conclusion

Zero Trust in 2020 moves from aspiration to execution. Fueled by global events and cloud transformation, organizations begin rethinking access not as a binary perimeter but as a continuous decision process. Identity, posture, context, and policy all work together to ensure that only the right entity accesses the right resource under the right conditions. As tooling matures and architectural patterns solidify, Zero Trust is no longer reserved for elite tech companies—it becomes a roadmap for all organizations seeking security in a perimeter-less world. Zero Trust in 2020 moves from aspiration to execution. Fueled by global events and cloud transformation, organizations begin rethinking access not as a binary perimeter but as a continuous decision process. Identity, posture, context, and policy all work together to ensure Zero Trust in 2020 moves from aspiration to execution. Fueled by global events and cloud transformation, organizations begin rethinking access not as a binary perimeter but as a continuous decision process. Identity, posture, context, and policy all work together to ensure that only the right entity accesses the right resource under the right conditions. As tooling matures and architectural patterns solidify, Zero

ZTNA vs Traditional VPNs

A common misconception in 2020 is that Zero Trust is just a more secure VPN. In reality, ZTNA represents a fundamental shift in access architecture. Traditional VPNs extend the network perimeter to the user, which often results in overprivileged access. Once connected, users can often see and reach internal systems beyond their intended scope. ZTNA, on the other hand, operates on the principle of application segmentation. Users authenticate and are granted access to specific applications—not the entire network. This distinction becomes critical during large-scale remote work rollouts. ZTNA solutions don’t require users to be placed on a flat internal IP space. They also offer better scalability, audit logging, and dynamic policy enforcement. In 2020, as VPN concentrators buckle under user load and split-tunneling introduces risk, ZTNA emerges as the modern alternative that enables fine-grained control and better user experience simultaneously. A common misconception in 2020 is that Zero Trust is just a more secure VPN. In reality, ZTNA represents a fundamental shift in access architecture. Traditional VPNs extend the network perimeter to the user, which often results in overprivileged access. Once connected, users can often see and reach internal systems beyond their intended scope. ZTNA, on the other hand, operates on the principle of application segmentation. Users authenticate and are

Eduardo Wnorowski is a network infrastructure consultant and Director.
With over 25 years of experience in IT and consulting, he helps organizations maintain stable and secure environments through proactive auditing, optimization, and strategic guidance.
LinkedIn Profile