Lion Cipher Lab

Design a zero trust architecture with NIST SP 800-207 and assess maturity with CISA's model

• GRC / Compliance
• Advanced
• ~90 min
• Free · no account required

Why it matters

"Zero trust" is the most over-sold phrase in security: every vendor claims their box delivers it, most budgets are approved on the strength of the buzzword, and almost nobody who signs the purchase order can say what the ARCHITECTURE actually is. That gap is where money dies. Teams buy a new VPN, relabel it 'zero trust,' and change nothing about the standing, implicit trust that let one phished laptop reach the crown-jewel database — the exact failure the model exists to remove. The skill that matters is not reciting 'never trust, always verify'; it is being able to take a real organization,…

What you'll learn

• stating precisely what a zero trust architecture (ZTA) IS and is NOT — not a product, a VPN, or a firewall — and naming the implicit-trust-zone problem it exists to remove
• applying the SEVEN tenets of NIST SP 800-207 to a concrete organization, translating each abstract tenet into what it demands of THIS environment
• designing the logical core of a ZTA: Policy Engine (PE), Policy Administrator (PA), Policy Enforcement Point (PEP), and the PE+PA = Policy Decision Point (PDP) relationship
• listing the trust-algorithm INPUTS (identity, device/asset posture, threat intelligence, resource sensitivity, behavioral/environmental signals) and writing one concrete, enforceable access-decision policy for one real resource
• choosing a deployment model from 800-207 (device agent/gateway, enclave gateway, resource portal, device application sandboxing) and JUSTIFYING the choice against the scenario's constraints — including a legacy system that cannot host an agent
• assessing maturity across the FIVE CISA Zero Trust Maturity Model 2.0 pillars (Identity, Devices, Networks, Applications & Workloads, Data) plus the three cross-cutting capabilities (Visibility & Analytics, Automation & Orchestration, Governance), placing each at Traditional / Initial / Advanced / Optimal with written justification
• producing a PRIORITIZED roadmap of 3-5 sequenced initiatives, each tied to the pillar it advances and to WHY it comes when it does
• recognizing and avoiding the named failure modes: 'zero trust washing' (relabeling a VPN), the Policy Engine as a single point of failure/latency, assuming device posture you cannot actually measure, boiling the ocean, and forgetting the Data pillar
• exercising the core judgment: when a full ZTA program is worth the cost versus when perimeter-plus-segmentation is adequate, and how to sequence for an org that cannot do it all at once

Steps in this lab

1. Kill the myth: what a zero trust architecture actually is
2. The worked scenario — meet Kestrel Analytics
3. Apply the SEVEN tenets of NIST SP 800-207 to Kestrel
4. Design the logical core — PE, PA, PEP — and write one real access policy
5. Choose a deployment model from 800-207 — and justify it
6. Assess maturity across the FIVE CISA pillars (+ the three cross-cutting capabilities)
7. Produce the PRIORITIZED roadmap — 3-5 sequenced initiatives
8. Named pitfalls — and how a pro does it differently
9. Judgment: when a full ZTA is worth it — and when it isn't (yet)

Open the full interactive lab →