Never trust, always verify: Identity & Zero Trust
For decades, security worked like a castle: a strong wall around the network, and anyone inside was trusted. Then people started working from home, apps moved to the cloud and attackers learned to steal passwords. Zero trust flips the idea. Nobody gets trusted just because of where they are on a network. Every request is checked: who is asking, from what device, for which resource, right now. In 2026 identity is the front door of almost every system, and passkeys and phishing-resistant sign-in are replacing passwords. NIST's published guidance (SP 800-207, SP 1800-35 and the new SP 800-63-4) and CISA's maturity model all point toward that way of working. We expect it to keep spreading through 2040, but that date is our own forward-looking framing, not a NIST requirement. This page is the I in SHIELD: Identity & zero trust.
What you'll be able to do
Explain zero trust in plain words
Describe how it differs from the castle-and-moat model, using the ideas in NIST SP 800-207.
Place an organization on a maturity scale
Use CISA's five pillars and four stages to say where a team is today and what to improve next.
Choose strong sign-in
Explain why passkeys and other phishing-resistant methods beat passwords and one-time codes.
Apply least privilege
Give people and apps only the access they need, for only as long as they need it.
Understand ZTNA, SASE and microsegmentation
Say what each one does and when a small team might use it.
Build a small zero-trust lab
Stand up a free overlay network or identity server and watch policy decide who gets in.
The big ideas, in plain English
All links are official or vendor-neutral where possible. Hours are our estimates.
NIST SP 800-207: Zero Trust Architecture
Published in August 2020 and still the reference definition. It says zero trust moves defenses away from static network perimeters and toward users, assets and resources, and that no trust is granted implicitly because of network location or ownership. Authentication and authorization for both the person and the device happen before a session to a resource starts. NIST's companion papers add cloud-native and implementation detail. Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 3 hours (estimate) · Level: Beginner to Intermediate.
SP 800-207
SP 800-207A
NIST SP 1800-35: Implementing a Zero Trust Architecture
From NIST's National Cybersecurity Center of Excellence (NCCoE). The final high-level document (June 10, 2025) describes 19 example zero-trust implementations built with 24 collaborators, so you can see how real products fit together. The NCCoE project page links the how-to guides. Provider: NIST NCCoE. You earn: none, this is reading. Cost: Free resource · About 3 hours for the high-level document (estimate) · Level: Intermediate.
SP 1800-35
NCCoE project page
CISA Zero Trust Maturity Model, Version 2.0
A friendly yardstick built to line up with OMB memo M-22-09, the U.S. federal zero-trust strategy. It has five pillars (Identity, Devices, Networks, Applications and Workloads, Data), three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, Governance) and four stages: Traditional, Initial, Advanced and Optimal. You do not need to be a government agency to use it as a checklist. Provider: CISA. You earn: none, this is reading. Cost: Free resource · About 2 hours (estimate) · Level: Beginner to Intermediate.
Maturity Model page
Version 2.0 (PDF)
OMB M-22-09
NIST SP 800-63-4: Digital Identity Guidelines
Revision 4 is final (July 2025) and replaces SP 800-63-3. It comes in four volumes: the overview (63-4), Identity Proofing and Enrollment (63A-4), Authentication and Authenticator Management (63B-4) and Federation and Assertions (63C-4). Highlights NIST lists include support for synced authenticators such as synced passkeys, new controls against injection attacks and forged media such as deepfakes, and tougher fraud requirements for identity proofing. Provider: NIST. You earn: none, this is reading. Cost: Free resource · About 3 hours for the overview and 63B (estimate) · Level: Intermediate.
SP 800-63-4 (NIST CSRC)
Read it online
Authentication volume (63B-4)
MFA, phishing-resistant sign-in and passkeys
Multi-factor authentication (MFA) asks for more than a password. But a one-time code can still be tricked out of you on a fake website. Phishing-resistant methods, such as passkeys and hardware security keys built on FIDO standards, tie your sign-in to the real website, so a look-alike site gets nothing. CISA publishes a short fact sheet on phishing-resistant MFA, and the FIDO Alliance and the open passkeys.dev site explain how passkeys work. Provider: CISA, FIDO Alliance, passkeys.dev. You earn: none, this is reading. Cost: Free resource · About 2 hours (estimate) · Level: Beginner.
CISA: phishing-resistant MFA (PDF)
passkeys.dev
FIDO Alliance design guidelines
CISA: turn on MFA
Least privilege, microsegmentation, ZTNA and SASE
Least privilege: every person, device and app gets the smallest set of access it needs. Microsegmentation: split a network into small zones so an intruder who gets into one cannot wander into the others. ZTNA (zero trust network access): instead of a VPN that puts you on the whole network, you are connected only to the specific app you are allowed to use, after your identity and device are checked. SASE (secure access service edge): a way of delivering networking and security, including ZTNA, as a cloud service. Cloudflare's learning paths and the OpenZiti introduction explain these ideas with diagrams. Provider: Cloudflare Learning Paths and OpenZiti (NetFoundry). You earn: none, this is reading. Cost: Free resource · About 3 hours (estimate) · Level: Beginner.
OpenZiti: zero trust vs. VPN
OpenZiti: zero trust models
Cloudflare learning paths
Google BeyondCorp: where the idea went mainstream
Google moved its own workforce off a privileged corporate network and onto identity-aware access. The research papers that describe how are free to read and are still some of the clearest explanations of why and how. Provider: Google Research. You earn: none, this is reading. Cost: Free resource · About 3 hours for two papers (estimate) · Level: Intermediate.
BeyondCorp: A New Approach
The Access Proxy
Migrating to BeyondCorp
Your free learning path
Every step below is free, so the recommended path costs $0. Paid exams are collected in an optional block at the end. Hours are our estimates, using the lengths shown on each provider's page where available.
Step 1 · Microsoft Learn: Zero Trust principles
Provider: Microsoft Learn. You earn: module achievements on your Microsoft Learn profile as you finish (certificate not confirmed). Cost: Free course · About 1.8 hours (Microsoft lists 106 minutes) · Level: Beginner. Establish the guiding principles and core components of Zero Trust.
Open the learning path
Step 2 · Microsoft Learn: security, compliance and identity concepts
Provider: Microsoft Learn. You earn: module achievements on your Microsoft Learn profile (certificate not confirmed). Cost: Free course · About 1.6 hours (97 minutes listed) plus about 3 hours for the Entra path (179 minutes listed) · Level: Beginner. Two beginner learning paths: Introduction to security, compliance, and identity concepts and Introduction to Microsoft Entra. You do not need an Azure account for the reading units.
Concepts path
Microsoft Entra path
Step 3 · Microsoft Learn: SC-300 identity and access learning (free), exam optional
Provider: Microsoft Learn. You earn: module achievements and the free SC-300 practice assessment; the Identity and Access Administrator Associate certification needs the paid exam. Cost: Free course · About 15 hours across four paths (256 + 298 + 154 + 203 minutes listed) · Level: Intermediate. The four self-paced paths that match the exam areas are Implement an identity management solution, Implement an authentication and access management solution, Implement access management for apps and Plan and implement an identity governance strategy. Microsoft updates the English exam on October 28, 2026, so the study guide is worth a look.
Identity management
Authentication and access
Access for apps
Identity governance
Study guide and practice
Step 4 · Cloud Security Alliance: the free CCZT Prep Kit
Provider: Cloud Security Alliance (CSA). You earn: self-study knowledge; the Certificate of Competence in Zero Trust (CCZT) needs the paid exam. Cost: Free study kit · About 15 hours (estimate) · Level: Intermediate. CSA says its free prep kit has what you need to study for the exam on your own. CSA's self-paced and instructor-led training courses are paid, so we do not include them in the $0 path.
CCZT Prep Kit
About CCZT
Step 5 · OpenZiti docs and tutorials
Provider: OpenZiti (open-source, run by NetFoundry). You earn: hands-on understanding of an open-source zero-trust overlay network (no certificate). Cost: Free course · About 6 hours (estimate) · Level: Intermediate. Start with the introduction and the “zero trust vs. VPN” page, then run a quickstart. The old openziti.io documentation links now forward to NetFoundry's docs.
OpenZiti introduction
Quickstarts
OpenZiti on GitHub
Step 7 · CISA Learning, then the maturity model in practice
Provider: CISA. You earn: free training; certificate of completion not confirmed. Cost: Free course · Your pick (estimate 2 to 10 hours per course) · Level: Beginner to Advanced. CISA Learning lists no-cost courses mapped to the NICE Framework. After a course, score a small organization against the five pillars of the Zero Trust Maturity Model.
About CISA Learning
Zero Trust Maturity Model
Optional, later, when sponsored · paid exams
Not part of the $0 path. CSA CCZT exam: $175, which includes two attempts usable within two years; open-book and online, 60 multiple-choice questions, 120 minutes, 80% to pass (per CSA's page). Microsoft SC-300: a paid proctored exam of 100 minutes, with the price set by country or region and shown when you schedule it (we could not confirm a single U.S. price). Microsoft certifications are renewed each year with a free online assessment. Check the official pages for current prices before anyone commits. Provider: CSA and Microsoft. You earn: CCZT digital badge and certificate, or Microsoft Certified: Identity and Access Administrator Associate. Cost: Paid exam · About 15 to 30 hours of study (estimate) · Level: Intermediate.
CCZT details (paid exam)
SC-300 details (paid exam)
Hands-on free labs
Use your own computer or a school lab, and only on systems you own or have permission to use. Free plans change, so check each provider's current limits before you sign up.
OpenZiti local network
Run a small zero-trust overlay on your own machine with the local quickstart, or use the Docker Compose version if you know Docker. Create an identity, write a policy, and watch an app become reachable only to that identity.
Keycloak identity server
Keycloak is open-source identity and access management. Follow its Docker getting-started guide, create a user and add a second factor.
Cloudflare Zero Trust free plan
Cloudflare says it offers a free plan for zero-trust access. Pair it with the Clientless Access learning path and the setup guide. Check the current user limit and terms on the plans page first.
Tailscale Personal plan
Tailscale lists a free Personal plan (up to 6 users, non-commercial use) for private device-to-device networking with identity-based access rules. Start with the install guide and see its pricing page for current limits.
Passkey playground
Register a passkey on the WebAuthn demo site. Then turn on a passkey or an authenticator app for one of your own real accounts, using CISA's MFA guide.
Maturity scorecard
Print the CISA model pillars. Rate a pretend company from Traditional to Optimal on each one and choose the single change that helps most.
Exercise: the castle versus the checkpoint
Draw your school or club network twice. First as a castle: one wall, everyone inside trusted. Then as a set of checkpoints: for each app (email, files, grades, printers) write who may use it, from which device, and how that is checked. Mark the pillar of the CISA model each checkpoint belongs to. Which drawing would you rather defend against a stolen password?
For Curiosity Coaches
Aim for a 45 to 60 minute session with a drawing or a live demo. Keep the focus on the idea that trust should be earned for each request.
Discussion prompts
- Why is a password like a key that anyone can copy? What makes a passkey harder to steal?
- Should the person who runs the printer have the same access as the person who runs payroll? Why or why not?
- What do you lose if every request gets extra checks? How could a system stay easy to use?
- Does “never trust” sound unfriendly? How does it protect the people inside the organization?
A 4-week plan
- Week 1: Microsoft Learn Zero Trust principles, then the castle versus checkpoint exercise.
- Week 2: CISA fact sheet on phishing-resistant MFA and a passkey demo. Learners secure one of their own accounts.
- Week 3: Skim NIST SP 800-207 and the CISA maturity model, then complete a maturity scorecard together.
- Week 4: Pick one lab (OpenZiti, Keycloak or Cloudflare) and present what was protected and how.
Age and level fit
- Ages 12 to 15: the castle exercise, passkey demo, and MFA setup on their own accounts.
- Ages 16 and up, and career-changers: add the Microsoft Learn paths and one hands-on lab.
- IT professionals: go to SP 800-207, SP 1800-35 and the SC-300 learning paths, and plan an OpenZiti or Keycloak pilot.
Careers this connects to
Typical job titles include identity and access management analyst, cloud security engineer, zero-trust architect, network security engineer and security consultant. See NIST's NICE Framework for official work roles and skills.
Free resource library
Identity and authentication
Vendor-learning (free reading)
Open source and community
Related reading on this site: the SHIELD 2040 hub and NIST Frameworks, Governance & Risk.