Review NCCoE Zero-trust architecture publication

[tulshi]

Review due August 8 link here

[tulshi]

Feedback provided:

• In section 3.3 (Assumptions), there is no mention of any assumption of interoperability between products. A statement such as there is an expectation that products should eventually interoperate regardless of their vendor origin will help

• In section 4.1.2 (ZTA Supporting Components), under ICAM

  • The bullet points for authentication and authorization management should be separated out. They are currently under one bullet on line 1703
  • There should be an additional bullet point for Continuous Access Evaluation, like similar bullet points under EDR/EPP and Security Analytics

• Section 4.2.1 (Build-Specific Features) describes two builds. There should be a discussion on how individual vendors were chosen to be a part of a certain build. Were there any limitations of interoperability that caused this choice?

• Appendix D.2 (Build Architecture) defines certain flows such as “User Joins the Enterprise” (D.2.2.2) and “Message Flow for a Successful Resource Access Request” (D.2.4), but does not describe how the session management flows defined in the ZTA in Operation section (4.1.3) are achieved.

• Appendix F has the similar issue that it defines the access request flow (F.2.3), but does not address the session management flow defined in the “ZTA in Operation” section (4.1.3)