100%
MFA enrollment
50 of 50 identities covered
Security posture
LOCAL CONTROL PLANELOADING EVIDENCE
ZERO TRUST EXECUTIVE OVERVIEW
Continuous verification.
Measurable control.
A reviewable model for identity, device, network, application, and data access across a fictional 50-user organization.
91.7POSTURE INDEX
84.8%
ZTNA traffic coverage
Modeled protected application flows
92%
Device compliance
46 of 50 modeled endpoints
187–210%
Year-1 modeled ROI
Estimate against $34,200 Year-1 cost
RISK TREND / 30 DAYS
Policy decisions
CONTROL COVERAGE
NIST pillars
Identity100
Device92
Network85
Application88
Data79
AUTHORIZED TEST HARNESS
Attack simulation log.
Twelve controlled scenarios exercise policy, detection, and response paths. Results are simulations—not production attack claims.
NIST SP 800-207 ALIGNMENT
Five verification pillars.
Every request is evaluated from multiple signals; network location alone never grants trust.
ACCESS
REQUEST
REQUEST
POLICY ENGINEVERIFY CONTEXTallow · limit · deny
Identity
Verify the person or workload with MFA, risk signals, and short-lived sessions.
Device
Check management, encryption, health, and compliance before sensitive access.
Network
Segment flows and continuously inspect traffic instead of trusting a location.
Application
Grant least-privilege access to a named resource, not the whole internal network.
Data
Apply classification, DLP, encryption, and session controls to the information itself.
EVIDENCE REGISTER
Thirty controls, mapped to owners and proof.
DEVICE POSTURE
Thirty modeled endpoints under continuous review.
ABOUT THIS BUILD
An explainable capstone,
not a black box.
Perimeter trust breaks under cloud work.
I built SentinelCore as a graduate capstone implementation for a fictional mid-size company, Nimbus Technologies. The problem is practical: users, devices, applications, and data no longer sit behind one trustworthy network boundary.
Make each decision reviewable.
I translated NIST SP 800-207 principles into 30 control records, device posture, policy artifacts, privileged-access rules, KQL detections, response playbooks, and a dashboard that computes its metrics from evidence data.
Stage controls safely.
I start Conditional Access in report-only mode, monitor break-glass use separately, require approved and time-bound privilege elevation, and connect every detection to a response path.
Reference implementation.
This repository is an executable portfolio reference—not a claim of live tenant deployment. The organization, telemetry, and ROI are modeled and documented for review. Production use requires tenant validation, named owners, rollout evidence, and control testing.
AZUREENTRA IDSENTINELDEFENDERKQLNIST 800-207