DESIGN, IMPLEMENTATION, AND EMPIRICAL VALIDATION OF ZERO_TRUST ARCHITECTURE USING OPEN_SOURCE PFSENSE ON COMMODITY HARDWARE_ A NIGERIAN ENTERPRISE CASE STUDY

ABSTRACT Traditional perimeter-based security models have been empirically demonstrated as inadequate for contemporary enterprise threats, with organizations lacking Zero-Trust controls experiencing 40% higher successful breach rates (Hasan, 2024). While Zero-Trust Architecture theory is mature as defined in NIST SP 800-207, practical, physically implemented and validated deployments remain scarce in African academic literature (Mushtaq et al., 2025). This research presents a complete, independently reproducible implementation of a five-zone microsegmented Zero-Trust enterprise network using exclusively open-source tools: pfSense Community Edition 2.7 as Policy Enforcement Point and Policy Administrator, Suricata 7.x as IDS, Wazuh 4.9.2 as SIEM, and custom WatchTower SOC dashboard. The architecture was virtualized across three commodity PCs (4GB RAM each) using VirtualBox 7.2, implementing subnets WAN 192.168.100.0/24, LAN 10.10.10.0/24, DMZ 10.10.20.0/24, Monitoring 10.10.30.0/24, Attack Zone 10.10.40.0/24. A 17-rule default-deny firewall policy with whitelist-by-exception was enforced, logging all events via syslog UDP 514 to Wazuh. Validation via 12 structured policy verification tests (ZT-01 to ZT-12) achieved 100% PASS rate, confirming Attack Zone isolation, DMZ-to-LAN critical deny, and SIEM full monitoring access. Compliance evaluation scored 95% against NIST SP 800-207 covering all seven tenets, 87% PCI-DSS v4.0, and 81% CBN Cybersecurity Framework. This work demonstrates enterprise-grade ZTA is achievable at <$500 hardware cost with zero software licensing, providing reproducible blueprint for Nigerian SMEs and universities.