For VA, moving to zero trust is simple concept to understand, but tough to implement