Zero Trust Architecture: Beyond the Perimeter

traditional_model:
  assumption: Trust inside the network
  controls:
    - Firewall at perimeter
    - VPN for remote access
    - Internal network is flat

  problems:
    - Once inside, attackers move freely
    - Cloud resources outside perimeter
    - Remote work expands attack surface
    - Insider threats ignored
    - East-west traffic unmonitored

zero_trust_principles:
  never_trust:
    - Don't trust based on network location
    - Don't trust based on IP address
    - Don't trust based on device ownership

  always_verify:
    - Verify identity on every request
    - Verify device health
    - Verify authorization

  least_privilege:
    - Grant minimum necessary access
    - Time-bound access
    - Just-in-time provisioning

  assume_breach:
    - Segment to limit blast radius
    - Monitor for anomalies
    - Log everything

authentication_requirements:
  mfa_everywhere:
    - All user access requires MFA
    - Phishing-resistant preferred (FIDO2/WebAuthn)
    - SMS/TOTP as minimum

  service_identity:
    - Mutual TLS between services
    - Short-lived certificates
    - Managed identity (cloud)

  api_authentication:
    - OAuth 2.0 / OpenID Connect
    - Short-lived tokens
    - Scoped permissions

# Example: Service mesh with mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT  # Require mTLS for all traffic

# BeyondCorp-style access policy
access_policy:
  user_trust:
    factors:
      - Identity verified (MFA)
      - Device managed and healthy
      - Behavior consistent with baseline
      - Location risk acceptable

  device_trust:
    factors:
      - Enrolled in MDM
      - OS patched
      - Disk encrypted
      - Security software running

  session_trust:
    factors:
      - Token not expired
      - No anomalous activity
      - Context hasn't changed

# Access decision example
def evaluate_access(request, user, device, resource):
    trust_score = 0

    # Identity factors
    if user.mfa_verified:
        trust_score += 30
    if user.verified_within(minutes=15):
        trust_score += 10

    # Device factors
    if device.managed:
        trust_score += 20
    if device.disk_encrypted:
        trust_score += 10
    if device.os_patched:
        trust_score += 10

    # Context factors
    if not user.location_anomalous:
        trust_score += 10
    if request.time_within_normal_hours:
        trust_score += 10

    # Resource requirements
    required_score = resource.sensitivity_score
    return trust_score >= required_score

microsegmentation:
  principle: Allow only required communication
  implementation:
    - Default deny all
    - Explicit allow per service
    - Label-based policies

  benefits:
    - Limit lateral movement
    - Contain breaches
    - Visibility into traffic

# Kubernetes Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-server-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-server
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
        - podSelector:
            matchLabels:
              app: mobile-backend
      ports:
        - port: 8080
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - port: 5432
    - to:
        - podSelector:
            matchLabels:
              app: cache
      ports:
        - port: 6379

# Istio Authorization Policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: order-service-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: order-service
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - cluster.local/ns/production/sa/api-gateway
              - cluster.local/ns/production/sa/checkout-service
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/orders/*"]

encryption_requirements:
  in_transit:
    - TLS 1.2+ for all connections
    - mTLS between services
    - No exceptions for "internal" traffic

  at_rest:
    - Encrypt all data at rest
    - Manage keys properly
    - Use cloud KMS where possible

  in_use:
    - Minimize data exposure in memory
    - Consider confidential computing
    - Tokenize sensitive data

# Attribute-based access control (ABAC)
data_access_policy:
  resources:
    - type: customer_data
      classification: pii
      rules:
        - principals:
            - role: support
          conditions:
            - ticket_assigned_to_user: true
          actions:
            - read
          fields:
            - exclude: [ssn, payment_info]

        - principals:
            - role: analyst
          conditions:
            - purpose: analytics
          actions:
            - read
          fields:
            - only: [aggregated_data]
          transforms:
            - anonymize

monitoring_requirements:
  network:
    - All traffic logged
    - Connection metadata captured
    - Anomaly detection enabled

  identity:
    - All authentication events
    - Authorization decisions logged
    - Session activity tracked

  data:
    - Data access logged
    - Sensitive data access alerted
    - Bulk operations flagged

# Behavior baseline and anomaly detection
class UserBehaviorAnalyzer:
    def __init__(self, user_id):
        self.baseline = self.load_baseline(user_id)

    def analyze_request(self, request):
        anomalies = []

        # Location analysis
        if self.is_impossible_travel(request.location, request.timestamp):
            anomalies.append(AnomalyType.IMPOSSIBLE_TRAVEL)

        # Time analysis
        if not self.is_normal_hours(request.timestamp):
            anomalies.append(AnomalyType.UNUSUAL_TIME)

        # Access pattern analysis
        if self.is_unusual_resource(request.resource):
            anomalies.append(AnomalyType.UNUSUAL_ACCESS)

        # Volume analysis
        if self.is_unusual_volume(request.timestamp):
            anomalies.append(AnomalyType.UNUSUAL_VOLUME)

        return anomalies

    def is_impossible_travel(self, location, timestamp):
        last_location, last_time = self.get_last_activity()
        distance = calculate_distance(location, last_location)
        time_diff = timestamp - last_time
        max_speed = 1000  # km/h (airplane)
        return distance / time_diff.hours > max_speed

zero_trust_phases:
  phase_1_visibility:
    duration: 3-6 months
    goals:
      - Inventory all assets and access patterns
      - Implement logging everywhere
      - Map data flows
      - Identify high-risk areas

  phase_2_identity:
    duration: 6-12 months
    goals:
      - MFA for all users
      - Service identity (mTLS)
      - Centralized identity provider
      - SSO for applications

  phase_3_segmentation:
    duration: 12-18 months
    goals:
      - Network policies implemented
      - Default deny established
      - Service-to-service auth
      - Microsegmentation

  phase_4_continuous:
    duration: Ongoing
    goals:
      - Continuous verification
      - Anomaly detection
      - Adaptive access
      - Regular review and improvement

zero_trust_stack:
  identity:
    - Okta, Azure AD, Google Workspace
    - FIDO2 keys, authenticator apps

  network:
    - Service mesh (Istio, Linkerd)
    - Network policies (Calico, Cilium)
    - Software-defined perimeter

  access:
    - Policy engine (OPA, Styra)
    - PAM (Privileged Access Management)
    - CASB (Cloud Access Security Broker)

  monitoring:
    - SIEM (Splunk, Elastic)
    - UEBA (User Entity Behavior Analytics)
    - NDR (Network Detection and Response)