Zero Trust Architecture

Zero Trust Architecture

What I Do

I provide guidance on implementing zero trust security architectures where no user, device, or network segment is implicitly trusted. This includes continuous verification of identity, device health, and context for every access request, microsegmentation of networks, and policy-based access control.

When to Use Me

• Designing a zero trust architecture for an organization or application
• Implementing continuous authentication and authorization checks
• Configuring microsegmentation between services
• Setting up device trust and health verification
• Migrating from perimeter-based security to zero trust
• Implementing policy engines for access decisions

Core Concepts

1. Never Trust, Always Verify: Authenticate and authorize every request regardless of source network, previous authentication, or device.
2. Least Privilege Access: Grant minimum required permissions for the specific task, resource, and time window.
3. Microsegmentation: Divide networks into granular zones with individual access policies for each segment.
4. Continuous Verification: Re-evaluate trust continuously based on user behavior, device state, and context changes.
5. Device Trust: Verify device identity, health, patch level, and compliance before granting access.
6. Context-Aware Policies: Make access decisions based on user identity, device, location, time, and risk score.
7. Assume Breach: Design systems assuming adversaries are already inside the network and limit blast radius.

Code Examples

1. Policy Decision Point (Python)

from dataclasses import dataclass
from enum import Enum
from typing import List

class Decision(Enum):
    ALLOW = "allow"
    DENY = "deny"
    MFA_REQUIRED = "mfa_required"

@dataclass
class AccessContext:
    user_id: str
    device_id: str
    device_compliant: bool
    ip_address: str
    resource: str
    action: str
    risk_score: float
    mfa_verified: bool

def evaluate_access(ctx: AccessContext) -> Decision:
    if not ctx.device_compliant:
        return Decision.DENY
    if ctx.risk_score > 0.8:
        return Decision.DENY
    if ctx.risk_score > 0.5 and not ctx.mfa_verified:
        return Decision.MFA_REQUIRED
    if ctx.action in ("delete", "admin") and not ctx.mfa_verified:
        return Decision.MFA_REQUIRED
    return Decision.ALLOW

2. Service-to-Service mTLS Verification (Go)

package main

import (
	"crypto/tls"
	"crypto/x509"
	"log"
	"net/http"
	"os"
)

func createMTLSClient(certFile, keyFile, caFile string) (*http.Client, error) {
	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
	if err != nil {
		return nil, err
	}
	caCert, err := os.ReadFile(caFile)
	if err != nil {
		return nil, err
	}
	caPool := x509.NewCertPool()
	caPool.AppendCertsFromPEM(caCert)

	tlsConfig := &tls.Config{
		Certificates: []tls.Certificate{cert},
		RootCAs:      caPool,
		MinVersion:   tls.VersionTLS13,
	}
	return &http.Client{
		Transport: &http.Transport{TLSClientConfig: tlsConfig},
	}, nil
}

3. Request Context Enrichment Middleware (Python/FastAPI)

from fastapi import Request, HTTPException
from starlette.middleware.base import BaseHTTPMiddleware
from typing import Optional
import ipaddress

TRUSTED_NETWORKS = [ipaddress.ip_network("10.0.0.0/8")]

class ZeroTrustMiddleware(BaseHTTPMiddleware):
    async def dispatch(self, request: Request, call_next):
        context = {
            "user": getattr(request.state, "user", None),
            "device_id": request.headers.get("X-Device-ID"),
            "client_ip": request.client.host,
            "user_agent": request.headers.get("User-Agent", ""),
            "request_id": request.headers.get("X-Request-ID"),
        }
        ip = ipaddress.ip_address(request.client.host)
        context["is_internal"] = any(ip in net for net in TRUSTED_NETWORKS)
        request.state.security_context = context
        response = await call_next(request)
        return response

Best Practices

1. Authenticate every request with strong identity verification regardless of network location.
2. Use mTLS for service-to-service communication to ensure mutual identity verification.
3. Implement microsegmentation so each service can only communicate with explicitly allowed peers.
4. Evaluate device trust including patch level, encryption status, and endpoint protection before granting access.
5. Apply time-limited access with just-in-time provisioning and automatic expiration of elevated privileges.
6. Log all access decisions with full context (who, what, when, where, why) for audit and anomaly detection.
7. Encrypt all traffic including east-west traffic between internal services.
8. Use a centralized policy engine to evaluate access decisions consistently across all services.
9. Implement step-up authentication that requires stronger verification for sensitive operations.
10. Continuously monitor and adapt policies based on threat intelligence and behavioral analytics.