# Zero Trust

> Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.

- Skill: `majiayu000/zero-trust-2` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/zero-trust-2`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/zero-trust-2/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/zero-trust-2

---


# Zero Trust Architecture

Implement "never trust, always verify" security model.

## Core Principles

```yaml
zero_trust_principles:
  - Verify explicitly (authenticate all access)
  - Least privilege access
  - Assume breach (micro-segmentation)
  - Continuous validation
  - End-to-end encryption
```

## Identity-Based Access

```yaml
# Service mesh mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: frontend-to-backend
spec:
  selector:
    matchLabels:
      app: backend
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/frontend"]
```

## Network Segmentation

```yaml
# Kubernetes Network Policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
```

## Implementation Steps

1. Identify sensitive resources
2. Map access patterns
3. Implement strong authentication
4. Apply micro-segmentation
5. Enable logging and monitoring
6. Continuous verification

## Best Practices

- Identity-aware proxies
- Device trust verification
- Context-based access
- Encrypted communications
- Continuous monitoring

## Related Skills

- [service-mesh](../../../infrastructure/networking/service-mesh/) - mTLS implementation
- [kubernetes-hardening](../../hardening/kubernetes-hardening/) - K8s security