zero-trust-architecture

What this skill does

# Zero Trust Architecture

Comprehensive guide to zero trust security architecture - the "never trust, always verify" approach to modern security.

## When to Use This Skill

- Designing security architecture for new systems
- Migrating from perimeter-based security
- Implementing microsegmentation
- Evaluating identity-based access controls
- Understanding ZTNA (Zero Trust Network Access)
- Assessing security posture

## Core Principles

```text
Zero Trust Pillars:

1. Never Trust, Always Verify
   └── Every request is verified regardless of origin
   └── No implicit trust based on network location
   └── Continuous authentication and authorization

2. Least Privilege Access
   └── Minimum permissions required for the task
   └── Just-in-time access when possible
   └── Just-enough-access for the operation

3. Assume Breach
   └── Design as if attackers are already inside
   └── Minimize blast radius of any compromise
   └── Continuous monitoring and verification

4. Explicit Verification
   └── Verify user identity
   └── Verify device health
   └── Verify request context
   └── Make access decisions at each request
```

## Architecture Components

### Identity Layer

```text
Identity Provider (IdP):
├── Multi-factor authentication (MFA)
├── Single sign-on (SSO)
├── Federated identity
└── Privileged access management (PAM)

User Identity:
- Strong authentication required
- Continuous session validation
- Risk-based authentication
- Context-aware access decisions

Service Identity:
- Machine identity management
- Service accounts with rotation
- Certificate-based authentication
- Workload identity
```

### Device Layer

```text
Device Trust Assessment:
├── Device health attestation
├── Endpoint detection and response (EDR)
├── Mobile device management (MDM)
├── Certificate-based device identity
└── Posture assessment

Device Trust Signals:
- Is the device managed/enrolled?
- Is the OS up to date?
- Is security software running?
- Are there known vulnerabilities?
- Is there anomalous behavior?
```

### Network Layer

```text
Microsegmentation:
┌─────────────────────────────────────────┐
│              Traditional               │
│  ┌──────────────────────────────────┐  │
│  │     Flat Internal Network       │  │
│  │   Trust everything inside       │  │
│  └──────────────────────────────────┘  │
│                  ↓                      │
│          Zero Trust                    │
│  ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐     │
│  │ Seg │ │ Seg │ │ Seg │ │ Seg │     │
│  │  A  │ │  B  │ │  C  │ │  D  │     │
│  └──┬──┘ └──┬──┘ └──┬──┘ └──┬──┘     │
│     │       │       │       │         │
│  All traffic verified at each hop     │
└─────────────────────────────────────────┘

Network Controls:
- Software-defined perimeter (SDP)
- Network access control (NAC)
- DNS security
- Encrypted communications (mTLS)
```

### Application Layer

```text
Application Security:
├── API gateway with authentication
├── Service mesh for service-to-service
├── Web application firewall (WAF)
├── Runtime application self-protection (RASP)
└── Secure software supply chain

Access Control:
- Attribute-based access control (ABAC)
- Role-based access control (RBAC)
- Policy-based access control
- Just-in-time access provisioning
```

### Data Layer

```text
Data Protection:
├── Classification and labeling
├── Encryption at rest and in transit
├── Data loss prevention (DLP)
├── Rights management
└── Tokenization/masking

Data Access:
- Need-to-know basis
- Fine-grained access control
- Audit logging for all access
- Data residency compliance
```

## Implementation Patterns

### Pattern 1: Identity-Aware Proxy

```text
                    ┌───────────────────┐
                    │   Identity Proxy   │
                    │  (BeyondCorp-style)│
                    └─────────┬─────────┘
                              │
        ┌─────────────────────┼─────────────────────┐
        │                     │                     │
   ┌────▼────┐          ┌────▼────┐          ┌────▼────┐
   │  User   │          │  Device │          │ Context │
   │ Identity│          │  Trust  │          │  Eval   │
   └────┬────┘          └────┬────┘          └────┬────┘
        │                     │                     │
        └─────────────────────┼─────────────────────┘
                              │
                    ┌─────────▼─────────┐
                    │   Access Decision  │
                    └─────────┬─────────┘
                              │
                    ┌─────────▼─────────┐
                    │   Application      │
                    └───────────────────┘

How it works:
1. User requests access to application
2. Proxy checks user identity (authentication)
3. Proxy evaluates device trust score
4. Proxy considers context (location, time, behavior)
5. Policy engine makes access decision
6. If approved, proxy provides access
```

### Pattern 2: Service Mesh Zero Trust

```text
┌─────────────────────────────────────────────────┐
│                   Control Plane                  │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐     │
│  │  Policy  │  │   Cert   │  │  Config  │     │
│  │  Engine  │  │ Authority│  │  Store   │     │
│  └────┬─────┘  └────┬─────┘  └────┬─────┘     │
└───────┼─────────────┼─────────────┼────────────┘
        │             │             │
┌───────▼─────────────▼─────────────▼────────────┐
│                   Data Plane                    │
│  ┌─────────────┐        ┌─────────────┐        │
│  │  Service A  │◄──mTLS──►│  Service B  │        │
│  │  ┌───────┐  │        │  ┌───────┐  │        │
│  │  │ Proxy │  │        │  │ Proxy │  │        │
│  │  └───────┘  │        │  └───────┘  │        │
│  └─────────────┘        └─────────────┘        │
└─────────────────────────────────────────────────┘

Service mesh provides:
- mTLS between all services
- Fine-grained authorization policies
- Service-to-service identity
- Traffic encryption everywhere
- Policy enforcement at the proxy
```

### Pattern 3: ZTNA (Zero Trust Network Access)

```text
Traditional VPN:
User ──► VPN ──► Full Network Access

ZTNA (Zero Trust Network Access):
User ──► ZTNA Broker ──► Specific App Only
              │
        ┌─────▼─────┐
        │ Evaluate: │
        │ - Identity│
        │ - Device  │
        │ - Context │
        │ - Policy  │
        └─────┬─────┘
              │
        Access to ONE application
        (not entire network)

ZTNA Benefits:
- Application-level access, not network-level
- Invisible infrastructure (no exposed IPs)
- Consistent policy regardless of location
- Reduced attack surface
```

## Trust Evaluation

### Continuous Trust Scoring

```text
Trust Score Components:

User Trust:
├── Authentication strength    [0-25 points]
├── Session age/freshness     [0-15 points]
├── Behavioral anomalies      [0-20 points]
└── Historical patterns       [0-10 points]

Device Trust:
├── Device management status   [0-20 points]
├── Security posture          [0-20 points]
├── Patch level               [0-15 points]
└── Certificate validity      [0-10 points]

Context Trust:
├── Network location          [0-15 points]
├── Geolocation               [0-10 points]
├── Time of access            [0-10 points]
└── Request patterns          [0-15 points]

Total Score: 0-185 points

Policy Example:
- Score > 150: Full access
- Score 100-150: Limited access + step-up auth
- Score 50-100: Read-only access
- Score < 50: Block access
```

### Risk-Based Access Decisions

```text
Access Decision Matrix:

                    │ Low-Risk Resource │ High-Risk Resource
────────────────────┼───────────────────┼────────────────────
High Trust Score    │ Allow             │ Allow
Medium Trust Score  │ Allow             │ MFA Challenge
Low Trust Score     │ MFA Challenge     │ Block + Alert

Dynamic Factors:
- Time-based: Unusual access hours?
- Location-based: Unusual geography?
- Behavior-based: Unusual patterns?
- Resource-based: Sensitive data access?
```

## Implementation Roadmap

### Ph