zero-trust-security

Zero-Trust Security

Level 1: Quick Reference

Core Principles

Zero-trust architecture operates on the principle: "Never trust, always verify." Unlike traditional perimeter-based security, zero-trust assumes breach and verifies every request regardless of origin.

Fundamental Tenets:

• No implicit trust based on network location
• Verify explicitly (authentication + authorization)
• Least privilege access (just-in-time, just-enough)
• Assume breach (limit blast radius, segment access)
• Inspect and log all traffic

Common Zero-Trust Patterns

1. Mutual TLS (mTLS)

# Istio PeerAuthentication for strict mTLS
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

When to use: Service-to-service authentication, encrypted communication between microservices.

2. Service Mesh

• Istio/Linkerd: Transparent mTLS, traffic encryption, identity management
• Consul Connect: Service identity and authorization
• AWS App Mesh: Cloud-native service mesh

Key benefits: Automatic encryption, fine-grained policies, observability.

3. BeyondCorp Model

# Identity-aware proxy configuration
apiVersion: v1
kind: Service
metadata:
  name: webapp
  annotations:
    cloud.google.com/neg: '{"ingress": true}'
    cloud.google.com/backend-config: '{"default": "beyondcorp-config"}'
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: 8080

Use case: Remote access without VPN, identity-based access to applications.

Essential Checklist

Identity & Authentication:

• Workload identities for all services (SPIFFE/SPIRE)
• mTLS enabled for service-to-service communication
• Strong authentication (MFA, certificates, tokens)
• Identity lifecycle management (rotation, revocation)

Authorization:

• Fine-grained access policies (attribute-based)
• Least privilege by default
• Just-in-time access provisioning
• Policy enforcement at every access point