Zero Trust Architecture

Traditional security model: "Trust but Verify"
  Firewall = castle wall
  Inside = trusted (employees, servers)
  Outside = untrusted (internet, attackers)
  Once inside: move freely

Why this fails in 2024:
1. Remote work: employees on untrusted home/cafe networks
2. Cloud: data NOT inside the castle anymore (S3, SaaS)
3. BYOD: personal devices inside the "trusted" network
4. Lateral movement: attacker breaches ONE internal host → reaches everything
5. Insider threats: malicious employee already "trusted"

Zero Trust: "Never Trust, Always Verify"
  No implicit trust based on network location
  Every request verified: who, what device, what context
  Minimal access: only what's needed for THIS task
  Assume breach: segment to limit blast radius

NIST Zero Trust Tenets:

1. ALL DATA AND SERVICES ARE RESOURCES
   Network location doesn't make something trusted
   Home WiFi = coffee shop = corporate LAN

2. ALL COMMUNICATION IS SECURED
   Never send sensitive data unencrypted, even internally
   Mutual TLS (mTLS) between microservices
   Encrypted internal traffic as if internet-facing

3. ACCESS GRANTED PER-SESSION
   No persistent network access ("once in, stay in")
   Access granted for specific request, reauthenticated continuously
   VPN-model replaced by session-based proxy access

4. ACCESS DETERMINED BY DYNAMIC POLICY
   Consider: user identity, device health, location, time, requested resource
   Risk engine: high-risk request → MFA challenge, block, or limited access

5. MONITOR AND MEASURE ALL RESOURCES
   All assets: monitored for health, anomalies
   Logs collected from everything: endpoint, network, app

6. AUTHENTICATION/AUTHORIZATION ENFORCED DYNAMICALLY
   Before EVERY request, not just at login
   Token-based: short-lived tokens reauthenticated frequently

7. COLLECT INFORMATION TO IMPROVE POSTURE
   Telemetry from all components improves the risk engine

Google's BeyondCorp (2014): employees work from anywhere
No VPN needed — every access goes through an access proxy

Components:
1. Identity Provider: who is the user? (SSO, Google Workspace)
2. Device Inventory: is this device known and healthy?
3. Access Proxy: single entry point for all internal apps
4. Access Policy Engine: should THIS user on THIS device access THIS app?
5. Trust Tiers: devices assigned trust level based on management

Access flow:
User → Access Proxy → Policy Engine → (if allowed) → Internal App
Policy checks: user identity, device certificate, time, location, MFA

Device health requirements:
- Corporate managed (MDM enrollment)
- Full disk encryption (FileVault, BitLocker)
- OS patched (last 30 days)
- AV/EDR installed and reporting
- Screen lock enabled

Result:
- Contractor on personal laptop from coffee shop: low trust, limited access
- Employee on managed laptop from office: high trust, full access
- Same employee from home on unmanaged device: medium trust, MFA required

Traditional: flat internal network (once inside, reach everything)
Microsegmentation: isolate workloads — breach of one doesn't spread

Implementation:
Host-based: firewall rules on each server (Windows Firewall, iptables)
Network-based: VLAN, SDN (software-defined networking)
Cloud-based: AWS Security Groups, Azure NSGs
Service mesh: mTLS between microservices (Istio, Linkerd)

Segmentation strategy:
Application tiers:
  Web tier ↔ App tier ↔ DB tier
  Web servers: can only reach app servers on port 8080
  App servers: can only reach DB on port 5432
  DB: no outbound allowed (can't exfiltrate data)

Zero Trust Segmentation:
  Even lateral movement within "same" zone is blocked
  Each microservice proves its identity with certificate (mTLS)
  Traffic denied by default, explicitly allowed per service pair

Attack impact:
Traditional: compromise web server → reach DB directly
Segmented: compromise web server → can't reach DB → lateral movement blocked

Identity = the new perimeter in Zero Trust

Principles:
1. Single strong identity: SSO (Single Sign-On) via SAML, OIDC
   Employee has ONE identity: Google Workspace, Azure AD, Okta
   All apps use this identity (federated)
   One place to provision and deprovision

2. MFA everywhere:
   Password alone is insufficient (phished too easily)
   TOTP (Google Authenticator) + password
   Better: FIDO2/WebAuthn (hardware key, passkey)
   Best: phishing-resistant MFA (YubiKey, Windows Hello)

3. Privileged Access Management (PAM):
   Admin accounts: separate from daily-use accounts
   Just-in-time (JIT) access: admin rights for specific ticket/time window
   Session recording: all admin sessions recorded
   Tools: CyberArk, BeyondTrust, Azure PIM

4. Conditional Access:
   Access policy evaluates context at each request
   High-risk = require step-up auth (MFA challenge)
   Impossible travel (NY to Tokyo in 2h): block, alert
   Unmanaged device: allow read-only, deny download

5. Service-to-service auth:
   mTLS: each service has X.509 certificate, mutual auth
   Service mesh: Istio handles cert rotation automatically
   SPIFFE/SPIRE: universal identity for workloads

ZTNA: replaces VPN
VPN: full network access to corporate network (too much!)
ZTNA: application-level access, just to what's needed

How ZTNA works:
1. User authenticates to ZTNA service (Cloudflare Access, Zscaler)
2. Device posture check: managed? patched? AV running?
3. Policy engine: user role + device + app + time = access decision
4. If allowed: encrypted tunnel just to that specific application
5. No general network access — can't scan internal network

SASE (Secure Access Service Edge):
Combines: ZTNA + CASB + FWaaS + SD-WAN
All security in the cloud, user traffic routed through security stack
Vendor: Cloudflare, Zscaler, Netskope, Palo Alto Prisma

Phased Zero Trust adoption:

Phase 1: Identity & MFA (quick wins)
- Deploy SSO for all applications
- Enable MFA for all users (TOTP minimum, FIDO2 preferred)
- Remove shared accounts
- Implement PAM for privileged access

Phase 2: Device Health
- MDM enrollment for all devices
- Certificate-based device authentication
- Device compliance policies (patch, AV, encryption)
- Block non-compliant devices

Phase 3: Application Access
- Deploy access proxy (Cloudflare Access, Azure App Proxy)
- Move internal apps behind access proxy
- Remove VPN-based network access
- Application-level segmentation

Phase 4: Data
- Data classification: public, internal, confidential, restricted
- DLP (Data Loss Prevention) policies
- Encrypt sensitive data at rest and in transit
- Monitor data access and exfiltration

Phase 5: Automation
- Continuous risk scoring per session
- Automated response: step-up MFA, session termination
- Behavioral analytics: detect anomalies