Designing a Zero-Trust Security Architecture

Zero-trust rejects the idea of a trusted internal network. Every request must be verified regardless of where it originates.

Core Principles

1. Never trust, always verify
2. Assume breach
3. Verify explicitly (identity, device, context)
4. Least privilege access
5. Microsegmentation

Traditional Perimeter vs Zero-Trust

Traditional:
  Outside → Firewall → [Trusted Internal Network]
  Once inside: Everything trusted
  Problem: Lateral movement after breach

Zero-Trust:
  Outside → Verify identity → Access specific resource
  Inside  → Verify identity → Access specific resource
  No implicit trust anywhere

Identity Verification

Every request must prove:
  WHO: Valid identity (human/service)
  WHAT: Valid device (managed, not compromised)
  HOW: Appropriate context (location, time, behavior)
  WHY: Authorized for this specific resource

mTLS (Mutual TLS)

Standard TLS: Server proves identity to client

mTLS: BOTH sides prove identity

Flow:
  Service A → TLS Handshake → Service B
  Service A presents cert (identity: order-service)
  Service B presents cert (identity: payment-service)
  Both verified against CA
  Connection established

Service Mesh (Istio)

Sidecar proxy injected into each pod:
  → Handles mTLS automatically
  → Enforces authorization policies
  → Provides observability (metrics, traces)

Policy:
  order-service → payment-service: ALLOW
  web-frontend  → payment-service: DENY
  Unknown source → any service:    DENY

Microsegmentation

Network Policy (Kubernetes):

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
spec:
  podSelector: { matchLabels: { app: payment } }
  ingress:
    - from:
      - podSelector: { matchLabels: { app: order } }
      ports:
      - port: 8080
  # All other ingress: DENIED

Privileged Access Management

Just-in-Time Access:
  Engineer requests prod DB access
  → Approval required
  → Access granted for 1 hour only
  → All queries logged
  → Auto-revoked after 1 hour

Conclusion

Zero-trust eliminates the dangerous assumption of network trust. mTLS + service mesh + microsegmentation + least-privilege access enforces security at every layer.