Security

Zero Trust Architecture Guide

Implement zero trust security architecture with identity verification, micro-segmentation, and continuous monitoring.

What you'll learn

Understand the Zero Trust principles (never trust, always verify)
Implement strong identity verification with MFA and device posture
Design micro-segmented network architecture
Enforce mutual TLS (mTLS) between services
Implement least-privilege access with just-in-time provisioning
Set up continuous monitoring and behavioural analytics

Zero Trust Principles

Zero Trust replaces the implicit trust of perimeter-based security with explicit, continuous verification of every request regardless of origin.

Never trust, always verify — authenticate and authorise every request, even from inside the network.
Least privilege access — grant only the minimum permissions required, for the minimum duration.
Assume breach — design as if an attacker is already inside; segment, monitor, and limit blast radius.
Verify explicitly — use all available signals: identity, device health, location, service.

Identity & Device Verification

JavaScript

1# Strong identity verification checklist:
2# ✓ MFA required for all users (TOTP, hardware key, or passkey)
3# ✓ Device health attestation (MDM enrollment, OS patch level)
4# ✓ Continuous session risk evaluation (anomalous location, behaviour)
5# ✓ Short-lived tokens (access tokens ≤ 15 min)
6# ✓ Refresh token rotation on every use
7
8# Example: enforce MFA in middleware
9async function requireMFA(req, res, next) {
10  const session = await getSession(req);
11  if (!session?.mfaVerifiedAt) {
12    return res.status(401).json({ error: 'MFA required' });
13  }
14  // MFA must have been verified in the last 8 hours
15  const eightHoursAgo = Date.now() - 8 * 60 * 60 * 1000;
16  if (session.mfaVerifiedAt < eightHoursAgo) {
17    return res.status(401).json({ error: 'MFA session expired' });
18  }
19  next();
20}

Network Micro-segmentation

YAML

1# Kubernetes NetworkPolicy — default deny, explicit allow
2apiVersion: networking.k8s.io/v1
3kind: NetworkPolicy
4metadata:
5  name: default-deny-all
6  namespace: production
7spec:
8  podSelector: {}       # applies to all pods
9  policyTypes: [Ingress, Egress]
10---
11# Allow only the API pod to reach the database pod
12apiVersion: networking.k8s.io/v1
13kind: NetworkPolicy
14metadata:
15  name: allow-api-to-db
16  namespace: production
17spec:
18  podSelector:
19    matchLabels: { app: postgres }
20  ingress:
21    - from:
22      - podSelector:
23          matchLabels: { app: api }
24      ports:
25        - protocol: TCP
26          port: 5432

Mutual TLS (mTLS)

YAML

1# Use a service mesh (Istio/Linkerd) for automatic mTLS
2# Istio — enable strict mTLS across the namespace
3apiVersion: security.istio.io/v1
4kind: PeerAuthentication
5metadata:
6  name: default
7  namespace: production
8spec:
9  mtls:
10    mode: STRICT
11
12# Without a service mesh — Node.js manual mTLS
13import tls from 'tls';
14const server = tls.createServer({
15  key:  fs.readFileSync('/certs/server-key.pem'),
16  cert: fs.readFileSync('/certs/server-cert.pem'),
17  ca:   fs.readFileSync('/certs/ca-cert.pem'),
18  requestCert: true,   // require client cert
19  rejectUnauthorized: true,
20}, (socket) => {
21  if (!socket.authorized) socket.destroy();
22});

Least Privilege Access

Use just-in-time (JIT) access provisioning — grant elevated permissions only when requested and for a fixed duration.
Implement attribute-based access control (ABAC) for fine-grained API authorisation.
Rotate service account credentials automatically (e.g. AWS IAM Roles Anywhere, Vault dynamic secrets).
Audit all privilege escalations — alert on any role grant outside normal business hours.

Continuous Monitoring

Bash

1# Signals to collect and correlate:
2# - Auth events: login, MFA, token refresh, logout
3# - Network flows: source/dest IP, port, bytes transferred
4# - Resource access: which APIs, which data, at what time
5# - Device posture: OS version, patch level, AV status
6# - Anomalies: impossible travel, off-hours access, mass downloads
7
8# Alert thresholds:
9# - >3 failed MFA attempts → lock account + alert
10# - Login from new country → require step-up auth
11# - Service calling another service it has never called → alert
12# - Data export > 10 MB by non-admin → alert