zero-trust

What this skill does

# Zero Trust Architecture

## Overview

Zero Trust is a security model that assumes no implicit trust based on network location. Every access request is fully authenticated, authorized, and encrypted regardless of origin.

**Keywords:** zero trust, ZTNA, micro-segmentation, identity-first, continuous verification, BeyondCorp, never trust always verify, least privilege, mTLS, service mesh, identity proxy

## When to Use This Skill

- Designing network security architecture
- Implementing identity-based access control
- Setting up micro-segmentation
- Configuring service-to-service authentication
- Building BeyondCorp-style access
- Implementing continuous verification
- Designing cloud-native security

## Zero Trust Principles

| Principle | Description | Implementation |
| --- | --- | --- |
| **Never Trust, Always Verify** | No implicit trust based on network | Authenticate every request |
| **Least Privilege** | Minimum necessary access | Role-based, time-limited access |
| **Assume Breach** | Design for compromise | Micro-segmentation, blast radius reduction |
| **Verify Explicitly** | All signals for authorization | Identity, device, location, behavior |
| **Continuous Verification** | Don't trust past authentication | Session validation, risk-based re-auth |

## Zero Trust Architecture Components

```text
┌─────────────────────────────────────────────────────────────────┐
│                    ZERO TRUST ARCHITECTURE                       │
├─────────────────────────────────────────────────────────────────┤
│                                                                  │
│  ┌────────────┐    ┌─────────────┐    ┌──────────────────────┐  │
│  │   USER     │───▶│  IDENTITY   │───▶│  POLICY ENGINE       │  │
│  │  + Device  │    │   PROXY     │    │  (Context Analysis)  │  │
│  └────────────┘    └─────────────┘    └──────────┬───────────┘  │
│                                                   │              │
│                           ┌───────────────────────┘              │
│                           ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │                   TRUST SIGNALS                           │   │
│  ├──────────────────────────────────────────────────────────┤   │
│  │ • Identity (MFA, SSO)    • Device Posture (MDM, health)  │   │
│  │ • Location (geo, IP)     • Behavior (anomaly detection)  │   │
│  │ • Time (business hours)  • Risk Score (continuous)       │   │
│  └──────────────────────────────────────────────────────────┘   │
│                           │                                      │
│                           ▼                                      │
│  ┌──────────────────────────────────────────────────────────┐   │
│  │               MICRO-SEGMENTED RESOURCES                   │   │
│  ├──────────────────────────────────────────────────────────┤   │
│  │  ┌─────────┐  ┌─────────┐  ┌─────────┐  ┌─────────┐     │   │
│  │  │ App A   │  │ App B   │  │ Data    │  │ Service │     │   │
│  │  │ (mTLS)  │  │ (mTLS)  │  │ (Encr.) │  │ (mTLS)  │     │   │
│  │  └─────────┘  └─────────┘  └─────────┘  └─────────┘     │   │
│  └──────────────────────────────────────────────────────────┘   │
│                                                                  │
└─────────────────────────────────────────────────────────────────┘
```

## Identity-First Security

### Identity Proxy Pattern

```csharp
// Identity-aware proxy for zero trust access
// All requests go through identity verification
using System.IdentityModel.Tokens.Jwt;
using System.Net;
using Microsoft.AspNetCore.Http;
using Microsoft.IdentityModel.Tokens;

public enum AccessDecision { Allow, Deny, Challenge }

/// <summary>
/// Context for access decision.
/// </summary>
public sealed record AccessContext(
    string UserId,
    string? DeviceId,
    DevicePosture DevicePosture,
    LocationInfo Location,
    double RiskScore,
    string RequestedResource,
    string RequestedAction);

/// <summary>
/// Zero trust policy decision engine.
/// </summary>
public sealed class PolicyEngine(IEnumerable<IAccessPolicy> policies)
{
    private static readonly HashSet<string> HighRiskCountries = ["XX", "YY", "ZZ"];
    private static readonly string[] OfficeIpRanges = ["10.0.0.0/8", "192.168.1.0/24"];

    public AccessDecision Evaluate(AccessContext context)
    {
        // Check device posture
        if (!CheckDevicePosture(context))
            return AccessDecision.Deny;

        // Check location policy
        if (!CheckLocation(context))
            return AccessDecision.Challenge;

        // Check risk score
        if (context.RiskScore > 0.8)
            return AccessDecision.Deny;
        if (context.RiskScore > 0.5)
            return AccessDecision.Challenge;

        // Check resource-specific policies
        foreach (var policy in policies)
        {
            if (policy.Matches(context))
                return policy.Evaluate(context);
        }

        // Default deny
        return AccessDecision.Deny;
    }

    private static bool CheckDevicePosture(AccessContext context)
    {
        var posture = context.DevicePosture;

        if (!posture.IsManaged) return false;
        if (!posture.DiskEncrypted) return false;
        if (!posture.FirewallEnabled) return false;
        if (string.Compare(posture.OsVersion, "min_required_version", StringComparison.Ordinal) < 0)
            return false;

        return true;
    }

    private static bool CheckLocation(AccessContext context)
    {
        if (HighRiskCountries.Contains(context.Location.Country))
            return false;

        if (!IsOfficeIp(context.Location.IpAddress, OfficeIpRanges))
        {
            if (!context.DevicePosture.VpnConnected)
                return false;
        }

        return true;
    }

    private static bool IsOfficeIp(string? ip, string[] ranges) =>
        ip is not null && ranges.Any(r => IpInRange(ip, r));

    private static bool IpInRange(string ip, string cidr) => true; // Simplified - implement CIDR matching
}

/// <summary>
/// Zero trust middleware - verify every request.
/// </summary>
public sealed class ZeroTrustMiddleware(
    RequestDelegate next,
    PolicyEngine policyEngine,
    IDevicePostureService deviceService,
    ILocationService locationService,
    IRiskScoreService riskService,
    TokenValidationParameters tokenParams)
{
    public async Task InvokeAsync(HttpContext context)
    {
        var authHeader = context.Request.Headers.Authorization.FirstOrDefault();
        if (string.IsNullOrEmpty(authHeader) || !authHeader.StartsWith("Bearer "))
        {
            context.Response.StatusCode = 401;
            await context.Response.WriteAsJsonAsync(new { error = "Authentication required" });
            return;
        }

        var token = authHeader["Bearer ".Length..];

        try
        {
            var handler = new JwtSecurityTokenHandler();
            var principal = handler.ValidateToken(token, tokenParams, out _);
            var userId = principal.FindFirst("sub")?.Value ?? throw new SecurityTokenException("Missing sub claim");

            var accessContext = new AccessContext(
                UserId: userId,
                DeviceId: context.Request.Headers["X-Device-ID"].FirstOrDefault(),
                DevicePosture: await deviceService.GetPostureAsync(context.Request),
                Location: await locationService.GetLocationAsync(context.Request),
                RiskScore: await riskService.CalculateAsync(context.Request, principal),
                RequestedResource: context.Request.Path,
                RequestedAction: context.Request.Method);

            var decision = policyEngine.Evaluate(accessContext);

            switch (decision)
            {
                case AccessDecision.Deny:
                    context.Response.StatusCode = 403;
                    await context.Response.WriteAsJsonAsync(new { error = "Access denied by