Dev Note

Zero-Trust Security Architecture: Implementing Never Trust, Always Verify
The perimeter is dead. In a world where employees work from anywhere, apps live in multiple clouds, and attackers operate inside corporate networks, the old “castle-and-moat” model is not just outdated — it’s dangerous.
Zero-trust isn’t a product you buy. It’s an architectural philosophy backed by concrete technical controls. This guide shows you how to actually implement it.
Photo by Ales Nesetril on Unsplash
The Core Principles
Zero-trust is built on three axioms:
Never trust, always verify — No user, device, or network location is trusted by default
Least privilege access — Grant the minimum access required, scoped to the task at hand
Assume breach — Design as if attackers are already inside. Limit blast radius.
These sound obvious. Implementing them is hard.
Identity: The New Perimeter
In zero-trust, identity is the control plane. Every access decision is based on verified identity — of users, devices, and services.
Workload Identity with SPIFFE/SPIRE
For service-to-service authentication, SPIFFE (Secure Production Identity Framework for Everyone) is the open standard:
# SPIRE Server configuration
server:
  bind_address: "0.0.0.0"
  bind_port: "8081"
  trust_domain: "company.com"
  
  ca_subject:
    country: ["US"]
    organization: ["Company Inc"]
  
  # SVIDs (SPIFFE Verifiable Identity Documents) expire after 1 hour
  # Short-lived certs eliminate the revocation problem
  default_svid_ttl: "1h"
  
plugins:
  DataStore:
    - sql:
        plugin_data:
          database_type: postgres
          connection_string: "postgresql://spire:pass@postgres/spire"
  
  NodeAttestor:
    - k8s_psat:          # Kubernetes projected service account tokens
        plugin_data:
          clusters:
            - name: "prod-cluster"
              service_account_allow_list: ["spire/spire-agent"]
// Service authenticates using its SPIFFE identity
package main
import (
    "context"
    "crypto/tls"
    "net/http"
    
    "github.com/spiffe/go-spiffe/v2/spiffeid"
    "github.com/spiffe/go-spiffe/v2/spiffetls"
    "github.com/spiffe/go-spiffe/v2/workloadapi"
)
func makeAuthenticatedRequest(ctx context.Context, url string) (*http.Response, error) {
    // Get TLS config with our SVID (automatically refreshed before expiry)
    tlsConfig, err := spiffetls.TLSClientConfig(
        ctx,
        spiffetls.AuthorizeID(spiffeid.RequireIDFromString(
            "spiffe://company.com/ns/payments/sa/payment-processor",
        )),
    )
    if err != nil {
        return nil, err
    }
    
    client := &http.Client{
        Transport: &http.Transport{
            TLSClientConfig: tlsConfig,
        },
    }
    
    // mTLS happens automatically — both sides verify each other's identity
    return client.Get(url)
}
Every service gets a cryptographic identity. There are no shared secrets, no API keys in environment variables, no rotation ceremonies — certs rotate automatically every hour.
User Identity with Continuous Authentication
# Middleware that validates identity on every request
import jwt
from functools import wraps
from dataclasses import dataclass
from datetime import datetime
@dataclass
class AuthContext:
    user_id: str
    email: str
    roles: list[str]
    device_id: str
    device_trust_level: str  # "managed", "unmanaged", "unknown"
    auth_time: datetime
    risk_score: float        # 0.0 - 1.0, computed continuously
def require_auth(min_trust_level: str = "medium", max_risk: float = 0.7):
    """Decorator that enforces zero-trust access policies."""
    def decorator(f):
        @wraps(f)
        async def wrapper(*args, **kwargs):
            token = extract_token(request)
            
            # Validate JWT signature and expiry
            claims = jwt.decode(
                token,
                options={"verify_exp": True},
                algorithms=["RS256"],
                audience="company-api"
            )
            
            auth_ctx = AuthContext(**claims)
            
            # Continuous risk assessment
            risk = await compute_risk_score(auth_ctx, request)
            auth_ctx.risk_score = risk
            
            # Step-up authentication for high-risk scenarios
            if risk > max_risk:
                raise StepUpRequired(
                    reason=f"Risk score {risk:.2f} exceeds threshold {max_risk}",
                    redirect_to=f"/auth/step-up?return={request.url}"
                )
            
            # Device trust check
            trust_levels = ["unknown", "unmanaged", "managed"]
            if trust_levels.index(auth_ctx.device_trust_level) < trust_levels.index(min_trust_level):
                raise InsufficientDeviceTrust(
                    required=min_trust_level,
                    actual=auth_ctx.device_trust_level
                )
            
            request.auth = auth_ctx
            return await f(*args, **kwargs)
        return wrapper
    return decorator
async def compute_risk_score(auth_ctx: AuthContext, request) -> float:
    signals = []
    
    # Anomalous location
    user_location = geoip.lookup(request.remote_addr)
    usual_locations = await get_user_locations(auth_ctx.user_id, days=30)
    if user_location not in usual_locations:
        signals.append(0.4)
    
    # Impossible travel
    last_login_location = await get_last_login(auth_ctx.user_id)
    if is_impossible_travel(last_login_location, user_location):
        signals.append(0.9)
    
    # Unusual time
    hour = datetime.now().hour
    usual_hours = await get_usual_active_hours(auth_ctx.user_id)
    if hour not in usual_hours:
        signals.append(0.2)
    
    # Velocity: too many requests
    rps = await get_request_rate(auth_ctx.user_id, window_seconds=60)
    if rps > 100:
        signals.append(0.5)
    
    return max(signals) if signals else 0.0
Network: Micro-Segmentation
Traditional firewall rules are coarse and static. Zero-trust requires fine-grained, dynamic network policies.
Kubernetes Network Policies
# Block all traffic by default
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}    # Selects all pods
  policyTypes:
  - Ingress
  - Egress
---
# Explicitly allow only what's needed
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: payments-service-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: payments-service
  
  policyTypes:
  - Ingress
  - Egress
  
  ingress:
  # Only accept traffic from the API gateway
  - from:
    - podSelector:
        matchLabels:
          app: api-gateway
    ports:
    - protocol: TCP
      port: 8080
  
  egress:
  # Allow calls to payments-db
  - to:
    - podSelector:
        matchLabels:
          app: payments-db
    ports:
    - protocol: TCP
      port: 5432
  
  # Allow calls to fraud-detection service
  - to:
    - podSelector:
        matchLabels:
          app: fraud-detection
    ports:
    - protocol: TCP
      port: 8081
  
  # Allow DNS resolution
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
    ports:
    - protocol: UDP
      port: 53
Service Mesh Authorization Policies
Using Istio for L7 authorization:
# AuthorizationPolicy: fine-grained request-level control
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payments-authz
  namespace: production
spec:
  selector:
    matchLabels:
      app: payments-service
  
  action: ALLOW
  
  rules:
  # API Gateway can only call specific endpoints
  - from:
    - source:
        principals:
        - "cluster.local/ns/production/sa/api-gateway"
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/v1/payments/*"]
  
  # Internal billing service can only call reconciliation
  - from:
    - source:
        principals:
        - "cluster.local/ns/production/sa/billing-service"
    to:
    - operation:
        methods: ["GET"]
        paths: ["/internal/reconcile"]
  
  # Monitoring can scrape metrics
  - from:
    - source:
        namespaces: ["monitoring"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/metrics", "/health"]
Secrets Management: No More .env Files
Vault Dynamic Secrets
HashiCorp Vault’s dynamic secrets are the gold standard. Instead of long-lived credentials, generate short-lived secrets on demand:
# Vault configuration for dynamic database credentials
resource "vault_database_secret_backend_role" "payments_service" {
  backend = vault_database_secrets_backend.postgres.path
  name    = "payments-service"
  
  db_name = vault_database_secrets_backend_connection.postgres.name
  
  # Generated creds expire in 1 hour
  default_ttl = "1h"
  max_ttl     = "24h"
  
  # Scoped to minimal required permissions
  creation_statements = [
    "CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'",
    "GRANT SELECT, INSERT, UPDATE ON payments TO \"{{name}}\"",
    "GRANT SELECT ON products TO \"{{name}}\"",
    # NOT GRANTED: DELETE, TRUNCATE, DROP, schema modifications
  ]
  
  revocation_statements = [
    "REVOKE ALL ON ALL TABLES IN SCHEMA public FROM \"{{name}}\"",
    "DROP ROLE IF EXISTS \"{{name}}\""
  ]
}
// Application fetches credentials at startup and refreshes before expiry
func getDatabaseCredentials(ctx context.Context, vaultClient *vault.Client) (*DBCreds, error) {
    secret, err := vaultClient.Logical().ReadWithContext(ctx,
        "database/creds/payments-service",
    )
    if err != nil {
        return nil, fmt.Errorf("vault credential fetch failed: %w", err)
    }
    
    return &DBCreds{
        Username:  secret.Data["username"].(string),
        Password:  secret.Data["password"].(string),
        ExpiresAt: time.Now().Add(time.Duration(secret.LeaseDuration) * time.Second),
        LeaseID:   secret.LeaseID,
    }, nil
}
No credential in a config file. No rotation ceremony. Compromise of a credential is automatically time-limited.
Observability: You Must See Everything
Zero-trust requires comprehensive observability — you can’t investigate what you can’t see.
# Structured security audit logging
import structlog
from opentelemetry import trace
tracer = trace.get_tracer(__name__)
log = structlog.get_logger()
class SecurityAuditMiddleware:
    async def __call__(self, request, call_next):
        with tracer.start_as_current_span("http.request") as span:
            auth_ctx = request.auth
            
            # Tag every trace with identity context
            span.set_attributes({
                "user.id": auth_ctx.user_id,
                "user.email": auth_ctx.email,
                "device.id": auth_ctx.device_id,
                "device.trust_level": auth_ctx.device_trust_level,
                "auth.risk_score": auth_ctx.risk_score,
                "http.method": request.method,
                "http.path": str(request.url.path),
                "http.client_ip": request.client.host,
            })
            
            response = await call_next(request)
            
            # Security audit log — every access decision recorded
            log.info(
                "access.decision",
                user_id=auth_ctx.user_id,
                resource=str(request.url.path),
                method=request.method,
                decision="allow",
                risk_score=auth_ctx.risk_score,
                status_code=response.status_code,
                trace_id=span.get_span_context().trace_id,
            )
            
            return response
Implementation Roadmap
Zero-trust is a journey, not a project. A realistic 12-month roadmap:
Months 1-3: Identity Foundation
Implement strong MFA everywhere
Deploy device management (MDM)
Centralize identity in an IdP (Okta, Azure AD, etc.)
Inventory all service accounts
Months 4-6: Network Micro-Segmentation
Deploy network policies (deny-all default)
Install service mesh for internal mTLS
Remove implicit network trust
Months 7-9: Secrets Modernization
Deploy Vault (or cloud equivalent)
Migrate to dynamic secrets
Eliminate long-lived credentials
Months 10-12: Continuous Monitoring
Comprehensive audit logging
Behavioral baselines
Automated anomaly detection
Key Takeaways
Zero-trust is an architecture, not a product — it requires multiple layers
Identity (user and workload) is the new perimeter
SPIFFE/SPIRE solves workload identity without manual cert management
Dynamic secrets (Vault) eliminate the long-lived credential problem
Micro-segmentation limits lateral movement when (not if) breach occurs
Comprehensive observability is not optional — you need to see everything
The hard part of zero-trust isn’t the technology. It’s the cultural shift from “trust the network” to “verify everything, always.” Start with identity, earn trust with results, and expand from there.
Photo by Franck on Unsplash

Zero-Trust Security Architecture: Implementing Never Trust, Always Verify

댓글