Zero Trust Implementation

Zero Trust Principles

Zero Trust replaces the castle-and-moat model with "never trust, always verify." Every request is authenticated, authorized, and inspected regardless of origin.

Micro-Segmentation

Divide your network into small, isolated zones. Each zone requires separate authentication.

Terraform: AWS security group micro-segmentation

resource "aws_security_group" "app_to_db" {

name = "app-db-ingress"

description = "Allow app tier to database"

vpc_id = var.vpc_id

ingress {

from_port = 5432

to_port = 5432

protocol = "tcp"

security_groups = [aws_security_group.app_tier.id]

}

egress {

from_port = 0

to_port = 0

protocol = "-1"

cidr_blocks = ["0.0.0.0/0"]

}

}

Least Privilege Access

Implement just-in-time (JIT) access with ephemeral credentials.

JIT access broker

from datetime import datetime, timedelta

import boto3

def grant_just_in_time_access(user, resource, duration_minutes=60):

iam = boto3.client("iam")

policy = {

"Version": "2012-10-17",

"Statement": [{

"Effect": "Allow",

"Action": resource["actions"],

"Resource": resource["arn"],

"Condition": {

"DateLessThan": {

"aws:CurrentTime": (datetime.utcnow() +

timedelta(minutes=duration_minutes)).isoformat()

}

}

}]

}

return iam.create_policy(PolicyName=f"jit-{user}-{int(datetime.utcnow().timestamp())}",

PolicyDocument=json.dumps(policy))

Verify Every Request

Every API call must be verified at the application layer.

// Zero Trust API gateway middleware

function zeroTrustMiddleware(req, res, next) {

const context = {

userId: req.headers["x-user-id"],

deviceId: req.headers["x-device-id"],

geo: req.headers["x-geo-location"],

time: Date.now(),

path: req.path

};

Promise.all([

verifyIdentity(context.userId),

verifyDevice(context.deviceId),

checkGeoPolicy(context.geo, context.path),

checkTimePolicy(context.time)

]).then(([identity, device, geo, time]) => {

if (identity && device && geo.allowed && time.allowed) {

next();

} else {

res.status(401).json({ error: "Access denied" });

}

});

}

Continuous Monitoring

Log and analyze all access attempts in real time.

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\-- Anomaly detection query

SELECT user_id, COUNT(*) as attempts,

COUNT(DISTINCT ip_address) as ips,

COUNT(DISTINCT geo_location) as regions

FROM access_logs

WHERE timestamp > NOW() - INTERVAL '1 hour'

AND denied = true

GROUP BY user_id

HAVING COUNT(*) > 10;

Conclusion

Zero Trust is an architectural shift, not a product. Start with a single application, implement micro-segmentation, enforce least privilege, and expand gradually. Measure progress by reduction in lateral movement capability and mean time to detect anomalies.