Zero Trust Architecture, Identity-Aware Proxies, and Micro-Segmentation

Traditional perimeter security ("castle-and-moat") assumes that anything inside the corporate network is trustworthy. Zero Trust Architecture (ZTA) eliminates implicit trust by enforcing the principle: "Never trust, always verify" for every user, device, and service call.

⚡ Quick Dive

Castle-and-Moat vs. Zero Trust Model

Dimension Perimeter Security (Castle-and-Moat) Zero Trust Architecture (ZTA)
Trust Assumption Inside network = Trusted; Outside = Untrusted Zero implicit trust anywhere (Internal or External)
Authentication VPN login at perimeter edge Continuous authentication per request with mTLS/OIDC
Blast Radius High (Compromised VPN user has full lateral access) Minimal (Strict micro-segmentation per service)
Identity Entity IP addresses & subnets Cryptographic workload identities (SPIFFE/SPIRE)
Access Decision Static firewall rules Dynamic contextual policy engine (Device health + User)

📖 Extended Guide

1. The 3 Core Pillars of NIST Zero Trust (SP 800-207)

[ Client Device / User ] ──► [ Policy Enforcement Point (PEP) ] ──► [ Protected Resource / API ]
                                            ▲
                                            │ (Evaluates Context)
                             [ Policy Decision Point (PDP) ]
                             (Device Health + MFA + Identity + Risk)
  1. Verify Explicitly: Authenticate and authorize based on all available data points (identity, location, device health, service classification).
  2. Use Least Privilege Access: Limit user and workload access with Just-In-Time (JIT) and Just-Enough-Access (JEA).
  3. Assume Breach: Minimize blast radius by segmenting networks, encrypting all end-to-end traffic with mTLS, and monitoring telemetry continuously.
⌂ All Guides