Zero Trust Architecture

What is Zero Trust Architecture and how do you implement it in a modern infrastructure?

Securityadvanced

// interview question

What is Zero Trust Architecture and how do you implement it in a modern infrastructure?

Sample answer

Zero Trust is a security model that assumes no implicit trust - every request must be verified. Core principles: 1) Never trust, always verify - authenticate and authorize every access attempt. 2) Least privilege - grant minimum necessary permissions. 3) Assume breach - design as if attackers are already inside. Implementation: identity-based access (not network-based), micro-segmentation, continuous verification with MFA, device health checks, encrypted communications everywhere, comprehensive logging. Technologies: identity providers (Okta, Azure AD), service mesh (mutual TLS), BeyondCorp-style access proxies.

Why this matters

Traditional perimeter security (castle and moat) fails in cloud-native environments with remote workers, SaaS applications, and microservices. Zero Trust shifts security to identity and per-request verification. Google's BeyondCorp pioneered this approach. Implementation is a journey - start with identity management and gradually add micro-segmentation. The goal is that compromising one system doesn't give access to everything.

Code examples

Istio mutual TLS policy

yaml

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT  # Require mTLS for all traffic
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payment-access
  namespace: production
spec:
  selector:
    matchLabels:
      app: payment-service
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/order-service"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/api/charge"]

AWS VPC micro-segmentation

hcl

# Security group per service tier
resource "aws_security_group" "api" {
  name        = "api-tier"
  description = "API service tier - minimal ingress"
  vpc_id      = aws_vpc.main.id

  # Only allow from load balancer
  ingress {
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }

  # Explicit egress rules (not allow all)
  egress {
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    security_groups = [aws_security_group.database.id]
  }
}

Common mistakes to avoid

Implementing Zero Trust as a product purchase instead of architectural change
Forgetting about east-west traffic (service to service) and only securing north-south
Not having comprehensive logging to detect anomalies

Likely follow-ups

How do you handle service-to-service authentication in a Zero Trust model?
What is the role of a service mesh in Zero Trust architecture?
How do you balance Zero Trust security with developer productivity?

Answer out loud first, then check yourself against the model answer.

Practice all Senior questions More Security questions

#security#zero-trust#architecture#identity#networking

Also worth your time on this topic

Interview

Security Architecture and DevSecOps

How do you integrate security into the DevOps pipeline? Describe the key components of a secure architecture.

senior

Article

Moving Authorization Out of Your App Code: If-Statements vs Cerbos vs SpiceDB, Measured

We built one permission model as if-statements, as Cerbos policies and as a SpiceDB relationship graph, grew it through roles, teams, sharing and a late contractor rule, and checked 84 hand-written decisions at every step. Here is what each design cost in latency, in list queries and in lines of code.

Exercise

AWS VPC with Terraform

Build a complete AWS VPC infrastructure using Terraform with public/private subnets, NAT gateway, and security groups.

120 minutes

Zero Trust Architecture

More Security interview questions

Also worth your time on this topic

Security Architecture and DevSecOps

Moving Authorization Out of Your App Code: If-Statements vs Cerbos vs SpiceDB, Measured

AWS VPC with Terraform