<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: designing-zero-trust-architecture
description: >-
  Design and implement zero trust architecture following NIST SP 800-207 principles
  with identity-verified access, microsegmentation, continuous validation, and
  least-privilege enforcement across network, application, and data layers.
domain: cybersecurity
subdomain: security-architecture
tags:
  - zero-trust
  - nist-800-207
  - identity-verification
  - microsegmentation
  - continuous-validation
  - least-privilege
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1021"]
---

# Designing Zero Trust Architecture

## Overview

Zero Trust Architecture (ZTA) eliminates implicit trust by requiring continuous
verification of every access request regardless of network location. This skill
covers designing ZTA aligned with NIST SP 800-207, implementing policy decision
and enforcement points, and deploying identity-centric access controls.

Mode: `[MODE: ARCHITECT]` — Security architecture design.

## Prerequisites

| Requirement | Details |
|---|---|
| NIST SP 800-207 Zero Trust Architecture reference | Required |
| Identity provider (Entra ID, Okta, or equivalent) | Required |
| Network infrastructure supporting microsegmentation | Required |
| Python 3.10+ | Required |

## Key Concepts

### Zero Trust Pillars

```
┌─────────────────────────────────────────────────────┐
│                   ZERO TRUST PILLARS                │
├──────────┬──────────┬──────────┬──────────┬─────────┤
│ Identity │ Devices  │ Networks │ Apps &   │ Data    │
│          │          │          │ Workloads│         │
├──────────┴──────────┴──────────┴──────────┴─────────┤
│              Visibility & Analytics                  │
├─────────────────────────────────────────────────────┤
│           Automation & Orchestration                 │
└─────────────────────────────────────────────────────┘
```

### NIST SP 800-207 Reference Architecture

```
                    ┌──────────────────┐
                    │  Policy Engine   │ ← Context: identity, device,
                    │  (PDP)           │   location, behavior, risk
                    └────────┬─────────┘
                             │ Policy Decision
                    ┌────────▼─────────┐
    Subject ───────►│ Policy Enforce-  │──────► Resource
    (User/Device)   │ ment Point (PEP) │       (App/Data)
                    └──────────────────┘
```

### Policy Decision Framework

```yaml
# Zero Trust Policy Decision Matrix
policy_inputs:
  identity:
    - user_identity: "Authenticated via MFA"
    - service_account: "Certificate-based mutual TLS"
    - role_membership: "RBAC/ABAC evaluated"
  device:
    - compliance: "MDM enrolled, patched, encrypted"
    - posture: "EDR running, no active threats"
    - certificate: "Device certificate valid"
  context:
    - location: "Expected geography"
    - time: "Within business hours"
    - behavior: "No anomalous patterns"
    - risk_score: "Below threshold"

access_decision:
  allow: "All signals pass threshold"
  deny: "Any critical signal fails"
  step_up: "Marginal signals require additional verification"
  monitor: "Allow with enhanced logging"
```

### Implementation Layers

```bash
# Layer 1: Identity — Enforce MFA everywhere
# Entra ID Conditional Access Policy (Azure CLI)
az ad conditionalaccesspolicy create --display-name "Require MFA All Users" \
  --state enabled \
  --conditions '{"users":{"includeUsers":["All"]},"applications":{"includeApplications":["All"]}}' \
  --grant-controls '{"operator":"OR","builtInControls":["mfa"]}'

# Layer 2: Device — Require compliant devices
az ad conditionalaccesspolicy create --display-name "Require Compliant Device" \
  --state enabled \
  --conditions '{"users":{"includeUsers":["All"]},"platforms":{"includePlatforms":["all"]}}' \
  --grant-controls '{"operator":"AND","builtInControls":["compliantDevice"]}'

# Layer 3: Network — Deploy identity-aware proxy
# Google BeyondCorp / Cloudflare Access / Zscaler ZPA
# Example: Cloudflare Access policy
curl -X POST "https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps" \
  -H "Authorization: Bearer $CF_TOKEN" \
  -d '{
    "name": "Internal App",
    "domain": "app.company.com",
    "type": "self_hosted",
    "session_duration": "4h",
    "policies": [{
      "decision": "allow",
      "include": [{"group": {"id": "engineering-group-id"}}],
      "require": [{"auth_method": {"auth_method": "mfa"}}]
    }]
  }'
```

### Continuous Validation Architecture

```python
def evaluate_access(request: dict) -> dict:
    """Zero trust continuous access evaluation."""
    signals = {
        "identity_verified": check_identity(request["token"]),
        "mfa_completed": check_mfa_status(request["session"]),
        "device_compliant": check_device_posture(request["device_id"]),
        "location_expected": check_geolocation(request["source_ip"]),
        "behavior_normal": check_ueba_score(request["user_id"]),
        "risk_acceptable": check_risk_score(request["context"]),
    }

    failed = [k for k, v in signals.items() if not v]

    if not failed:
        return {"decision": "allow", "confidence": "high"}
    elif any(f in failed for f in ["identity_verified", "mfa_completed"]):
        return {"decision": "deny", "reason": failed}
    else:
        return {"decision": "step_up", "additional_verification": failed}
```

## Workflow

### Step 1: Assess Current State

```bash
node scripts/agent.js --action assess --scope network,identity,devices
```

### Step 2: Design Zero Trust Zones

```bash
node scripts/agent.js --action design --pillars identity,devices,network,apps,data
```

### Step 3: Define Policies

```bash
node scripts/agent.js --action policies --output zt-policies.json
```

### Step 4: Validate Architecture

```bash
node scripts/agent.js --action validate --config zt-policies.json
```

## Detection

```yaml
title: Designing Zero Trust Architecture Detection
id: 55f1edd0-9982-47d2-be14-127a1c010b7c
status: experimental
description: Detects suspicious activity related to designing zero trust architecture techniques in security architecture context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1021
  - attack.lateral_movement
falsepositives:
  - Network segmentation testing by authorized infrastructure teams
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Designing Zero Trust Architecture Detection | firewall/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1021 |

## Verification

- [ ] Every access request requires identity verification regardless of network location
- [ ] MFA enforced for all users and privileged service accounts
- [ ] Device compliance checked before granting access
- [ ] Microsegmentation prevents lateral movement
- [ ] Continuous session validation with risk-based step-up
- [ ] All access decisions logged and forwarded to SIEM
- [ ] Least privilege enforced — no standing admin access
- [ ] Emergency break-glass procedures documented and tested

## References

- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CISA Zero Trust Maturity Model](https://www.cisa.gov/zero-trust-maturity-model)
- [Google BeyondCorp](https://cloud.google.com/beyondcorp)
