<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Zero Trust, Defense-in-Depth, and Network Segmentation Reference

## Zero Trust Architecture (NIST SP 800-207)

Core principles:
1. All data sources and computing services are resources
2. All communication is secured regardless of network location
3. Access to individual resources is granted on a per-session basis
4. Access is determined by dynamic policy (identity, device, behavior, environment)
5. Enterprise monitors and measures integrity/security posture of all owned assets
6. Authentication and authorization are dynamic and strictly enforced before access
7. Enterprise collects as much information as possible about network state

### Implementation Layers

```
IDENTITY PLANE
├── Identity Provider (Okta, Azure AD, Google Workspace)
├── MFA everywhere — phishing-resistant (FIDO2/WebAuthn, not SMS)
├── Device trust (MDM enrollment, posture check, TPM attestation)
├── Conditional access policies (location, risk score, device compliance)
└── Just-in-time access (PIM/PAM — no standing privileges)

NETWORK PLANE
├── Microsegmentation (per-workload firewall rules, not flat VLANs)
├── Software-defined perimeter (BeyondCorp model, Tailscale/Cloudflare Access)
├── East-west traffic inspection (service mesh mTLS, Cilium, Calico)
├── DNS filtering and monitoring (canary domains, DGA detection)
└── Encrypted transport everywhere (mTLS between services, WireGuard)

DATA PLANE
├── Classification (public, internal, confidential, restricted)
├── Encryption at rest (AES-256, envelope encryption, KMS-managed keys)
├── Encryption in transit (TLS 1.3, mTLS for service-to-service)
├── DLP policies (egress inspection, watermarking, rights management)
└── Tokenization for sensitive fields (PCI DSS, PII handling)

APPLICATION PLANE
├── API gateway with authn/authz (OAuth2 + OIDC, API keys are not auth)
├── Input validation at trust boundary (allowlist > denylist)
├── Rate limiting and circuit breakers
├── Secrets management (Vault, AWS Secrets Manager — never in code)
└── SBOM and dependency scanning (Trivy, Grype, Syft)
```

## Defense-in-Depth Layering

```
Layer 1: PERIMETER       — WAF, DDoS protection, CDN edge rules
Layer 2: NETWORK         — Segmentation, IDS/IPS, flow monitoring
Layer 3: ENDPOINT        — EDR, host firewall, application allowlisting
Layer 4: APPLICATION     — Input validation, AuthN/AuthZ, SAST/DAST
Layer 5: DATA            — Encryption, DLP, access controls, backup
Layer 6: IDENTITY        — MFA, least privilege, PAM, session management
Layer 7: OPERATIONS      — Logging, monitoring, alerting, IR playbooks
```

Control types per layer: Preventive, Detective, Corrective, Deterrent.

## Network Segmentation Patterns

### Zone-Based

```
INTERNET ──┬── DMZ (web servers, reverse proxy, WAF)
            ├── APPLICATION ZONE (app servers, API gateways)
            ├── DATA ZONE (databases, file stores, caches)
            ├── MANAGEMENT ZONE (bastion, CI/CD, monitoring)
            └── RESTRICTED ZONE (secrets, HSM, PKI, backup)
```

Rules: DMZ→APP on specific ports only; DATA cannot initiate outbound; MANAGEMENT via bastion+MFA only.

### Microsegmentation (Zero Trust)

- Per-workload identity (SPIFFE/SPIRE, K8s service accounts)
- mTLS between all services (Istio, Linkerd, Cilium)
- Network policies deny-all by default, allowlist per service pair
- East-west traffic logged and inspected

## Cloud Security Reference Architectures

### AWS Landing Zone

```
AWS Organization
├── Management Account (SCPs, CloudTrail org trail, GuardDuty)
├── Security Account (SecurityHub, Detective, Macie)
├── Log Archive Account (immutable S3 + Glacier, object lock)
├── Network Account (Transit Gateway, Network Firewall)
├── Shared Services (AD, CI/CD, artifact registry)
├── Workload Accounts (prod, staging, dev — separate per env)
└── Sandbox Accounts (experimentation, restricted SCPs)
```

### Kubernetes Security

```
├── RBAC: least-privilege, no cluster-admin for workloads
├── Network Policies: deny-all default, per-namespace allowlists
├── Pod Security Standards: restricted profile
├── Secrets: external-secrets-operator → Vault/AWS SM
├── Image policy: admission controller → signed images only
├── Runtime: Falco for syscall monitoring, seccomp profiles
└── Audit: API server audit logs → SIEM
```

## Identity Fabric Design

```
USERS → Identity Provider (Okta/Azure AD)
          ├── SSO (SAML 2.0 / OIDC) → SaaS apps
          ├── SCIM provisioning → downstream directories
          ├── Conditional Access → device trust + risk score
          ├── PAM → privileged access
          └── FIDO2/Passkeys → phishing-resistant MFA

SERVICE IDENTITIES
├── K8s: ServiceAccount + IRSA/Workload Identity
├── Cloud: IAM roles (never long-lived keys)
├── CI/CD: OIDC federation (no stored secrets)
└── Machine: mTLS certificates (SPIFFE/SPIRE)
```
