Zero Trust Networking

BeyondCorp identity-based access, microsegmentation, ZTNA architecture, mTLS everywhere, and never-trust-always-verify model.

Overview

Overview Zero Trust Networking (ZTN) is a security model that eliminates the concept of a trusted network perimeter. Traditional security assumes that traffic inside the corporate network or VPC is trusted. Zero Trust rejects this assumption: "never trust, always verify" — every request must be authenticated and authorized regardless of where it originates.

The model emerged from Google's BeyondCorp initiative (2014-2016). BeyondCorp moved access control from the network layer to the application layer. Employees access corporate applications via a proxy that verifies their device certificate, identity token, and risk posture — not their network location. A laptop on a coffee shop WiFi receives the same treatment as one on the corporate network.

The key principles are: verify explicitly (authenticate and authorize every request using all available signals), use least privilege access (grant minimum necessary permissions), and assume breach (design systems assuming an attacker is already inside; limit blast radius through microsegmentation).

Microsegmentation applies fine-grained network policies that allow only the specific communication paths required by business logic. In Kubernetes, this is implemented via NetworkPolicy. In AWS, via security group references. In a service mesh, via authorization policies on the mTLS-authenticated service identity.

mTLS (mutual TLS) is the cryptographic mechanism underlying Zero Trust service-to-service communication. Unlike standard TLS where only the server presents a certificate, mTLS requires both client and server to present and verify certificates. Service meshes like Istio and Linkerd automate mTLS certificate provisioning, rotation, and enforcement.

Key concepts

Never Trust, Always Verify: No user, device, or service is implicitly trusted based on network location. Every access request must be authenticated and authorized. Being inside the VPC or corporate network confers no trust by itself.
BeyondCorp: Google's implementation of Zero Trust. Access is controlled by a central access proxy evaluating user identity, device certificate, device inventory status, and request context — not network IP.
Microsegmentation: Dividing a network into small segments with fine-grained access controls. Each workload can only communicate with the specific other workloads it needs to. Limits lateral movement after a breach.
mTLS (Mutual TLS): Both the client and server present X.509 certificates during the TLS handshake. Each service has a cryptographic identity (SPIFFE SVID in service meshes). Requests are authenticated at the transport layer.
ZTNA (Zero Trust Network Access): A modern replacement for VPN. Users connect to a ZTNA proxy that evaluates device posture, identity, and context before proxying access to specific applications. Users never have broad network access.
SPIFFE/SPIRE: Secure Production Identity Framework for Everyone. An open standard for workload identity. SPIRE issues short-lived X.509 SVIDs to workloads. Istio uses SPIFFE-compatible identities automatically.

When to use it

Designing access control for a remote workforce accessing internal applications from untrusted networks
Implementing service-to-service authentication in a microservices architecture
Explaining microsegmentation as an alternative to VPN-based network isolation
Designing mTLS with Istio or Linkerd for a Kubernetes-based service mesh
Scoping the blast radius of a potential security breach in a microservices environment
Replacing a VPN-based remote access architecture with a ZTNA solution

Interview questions

Explain how Istio implements Zero Trust service-to-service authentication using mTLS.
Compare VPN-based remote access with ZTNA. What are the architectural differences and when do you migrate?

Zero Trust Networking

Overview

Key concepts

When to use it

Interview questions

More Networking topics