Stackbook Logo
security-complianceemerging · high operational burden

Zero Trust Architecture

Also known as: zero-trust-network, beyondcorp, identity-aware-proxy

Intent

Never trust, always verify. Authenticate and authorize every request based on identity and context, not network location.

Problem

Perimeter security (VPN, firewall) assumes internal network is trusted. Breaches move laterally. Remote work breaks perimeter.

Forces

  • •Users, devices, services everywhere (cloud, remote, hybrid)
  • •Lateral movement: compromised workload accesses everything
  • •Implicit trust by network segment is obsolete
  • •Need identity-based, context-aware access decisions

Solution

✓ When to Use

  • •Remote/hybrid workforce
  • •Multi-cloud, hybrid infrastructure
  • •Regulatory: zero trust mandated (FedRAMP, NIST 800-207)
  • •Lateral movement risk high

✗ When Not to Use

  • •Simple, on-prem only, small attack surface
  • •Legacy apps that can't do mTLS/OIDC
  • •Team not ready for identity/device management

Pros

  • +Eliminates lateral movement
  • +Works anywhere: cloud, on-prem, edge
  • +Granular: per-request, context-aware
  • +Auditability: every decision logged

Cons

  • −Complexity: identity, device, policy, enforcement
  • −Latency: policy check per request (mitigate: caching)
  • −Device management: MDM, certificates, posture
  • −Migration: incremental, coexistence with VPN

Cost Profile

Infrastructure

Medium-High — IAP, mesh, device mgmt, policy engine

Operational

High — policy authoring, cert rotation, device lifecycle

Cognitive

High — paradigm shift from perimeter

Failure Modes

  • Policy engine down → allow-all (fail-open) or deny-all (fail-closed)

  • Clock skew → certificate validation fails

  • Device posture stale → access granted to compromised device

  • Policy conflict: allow + deny rules overlap

  • Performance: policy check adds latency to every request

Real-World Examples

Alternatives

  • perimeter-security
  • vpn
  • service-mesh
  • mtls

Related Patterns

  • service-mesh
  • mtls
  • api-gateway
  • identity-provider
  • policy-engine

Competency Domains

security compliancedistribution communicationreliability opseconomics evolution