Spark
Sign In
Skill

Implement Zero Trust Architecture

A skill for Zero Trust Architecture - risk-based auth, privileged access controls, microsegmentation, DLP, and phased rollout.

Get skill
Works with azuremicrosoft graphkubernetes
VibeBaza
Own this? Claim it

Maintainer of this project? Claim this page to edit the listing.

62
Spark score
out of 100
Updated 7 months ago
Fresher alternatives ↓
Version 1.0.0
Models
claude
Add to Favorites

Why it matters

Establish a robust Zero Trust Architecture (ZTA) by designing, implementing, and managing security frameworks across identity, devices, networks, and data.

Outcomes

What it gets done

01

Configure identity and access management with MFA and privileged access controls.

02

Implement network microsegmentation and Zero Trust Network Access (ZTNA).

03

Enforce device compliance and data loss prevention policies.

04

Set up continuous monitoring and analytics for security events.

Install

Add it to your toolbox

Run in your project directory:

curl -fsSL https://spark.entire.vc/get/vb-zero-trust-architecture | bash

Overview

Zero Trust Architecture Expert

This skill implements Zero Trust Architecture - risk-scored authentication, just-in-time privileged access, network microsegmentation, device compliance, and DLP policies, deployed in five phases. Use it when designing or hardening a full zero-trust program across identity, devices, network, and data, not a single point control like MFA alone.

What it does

This skill designs, implements, and manages comprehensive Zero Trust Architecture (ZTA) across identity, device, network, data, and monitoring layers in cloud, hybrid, and on-premises environments. The core principle is "never trust, always verify" - every user, device, and application is verified regardless of location, authentication and authorization are continuous, least-privilege access is enforced, and every security decision assumes breach has already occurred. Risk-based authentication scores context signals (a new device adds 30 points, an unusual location 25, off-hours access 20, an unmanaged device 25) and escalates response accordingly: a score above 70 triggers step-up authentication, above 40 requires MFA, otherwise access proceeds with monitoring.

When to use - and when NOT to

Use it when designing or hardening a full zero-trust program across identity, devices, network, and data - not a single point control like adding MFA in isolation. It is not meant to be deployed all at once: the phased rollout runs identity foundation first, then device security, network microsegmentation, data protection, and advanced analytics last, since each phase depends on the maturity of the one before it.

Inputs and outputs

Given an environment to secure, it produces privileged access controls (just-in-time access capped at a 4-hour duration requiring approval and business justification, and Privileged Identity Management activations capped at 2 hours requiring an approver, MFA, and justification, with a hard limit of 2 active Global Administrator assignments plus 2 emergency-access accounts), network microsegmentation policies scoping ingress and egress to specific namespaces, pods, and ports, Zero Trust Network Access rules gating a specific application to named user groups, managed or compliant device trust levels, MFA, allowed locations, a time window, and a session timeout, device compliance policies (password complexity and rotation rules, OS version bounds, jailbreak blocking, and a required threat-protection security level), and a data-loss-prevention policy blocking access to content containing credit card numbers, Social Security numbers, or health information across email, SharePoint, OneDrive, and Teams.

### Kubernetes Network Policies for Zero Trust
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: zero-trust-microsegmentation
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web-frontend
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: dmz
    - podSelector:
        matchLabels:
          role: load-balancer
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: api-backend
    ports:
    - protocol: TCP
      port: 3000

Integrations

Continuous monitoring runs SIEM queries (KQL against Azure Sentinel) for suspicious sign-in patterns filtered by risk level and conditional-access failures, device compliance violation counts, and privileged role-management activity. Success is tracked against named KPIs per layer: over 95% MFA adoption and 30%+ risk-score improvement for identity, over 98% device compliance and 90%+ managed-device coverage for devices, over 85% network segmentation coverage and 95%+ lateral-movement blocking for network, over 80% classified data and 92%+ DLP effectiveness for data, and under 15 minutes mean time to detection with under 1 hour mean time to response for monitoring.

Who it's for

Security architects rolling out zero trust across a full organization who also need to handle legacy systems (identity federation, network-based controls for non-integrated apps, PAM for legacy admin access) and user experience (risk-based authentication, single sign-on, passwordless methods, and clear security training) without degrading either security posture or day-to-day usability.

Source README

Zero Trust Architecture Expert

You are an expert in Zero Trust Architecture (ZTA), specializing in designing, implementing, and managing comprehensive zero trust security frameworks. Your expertise covers identity verification, device trust, network microsegmentation, data protection, and continuous monitoring across cloud, hybrid, and on-premises environments.

Core Zero Trust Principles

Never Trust, Always Verify

  • Verify every user, device, and application regardless of location
  • Implement continuous authentication and authorization
  • Apply principle of least privilege access
  • Assume breach mentality in all security decisions

Verify Explicitly

### Example Azure AD Conditional Access Policy
conditionalAccessPolicy:
  displayName: "Zero Trust Device Compliance"
  state: enabled
  conditions:
    users:
      includeUsers: ["all"]
    applications:
      includeApplications: ["all"]
    deviceStates:
      includeStates: ["all"]
  grantControls:
    operator: "AND"
    builtInControls:
      - "mfa"
      - "compliantDevice"
      - "domainJoinedDevice"

Identity and Access Management (IAM)

Multi-Factor Authentication Implementation

### Example MFA enforcement with risk-based authentication
import azure.identity as azure_id
from microsoft.graph import GraphServiceClient

class ZeroTrustAuthenticator:
    def __init__(self):
        self.credential = azure_id.ClientSecretCredential(
            tenant_id="your-tenant-id",
            client_id="your-client-id",
            client_secret="your-client-secret"
        )
        
    def evaluate_risk_and_authenticate(self, user_context):
        risk_score = self.calculate_risk_score(user_context)
        
        if risk_score > 70:
            return self.require_step_up_auth(user_context)
        elif risk_score > 40:
            return self.require_mfa(user_context)
        else:
            return self.allow_with_monitoring(user_context)
    
    def calculate_risk_score(self, context):
        score = 0
        if context.get('new_device'): score += 30
        if context.get('unusual_location'): score += 25
        if context.get('off_hours_access'): score += 20
        if not context.get('managed_device'): score += 25
        return score

Privileged Access Management

{
  "privilegedAccessPolicy": {
    "justInTimeAccess": {
      "enabled": true,
      "maxDuration": "PT4H",
      "approvalRequired": true,
      "businessJustificationRequired": true
    },
    "privilegedIdentityManagement": {
      "activationDuration": "PT2H",
      "approverRequired": true,
      "mfaRequired": true,
      "justificationRequired": true
    },
    "adminRoles": [
      {
        "roleName": "Global Administrator",
        "maxActiveAssignments": 2,
        "emergencyAccessAccounts": 2
      }
    ]
  }
}

Network Microsegmentation

Software-Defined Perimeter Implementation

### Kubernetes Network Policies for Zero Trust
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: zero-trust-microsegmentation
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web-frontend
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: dmz
    - podSelector:
        matchLabels:
          role: load-balancer
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: api-backend
    ports:
    - protocol: TCP
      port: 3000

Zero Trust Network Access (ZTNA) Configuration

#!/bin/bash
### Configure application-specific access policies

### Install and configure ZTNA agent
curl -sSL https://install.zscaler.com/zapp | sudo bash

### Application access policy
cat > /etc/zscaler/app-policies.json << EOF
{
  "policies": [
    {
      "name": "CRM-Application-Access",
      "applications": ["crm.company.internal"],
      "userGroups": ["Sales", "Marketing"],
      "deviceTrustLevels": ["Managed", "Compliant"],
      "accessControls": {
        "requireMFA": true,
        "allowedLocations": ["Corporate", "Home-Office"],
        "timeRestrictions": "09:00-17:00",
        "sessionTimeout": "4h"
      }
    }
  ]
}
EOF

Device Trust and Endpoint Security

Device Compliance Policies

### Microsoft Intune device compliance script
$CompliancePolicy = @{
    "@odata.type" = "#microsoft.graph.deviceCompliancePolicy"
    displayName = "Zero Trust Device Compliance"
    passwordRequired = $true
    passwordMinimumLength = 12
    passwordRequiredType = "alphanumeric"
    passwordMinutesOfInactivityBeforeLock = 15
    passwordExpirationDays = 90
    passwordPreviousPasswordBlockCount = 12
    osMinimumVersion = "10.0.19041"
    osMaximumVersion = "10.0.99999.9999"
    securityBlockJailbrokenDevices = $true
    deviceThreatProtectionEnabled = $true
    deviceThreatProtectionRequiredSecurityLevel = "medium"
    advancedThreatProtectionRequiredSecurityLevel = "medium"
}

New-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $CompliancePolicy

Data Protection and Classification

Data Loss Prevention (DLP) Policies

### Microsoft Purview DLP Policy for Zero Trust
dlpPolicy:
  name: "Zero Trust Data Protection"
  rules:
    - name: "Sensitive Data Protection"
      conditions:
        - contentContainsSensitiveInformation:
            - "Credit Card Number"
            - "Social Security Number"
            - "Personal Health Information"
      actions:
        - blockAccess: true
        - requireJustification: true
        - notifyUser: true
        - auditLog: true
      locations:
        - "Exchange Online"
        - "SharePoint Online"
        - "OneDrive for Business"
        - "Microsoft Teams"

Continuous Monitoring and Analytics

Security Information and Event Management (SIEM)

### Azure Sentinel KQL queries for Zero Trust monitoring
SENTINEL_QUERIES = {
    "suspicious_login_patterns": """
    SigninLogs
    | where TimeGenerated > ago(24h)
    | where RiskLevelDuringSignIn in ("high", "medium")
    | where ConditionalAccessStatus != "success"
    | project TimeGenerated, UserPrincipalName, IPAddress, 
              Location, RiskLevelDuringSignIn, ConditionalAccessStatus
    | order by TimeGenerated desc
    """,
    
    "device_compliance_violations": """
    DeviceComplianceOrg
    | where TimeGenerated > ago(1h)
    | where ComplianceState == "Noncompliant"
    | summarize ViolationCount = count() by DeviceName, ComplianceState
    | order by ViolationCount desc
    """,
    
    "privileged_access_monitoring": """
    AuditLogs
    | where TimeGenerated > ago(4h)
    | where Category == "RoleManagement"
    | where ActivityDisplayName contains "role"
    | project TimeGenerated, Identity, ActivityDisplayName, Result
    """
}

Implementation Best Practices

Phased Zero Trust Deployment

  1. Phase 1: Identity Foundation

    • Implement MFA for all users
    • Deploy conditional access policies
    • Establish identity governance

  2. Phase 2: Device Security

    • Enforce device compliance
    • Implement mobile device management
    • Deploy endpoint detection and response

  3. Phase 3: Network Segmentation

    • Implement microsegmentation
    • Deploy software-defined perimeters
    • Establish network access control

  4. Phase 4: Data Protection

    • Classify and label sensitive data
    • Implement data loss prevention
    • Deploy cloud access security brokers

  5. Phase 5: Advanced Analytics

    • Deploy SIEM/SOAR solutions
    • Implement user and entity behavior analytics
    • Establish security orchestration

Key Performance Indicators (KPIs)

zeroTrustKPIs:
  identity:
    - mfaAdoptionRate: ">95%"
    - riskScoreImprovement: ">30%"
  devices:
    - complianceRate: ">98%"
    - managedDevicePercentage: ">90%"
  network:
    - segmentationCoverage: ">85%"
    - lateralMovementBlocked: ">95%"
  data:
    - classifiedDataPercentage: ">80%"
    - dlpPolicyEffectiveness: ">92%"
  monitoring:
    - meanTimeToDetection: "<15 minutes"
    - meanTimeToResponse: "<1 hour"

Common Implementation Challenges

Legacy System Integration

  • Use identity federation for older systems
  • Implement network-based controls for non-integrated applications
  • Deploy privileged access management for legacy admin access
  • Consider application modernization roadmaps

User Experience Balance

  • Implement risk-based authentication
  • Use single sign-on where possible
  • Deploy passwordless authentication methods
  • Provide clear security training and communication

Performance Optimization

  • Cache authentication decisions
  • Implement geographically distributed policy enforcement points
  • Use machine learning for adaptive authentication
  • Monitor and optimize policy evaluation times

FAQ

Common questions

Discussion

Questions & comments · 0

Sign In Sign in to leave a comment.