Implement Zero Trust Architecture

This skill designs, implements, and manages comprehensive Zero Trust Architecture (ZTA) across identity, device, network, data, and monitoring layers in cloud, hybrid, and on-premises environments. The core principle is "never trust, always verify" - every user, device, and application is verified regardless of location, authentication and authorization are continuous, least-privilege access is enforced, and every security decision assumes breach has already occurred. Risk-based authentication scores context signals (a new device adds 30 points, an unusual location 25, off-hours access 20, an unmanaged device 25) and escalates response accordingly: a score above 70 triggers step-up authentication, above 40 requires MFA, otherwise access proceeds with monitoring.

Use it when designing or hardening a full zero-trust program across identity, devices, network, and data - not a single point control like adding MFA in isolation. It is not meant to be deployed all at once: the phased rollout runs identity foundation first, then device security, network microsegmentation, data protection, and advanced analytics last, since each phase depends on the maturity of the one before it.

Given an environment to secure, it produces privileged access controls (just-in-time access capped at a 4-hour duration requiring approval and business justification, and Privileged Identity Management activations capped at 2 hours requiring an approver, MFA, and justification, with a hard limit of 2 active Global Administrator assignments plus 2 emergency-access accounts), network microsegmentation policies scoping ingress and egress to specific namespaces, pods, and ports, Zero Trust Network Access rules gating a specific application to named user groups, managed or compliant device trust levels, MFA, allowed locations, a time window, and a session timeout, device compliance policies (password complexity and rotation rules, OS version bounds, jailbreak blocking, and a required threat-protection security level), and a data-loss-prevention policy blocking access to content containing credit card numbers, Social Security numbers, or health information across email, SharePoint, OneDrive, and Teams.

### Kubernetes Network Policies for Zero Trust
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: zero-trust-microsegmentation
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web-frontend
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: dmz
    - podSelector:
        matchLabels:
          role: load-balancer
    ports:
    - protocol: TCP
      port: 8080
  egress:
  - to:
    - podSelector:
        matchLabels:
          app: api-backend
    ports:
    - protocol: TCP
      port: 3000

Continuous monitoring runs SIEM queries (KQL against Azure Sentinel) for suspicious sign-in patterns filtered by risk level and conditional-access failures, device compliance violation counts, and privileged role-management activity. Success is tracked against named KPIs per layer: over 95% MFA adoption and 30%+ risk-score improvement for identity, over 98% device compliance and 90%+ managed-device coverage for devices, over 85% network segmentation coverage and 95%+ lateral-movement blocking for network, over 80% classified data and 92%+ DLP effectiveness for data, and under 15 minutes mean time to detection with under 1 hour mean time to response for monitoring.

Security architects rolling out zero trust across a full organization who also need to handle legacy systems (identity federation, network-based controls for non-integrated apps, PAM for legacy admin access) and user experience (risk-based authentication, single sign-on, passwordless methods, and clear security training) without degrading either security posture or day-to-day usability.