Getting Started with Zero Trust Architecture

Zero Trust gets used as a label for a lot of unrelated products. The idea underneath it is narrow: stop granting trust based on network location, and verify every request instead. This is what that meant in practice when we applied it to payment infrastructure under PCI scope.

The starting position

The traditional model assumes a perimeter. Inside the firewall is trusted, outside is not. That falls over the moment you run dozens of services in a cluster, because “inside” is now a very large room with a lot of doors.

The three rules we worked from:

1. Verify every request. Authenticate and authorize on the request itself, not on where it came from.
2. Grant the least access that works. Scoped, time-bound access rather than standing permissions.
3. Assume something is already compromised. Design so that one compromised service is not a path to everything else.

What we changed at the network level

• mTLS between all services, via Istio. No service accepts plaintext from a peer.
• NetworkPolicies in Kubernetes, so pod-to-pod traffic is allowed by declaration rather than by default.
• No public IPs for internal services. Ingress happens in one place, on purpose.

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT

Turning on STRICT mode is the easy part. The work is finding every job, cron and legacy client that was quietly talking plaintext, which is why the rollout ran in permissive mode first.

What we changed at the application level

• Identity on every request. A verified caller identity, propagated rather than re-derived.
• Short-lived tokens. JWTs with expiry measured in minutes, not days.
• Re-checking authorization inside the request, instead of once at the edge and never again.

What I would tell someone starting

Start with observability. Before tightening anything, make sure you can see which service talks to which. Every team we worked with underestimated this, and the connection map is always wider than the architecture diagram.

Automate the enforcement. A policy that depends on someone remembering it is not a policy. If mTLS or a NetworkPolicy can be bypassed by a manual deploy, it will be.

Expect the first rollout to break something boring. Ours was a health check.

Zero Trust is not a project with an end date. Each layer you add reduces what a single compromise gets you, and that is the whole return.