1. BeyondCorp Model
Google’s BeyondCorp is a Zero Trust implementation that shifts access controls from the network perimeter to individual users and devices.
Key Components
- Access Proxy: All access to services goes through a central proxy
- Device Inventory: Comprehensive database of all devices
- User Directory: Centralized identity management
- Access Control Engine: Makes real-time access decisions
Implementation Example: Access Proxy with Identity-Aware Proxy (IAP)
# Terraform configuration for Google Cloud IAP
resource "google_iap_brand" "project_brand" {
support_email = "[email protected]"
application_title = "Cloud IAP Example"
}
resource "google_iap_client" "project_client" {
display_name = "IAP Client"
brand = google_iap_brand.project_brand.name
}
resource "google_iap_web_backend_service_iam_binding" "binding" {
project = var.project_id
web_backend_service = google_compute_backend_service.backend_service.name
role = "roles/iap.httpsResourceAccessor"
members = [
"user:[email protected]",
"group:[email protected]",
]
}
resource "google_compute_backend_service" "backend_service" {
name = "backend-service"
port_name = "http"
protocol = "HTTP"
timeout_sec = 10
backend {
group = google_compute_instance_group_manager.webservers.instance_group
}
health_checks = [
google_compute_http_health_check.default.id
]
}
2. Service Mesh Security
Service meshes provide a dedicated infrastructure layer for handling service-to-service communication with built-in security features.
Key Components
- Sidecar Proxies: Intercept all network traffic
- Control Plane: Manages security policies
- Certificate Authority: Issues and rotates certificates
- Policy Engine: Enforces access control policies
Implementation Example: Istio Security Policies
# Istio AuthorizationPolicy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: payment-service-policy
namespace: production
spec:
selector:
matchLabels:
app: payment-service
action: ALLOW
rules:
- from:
- source:
principals: ["cluster.local/ns/production/sa/order-service"]
to:
- operation:
methods: ["POST"]
paths: ["/api/payments"]
when:
- key: request.headers[x-transaction-id]
values: ["*"]
- key: request.auth.claims[roles]
values: ["payment-service-client"]
3. Zero Trust Data Protection
This pattern focuses on protecting data through encryption, access controls, and continuous monitoring.
Key Components
- Data Classification: Categorize data based on sensitivity
- Encryption: Protect data at rest and in transit
- Access Controls: Fine-grained permissions for data access
- Data Loss Prevention: Monitor and prevent unauthorized data exfiltration