Principles
- Verify explicitly — authenticate and authorise every request (user + device + context)
- Least privilege — minimum necessary permissions, only for the needed duration
- Assume breach — act as if an attacker is already inside. Minimise lateral movement
In practice
- MFA for all users, including internal services
- mTLS between microservices — mutual authentication
- Network microsegmentation — services cannot freely communicate with each other
- Continuous monitoring and logging of all connections
Tools
Google BeyondCorp, Cloudflare Access, HashiCorp Vault, Istio service mesh.