Implementing Zero-Trust Security in Modern Applications: A Complete Guide

// Example: Zero-trust authentication middleware (Node.js/Express)
import jwt from 'jsonwebtoken';
import { verifyMFA, checkDeviceHealth, evaluateRiskScore } from './security';

export async function zeroTrustAuth(req, res, next) {
  try {
    // 1. Verify JWT token
    const token = req.headers.authorization?.split(' ')[1];
    if (!token) {
      return res.status(401).json({ error: 'No token provided' });
    }

    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    
    // 2. Verify user still exists and is active
    const user = await getUserById(decoded.userId);
    if (!user || !user.active) {
      return res.status(401).json({ error: 'User not found or inactive' });
    }

    // 3. Check MFA if required for this resource
    const resource = req.path;
    const mfaRequired = await isMFARequired(resource, user.role);
    if (mfaRequired && !decoded.mfaVerified) {
      return res.status(403).json({ error: 'MFA required', needsMFA: true });
    }

    // 4. Verify device health and compliance
    const deviceId = req.headers['x-device-id'];
    const deviceHealthy = await checkDeviceHealth(deviceId);
    if (!deviceHealthy) {
      return res.status(403).json({ 
        error: 'Device does not meet security requirements' 
      });
    }

    // 5. Evaluate contextual risk score
    const riskScore = await evaluateRiskScore({
      userId: user.id,
      ipAddress: req.ip,
      location: req.headers['x-geo-location'],
      deviceId,
      resource,
      time: new Date()
    });

    if (riskScore > 0.7) {
      // High risk - require additional verification
      await triggerAdditionalVerification(user.id);
      return res.status(403).json({ 
        error: 'Additional verification required',
        needsStepUp: true 
      });
    }

    // 6. Check time-based access policies
    const hasTimeAccess = await checkTimeBasedAccess(user.id, resource);
    if (!hasTimeAccess) {
      return res.status(403).json({ error: 'Access not permitted at this time' });
    }

    // 7. Attach verified identity to request
    req.user = {
      id: user.id,
      email: user.email,
      role: user.role,
      permissions: user.permissions,
      riskScore,
      deviceId
    };

    // 8. Log access attempt for audit
    await logAccessAttempt({
      userId: user.id,
      resource,
      action: req.method,
      granted: true,
      riskScore,
      timestamp: new Date()
    });

    next();
  } catch (error) {
    await logAccessAttempt({
      resource: req.path,
      action: req.method,
      granted: false,
      error: error.message,
      timestamp: new Date()
    });
    
    return res.status(401).json({ error: 'Authentication failed' });
  }
}

// Example: Role-Based Access Control with time-limited permissions
import { Permission, Role } from './types';

interface AccessGrant {
  userId: string;
  resource: string;
  permissions: Permission[];
  grantedAt: Date;
  expiresAt: Date;
  grantedBy: string;
  justification: string;
}

class ZeroTrustAccessControl {
  async requestAccess(
    userId: string,
    resource: string,
    permissions: Permission[],
    justification: string,
    durationMinutes: number = 60
  ): Promise<AccessGrant> {
    // 1. Verify requester identity
    const user = await this.verifyUser(userId);
    
    // 2. Check if user can request these permissions
    const canRequest = await this.canRequestPermissions(
      user.role, 
      permissions
    );
    if (!canRequest) {
      throw new Error('User cannot request these permissions');
    }

    // 3. Require approval for sensitive resources
    const requiresApproval = await this.requiresApproval(resource, permissions);
    if (requiresApproval) {
      return await this.submitForApproval({
        userId,
        resource,
        permissions,
        justification,
        durationMinutes
      });
    }

    // 4. Grant time-limited access
    const grant: AccessGrant = {
      userId,
      resource,
      permissions,
      grantedAt: new Date(),
      expiresAt: new Date(Date.now() + durationMinutes * 60 * 1000),
      grantedBy: 'system',
      justification
    };

    // 5. Store grant in access control list
    await this.storeGrant(grant);

    // 6. Schedule automatic revocation
    await this.scheduleRevocation(grant);

    // 7. Notify security team of elevated access
    await this.notifySecurityTeam(grant);

    return grant;
  }

  async checkAccess(
    userId: string,
    resource: string,
    permission: Permission
  ): Promise<boolean> {
    // 1. Get user's role-based permissions
    const rolePermissions = await this.getRolePermissions(userId);
    
    // 2. Get active time-limited grants
    const activeGrants = await this.getActiveGrants(userId, resource);
    
    // 3. Combine and check permissions
    const hasRolePermission = rolePermissions.some(
      p => p.resource === resource && p.permission === permission
    );
    
    const hasGrantedPermission = activeGrants.some(
      grant => grant.permissions.includes(permission) && 
               grant.expiresAt > new Date()
    );

    return hasRolePermission || hasGrantedPermission;
  }

  async revokeAccess(grantId: string, revokedBy: string): Promise<void> {
    const grant = await this.getGrant(grantId);
    
    // Log revocation for audit
    await this.logRevocation({
      grantId,
      revokedBy,
      revokedAt: new Date(),
      originalGrant: grant
    });

    // Remove from active grants
    await this.removeGrant(grantId);

    // Invalidate any cached permissions
    await this.invalidateCache(grant.userId);
  }
}

# Example: Kubernetes NetworkPolicy for micro-segmentation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-server-policy
  namespace: production
spec:
  # Apply to API server pods
  podSelector:
    matchLabels:
      app: api-server
  
  policyTypes:
  - Ingress
  - Egress
  
  # Ingress rules - who can talk TO api-server
  ingress:
  # Allow from load balancer
  - from:
    - namespaceSelector:
        matchLabels:
          name: ingress-nginx
    ports:
    - protocol: TCP
      port: 8080
  
  # Allow from monitoring
  - from:
    - namespaceSelector:
        matchLabels:
          name: monitoring
    ports:
    - protocol: TCP
      port: 9090
  
  # Egress rules - who api-server can talk TO
  egress:
  # Allow to database
  - to:
    - podSelector:
        matchLabels:
          app: postgres
    ports:
    - protocol: TCP
      port: 5432
  
  # Allow to cache
  - to:
    - podSelector:
        matchLabels:
          app: redis
    ports:
    - protocol: TCP
      port: 6379
  
  # Allow to authentication service
  - to:
    - podSelector:
        matchLabels:
          app: auth-service
    ports:
    - protocol: TCP
      port: 8081
  
  # Allow DNS resolution
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system
    ports:
    - protocol: UDP
      port: 53
  
  # Allow HTTPS to external services (rate limiter, fraud detection)
  - to:
    - namespaceSelector: {}
    ports:
    - protocol: TCP
      port: 443

// Example: Behavioral analytics for anomaly detection
interface UserBehaviorProfile {
  userId: string;
  normalAccessPatterns: {
    typicalHours: number[];  // Hours they usually work
    typicalLocations: string[];  // Countries/cities
    avgRecordsAccessed: number;
    commonResources: string[];
    typicalDevices: string[];
  };
  riskFactors: RiskFactor[];
}

class BehaviorAnalytics {
  async evaluateAccessRisk(
    userId: string,
    currentAccess: AccessAttempt
  ): Promise<number> {
    // Get user's behavioral profile
    const profile = await this.getUserProfile(userId);
    
    let riskScore = 0;

    // Check time-based anomalies
    const currentHour = new Date().getHours();
    if (!profile.normalAccessPatterns.typicalHours.includes(currentHour)) {
      riskScore += 0.2;  // Unusual time
    }

    // Check location-based anomalies
    if (!profile.normalAccessPatterns.typicalLocations.includes(
      currentAccess.location
    )) {
      riskScore += 0.3;  // New location
    }

    // Check for impossible travel
    const lastAccess = await this.getLastAccess(userId);
    if (lastAccess) {
      const timeDiff = currentAccess.timestamp - lastAccess.timestamp;
      const distance = this.calculateDistance(
        lastAccess.location,
        currentAccess.location
      );
      const maxPossibleDistance = (timeDiff / 1000 / 60 / 60) * 900; // 900 km/h
      
      if (distance > maxPossibleDistance) {
        riskScore += 0.5;  // Impossible travel detected
      }
    }

    // Check device anomalies
    if (!profile.normalAccessPatterns.typicalDevices.includes(
      currentAccess.deviceId
    )) {
      riskScore += 0.15;  // New device
    }

    // Check access volume anomalies
    const recentAccessCount = await this.getRecentAccessCount(
      userId, 
      60  // last 60 minutes
    );
    if (recentAccessCount > profile.normalAccessPatterns.avgRecordsAccessed * 5) {
      riskScore += 0.4;  // Unusual volume
    }

    // Check for privilege escalation attempts
    if (currentAccess.requestedPermissions.some(
      p => !profile.normalAccessPatterns.commonResources.includes(p)
    )) {
      riskScore += 0.3;  // Requesting unusual permissions
    }

    return Math.min(riskScore, 1.0);  // Cap at 1.0
  }

  async handleHighRiskAccess(
    userId: string,
    riskScore: number,
    access: AccessAttempt
  ): Promise<void> {
    if (riskScore > 0.8) {
      // Very high risk - block and require re-authentication
      await this.blockAccess(userId);
      await this.requireReauthentication(userId);
      await this.notifySecurityTeam({
        userId,
        riskScore,
        access,
        action: 'blocked'
      });
    } else if (riskScore > 0.6) {
      // High risk - require MFA
      await this.requireMFA(userId);
      await this.notifySecurityTeam({
        userId,
        riskScore,
        access,
        action: 'mfa_required'
      });
    } else if (riskScore > 0.4) {
      // Moderate risk - log and monitor closely
      await this.increaseMonitoring(userId);
      await this.logRiskEvent({
        userId,
        riskScore,
        access
      });
    }
  }
}