moai-security-zero-trust

name	moai-security-zero-trust
version	4.0.0
status	stable
description	Enterprise Skill for advanced development
allowed-tools	Read, Bash, WebSearch, WebFetch

moai-security-zero-trust: Zero-Trust Architecture & Micro-Segmentation

Enterprise Zero-Trust with eBPF, Micro-Segmentation & mTLS
Trust Score: 9.9/10 | Version: 4.0.0 | Enterprise Mode | Last Updated: 2025-11-12

---

Overview

Zero-Trust Architecture (ZTA) implementation with eBPF-based network policies, micro-segmentation, and mutual TLS (mTLS) enforcement. Kubernetes NetworkPolicy with Cilium 1.18+, Teleport BeyondCorp implementation, device trust verification. 2025 standard: 50% of enterprises now use service mesh for zero-trust enforcement.

When to use this Skill:

• Implementing zero-trust security model
• Kubernetes microservices security
• Enforcing network micro-segmentation
• BeyondCorp device trust architecture
• mTLS enforcement between services
• Service mesh deployment (Cilium/Istio)
• Cloud-native zero-trust implementation

---

Level 1: Foundations

Zero-Trust Principles

Traditional Security Model (Perimeter-based):
Network Edge
    │
    ├─ Firewall (allow/deny external)
    └─ Internal trust: ANY communication allowed
    
Zero-Trust Model (Never trust, always verify):
Every Request
    ├─ Identity: WHO is making request?
    ├─ Device: IS device trusted?
    ├─ Network: IS source authorized?
    ├─ Application: IS request legitimate?
    └─ Decision: ALLOW or DENY

Key Principles:
1. Never trust, always verify
2. Least privilege access
3. Assume breach (defense in depth)
4. Verify every transaction
5. Encrypt all traffic
6. Monitor all activity

Zero-Trust Architecture Layers

Layer 1: Identity & Authentication
├─ Multi-factor authentication (MFA)
├─ Passwordless authentication
└─ Continuous authentication

Layer 2: Device Security
├─ Device posture assessment
├─ Endpoint detection & response (EDR)
├─ Device certificate (PKI)
└─ Hardware security modules (HSM)

Layer 3: Network Segmentation
├─ Micro-segmentation policies
├─ Application-aware firewalling
├─ Encrypted tunnels (mTLS)
└─ Service mesh enforcement

Layer 4: Application & Data
├─ Fine-grained access control
├─ Data encryption (at-rest, in-transit)
├─ Sensitive data masking
└─ Audit logging of all access

---

Level 2: Core Patterns

Pattern 1: Kubernetes NetworkPolicy with Cilium

# Default: Deny All (Zero-Trust Default)
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
# Allow Frontend -> Backend traffic
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: frontend-to-backend
spec:
  podSelector:
    matchLabels:
      tier: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: frontend
    ports:
    - protocol: TCP
      port: 8080
---
# Cilium CiliumNetworkPolicy (Layer 7 - application layer)
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
   

   
  
  
  
    
       
  
  
  
   
     
         
    
     
        
         
      
      
        
          
           
          
           
  
  
  
   
     
         
    
     
        
         
      
        
          
           

// Cilium integration in Node.js
const k8s = require('@kubernetes/client-node');

class CiliumNetworkPolicyManager {
  constructor() {
    this.kc = new k8s.KubeConfig();
    this.kc.loadFromDefault();
    this.k8sApi = this.kc.makeApiClient(k8s.CustomObjectsApi);
  }
  
  async applyZeroTrustPolicy(namespace, serviceName) {
    // Create default deny-all policy
    const denyPolicy = {
      apiVersion: 'networking.k8s.io/v1',
      kind: 'NetworkPolicy',
      metadata: {
        name: `${serviceName}-default-deny`,
        namespace,
      },
      spec: {
        podSelector: {
          matchLabels: {
            app: serviceName,
          },
        },
        policyTypes: ['Ingress', 'Egress'],
        ingress: [],  // Empty = deny all
        egress: [],   // Empty = deny all
      },
    };
    
    // Create Cilium Layer 7 policy for specific allowed traffic
    const l7Policy = {
      : ,
      : ,
      : {
        : ,
        namespace,
      },
      : {
        : {
          : {
            : serviceName,
          },
        },
        : [
          {
            : [
              {
                : {
                  : ,
                },
              },
            ],
            : [
              {
                : [
                  {
                    : ,
                    : ,
                  },
                ],
                : {
                  : [
                    {
                      : ,
                      : ,
                    },
                  ],
                },
              },
            ],
          },
        ],
      },
    };
    
    
     ..(
      ,
      ,
      namespace,
      ,
      denyPolicy
    );
    
     ..(
      ,
      ,
      namespace,
      ,
      l7Policy
    );
    
    .();
  }
}

Pattern 2: mTLS Enforcement (Service Mesh)

// Service mesh (Cilium, Istio) enforces mTLS between services
const { Issuer } = require('openid-client');

class mTLSEnforcement {
  constructor() {
    this.certs = new Map();
    this.trustStore = [];
  }
  
  // Issue certificate to service
  async issueCertificate(serviceName, namespace) {
    const cert = {
      subject: `/CN=${serviceName}.${namespace}.svc.cluster.local`,
      validity: {
        notBefore: new Date(),
        notAfter: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
      },
      keySize: 4096,
      algorithm: 'RSA',
    };
    
    // Store in secret
    await this.storeInK8sSecret(serviceName, namespace, cert);
    
    this.certs.set(`.`, cert);
    
     cert;
  }
  
  
   () {
    
     (!.(clientCert)) {
        ();
    }
    
    
     (!.(serverCert)) {
        ();
    }
    
    
     (!.(clientCert)) {
        ();
    }
    
     (!.(serverCert)) {
        ();
    }
    
    
     now =  ();
     (now <  (clientCert.) || now >  (clientCert.)) {
        ();
    }
    
     (now <  (serverCert.) || now >  (serverCert.)) {
        ();
    }
    
     {
      : ,
      : clientCert.,
      : serverCert.,
    };
  }
  
  () {
    
     ;  
  }
  
  () {
    
     ..( ca. === cert.);
  }
}

Pattern 3: Device Trust Verification (BeyondCorp)

class DeviceTrustAssessment {
  async assessDeviceTrust(device) {
    const assessment = {
      deviceId: device.id,
      timestamp: new Date(),
      score: 0,
      checks: {},
    };
    
    // Check 1: Operating System
    const osCheck = await this.checkOS(device);
    assessment.checks.os = osCheck;
    assessment.score += osCheck.trusted ? 25 : 0;
    
    // Check 2: Antivirus/Anti-malware
    const avCheck = await this.checkAntivirus(device);
    assessment.checks.antivirus = avCheck;
    assessment.score += avCheck.enabled ? 25 : 0;
    
    // Check 3: Firewall
    const fwCheck = await this.checkFirewall(device);
    assessment.checks.firewall = fwCheck;
    assessment.score += fwCheck.enabled ? 25 : 0;
    
    // Check 4: Disk Encryption
    const encCheck =  .(device);
    assessment.. = encCheck;
    assessment. += encCheck. ?  : ;
    
    
    assessment. = .(assessment.);
    
     assessment;
  }
  
  () {
     (score >= )  ;
     (score >= )  ;
     ;
  }
  
   () {
    
     {
      : device.,
      : device.,
      : device.,
      : .(device),
    };
  }
  
   () {
    
     {
      : device.,
      : device.,
      : device.,
      : .(device.),
    };
  }
  
  () {
     daysSincePatch = .(
      (.() -  (device.)) / ( *  *  * )
    );
    
    
     daysSincePatch <= ;
  }
  
  () {
     .(
      (.() -  (lastUpdate)) / ( *  *  * )
    );
  }
}


 deviceTrust =  ();

app.( (req, res, next) => {
   device = req.;  
  
   assessment =  deviceTrust.(device);
  
   (assessment. === ) {
     res.().({
      : ,
      assessment,
    });
  }
  
   (assessment. === ) {
    
    req. = ;
  }
  
  ();
});

---

Level 3: Advanced

Advanced: Context7 MCP Network Policy Validation

const { Context7Client } = require('context7-mcp');

class NetworkPolicyValidator {
  constructor(apiKey) {
    this.context7 = new Context7Client(apiKey);
  }
  
  // Validate network policy against threat intelligence
  async validatePolicy(policy) {
    const validation = await this.context7.query({
      type: 'network_policy_validation',
      policy,
      tags: ['zero_trust', 'micro_segmentation'],
    });
    
    return {
      valid: validation.isValid,
      issues: validation.issues,
      recommendations: validation.recommendations,
    };
  }
  
  // Detect policy conflicts
  async detectConflicts(policies) {
    const conflicts = await this.context7.query({
      type: 'policy_conflict_detection',
      policies,
    });
    
    return conflicts.detectedConflicts;
  }
}

---

Checklist

• Default deny-all NetworkPolicy implemented
• Explicit allow rules for service-to-service communication
• Cilium L7 policies for HTTP methods/paths
• mTLS enforced between all services
• Service certificates issued and managed
• Device trust assessment process implemented
• BeyondCorp device verification working
• Continuous monitoring of network traffic
• Hubble observability enabled
• Zero-trust validated against threat intelligence

---

Quick Reference

Component	Purpose	Tool
Identity	Verify WHO	MFA, Passwordless
Device	Verify DEVICE HEALTH	EDR, Certificate
Network	Verify PATH	Cilium, Istio
Application	Verify REQUEST	mTLS, RBAC