Zero Trust Architecture (ZTA)
The end of the 'Castle-and-Moat' philosophy. In a ZTA, we assume the network is compromised and verify every single request.
The Zero Trust Axiom
The traditional perimeter model is dead. Lateral movement is the primary weapon of modern attackers.
A Master Grade ZTA relies on:
• Identity-First Security: Every request must be authenticated via a strong identity provider.
• Least Privilege (LPA): Access is granted for the specific task and time required.
• Micro-Segmentation: Breaking the network into isolated zones to prevent 'hops'.
Zero Trust Logic Flow
Request
->
PEP (Enforcement)
->
PDP (Decision)
->
Resource
mTLS & Service Mesh
Ensuring that trust is not implicit, but cryptographic.
The Sidecar Pattern
Managing certificates for 100+ microservices manually is a failure point.
The la carte solution is the Service Mesh (e.g., Istio):
• Automation: Certificates are rotated every few hours automatically.
• Transparency: The Sidecar Proxy (Envoy) handles the mTLS tunnel, so the application code remains clean.
• Identity: Service-to-service identity is verified via SPIFFE standards.
Swiss Data Sovereignty & nDSG
Meeting the strict requirements of the New Swiss Data Protection Act.
The Sovereignty Stack
nDSG requires that Swiss citizens' data be protected from foreign surveillance (e.g. US Cloud Act).
Implementation Requirements:
• Geographic Pinning: Explicit use of Azure CH-North or CH-West.
• BYOK (Bring Your Own Key): Encryption keys must reside in a Swiss HSM, not in the cloud provider's default vault.
• Data Residency: Ensuring no 'Global' load balancers redirect traffic to non-Swiss nodes.
The Compliance Fallacy
Passing an nDSG audit does not mean you are secure. Compliance is the baseline; the implementation of BYOK and ZTA is the actual security.
Engineer's Implementation Checklist
Replace long-lived VPNs with Identity-Aware Proxies
Implement mTLS between internal microservices
Audit and Pin PII to Swiss regions
Implement Short-Lived JWTs with rotation
Transition to 'Deny-All' default firewall policy