Zero Trust Security: BeyondCorp Architecture, Identity-Aware Proxy, and Modern Network Security

Traditional network security assumes the corporate network is trusted and external traffic is not. Zero trust rejects this assumption: "never trust, always verify." Every request — whether from inside the office network, a remote employee, or a service calling another service — must authenticate and be authorized before accessing resources.

Google built BeyondCorp in 2011 after a major breach (Operation Aurora) and has operated without a VPN since. Zero trust is now industry standard for serious security postures.

---

Why VPN Falls Short

---

The Zero Trust Model

Traditional: Network perimeter defines trust
  [Internet] → [Firewall] → [Trusted Network] → Resources

Zero Trust: Identity + Device define trust
  [Any Network] → [Identity Verification] + [Device Trust] → [Per-Resource Auth] → Resource

Every access decision evaluates:

1. Who are you? (Identity — SSO, MFA)
2. What device are you on? (Device posture — managed device, OS version, disk encryption, endpoint protection)
3. What are you accessing? (Resource sensitivity level)
4. Is this normal for you? (Behavioral context — location, time, access pattern)

---

Cloudflare Access (Zero Trust ZTNA)

Cloudflare Access is the easiest way to implement zero trust for most organizations — it sits in front of your internal applications and enforces identity + device checks.

User → Cloudflare Access → Your Internal App
           ↑ Verifies:
           - Google/Okta/GitHub SSO identity
           - Device managed? (via WARP client)
           - Access policy (which users/groups allowed?)

Setup:

# Install cloudflared (the tunnel agent) on your internal server
curl -L https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64 \
  -o /usr/local/bin/cloudflared
chmod +x /usr/local/bin/cloudflared

# Authenticate with Cloudflare
cloudflared tunnel login

# Create a tunnel
cloudflared tunnel create internal-apps

# Configure tunnel
cat > ~/.cloudflared/config.yml << EOF
tunnel: <tunnel-uuid>
credentials-file: /home/user/.cloudflared/<tunnel-uuid>.json

ingress:
  - hostname: grafana.internal.yourcompany.com
    service: http://localhost:3000
  - hostname: postgres-admin.internal.yourcompany.com
    service: http://localhost:8080  # pgAdmin
  - hostname: jenkins.internal.yourcompany.com
    service: http://localhost:8090
  - service: http_status:404
EOF

# Run tunnel (or install as systemd service)
cloudflared tunnel run internal-apps

Define access policies (Cloudflare dashboard or Terraform):

# terraform/cloudflare-access.tf
resource "cloudflare_access_application" "grafana" {
  zone_id          = var.zone_id
  name             = "Grafana — Internal Monitoring"
  domain           = "grafana.internal.yourcompany.com"
  type             = "self_hosted"
  session_duration = "8h"
}

resource "cloudflare_access_policy" "grafana_engineering" {
  application_id = cloudflare_access_application.grafana.id
  zone_id        = var.zone_id
  name           = "Engineering team"
  precedence     = 1
  decision       = "allow"

  include {
    email_domain = ["yourcompany.com"]  # All company email addresses
    group = [cloudflare_access_group.engineering.id]
  }

  require {
    # Require WARP (device posture check)
    device_posture = [cloudflare_device_posture_rule.managed_device.id]
  }
}

# Separate policy for contractors (email list, no device requirement)
resource "cloudflare_access_policy" "grafana_contractors" {
  application_id = cloudflare_access_application.grafana.id
  zone_id        = var.zone_id
  name           = "Contractors"
  precedence     = 2
  decision       = "allow"

  include {
    email = var.contractor_emails
  }
  # No device posture requirement for contractors
}

---

Identity-Aware Proxy Pattern

For your own applications, implement an identity-aware proxy layer that validates every request:

// middleware/zeroTrustAuth.ts
import jwt from 'jsonwebtoken';
import jwksClient from 'jwks-rsa';

// Cloudflare Access provides a JWT on every request that passes the access check
// Verify it to ensure requests haven't bypassed Cloudflare

const jwks = jwksClient({
  jwksUri: `https://${process.env.CLOUDFLARE_TEAM_DOMAIN}.cloudflareaccess.com/cdn-cgi/access/certs`,
  cache: true,
  rateLimit: true,
});

async function getCloudflarePublicKey(kid: string): Promise<string> {
  return new Promise((resolve, reject) => {
    jwks.getSigningKey(kid, (err, key) => {
      if (err) return reject(err);
      resolve(key!.getPublicKey());
    });
  });
}

export async function verifyCloudflareAccessJWT(token: string): Promise<{
  email: string;
  sub: string;
  groups: string[];
}> {
  const decoded = jwt.decode(token, { complete: true });
  if (!decoded || typeof decoded.payload === 'string') {
    throw new Error('Invalid JWT format');
  }

  const publicKey = await getCloudflarePublicKey(decoded.header.kid!);

  const payload = jwt.verify(token, publicKey, {
    issuer: `https://${process.env.CLOUDFLARE_TEAM_DOMAIN}.cloudflareaccess.com`,
    audience: process.env.CLOUDFLARE_ACCESS_AUDIENCE,
  }) as jwt.JwtPayload;

  return {
    email: payload.email,
    sub: payload.sub!,
    groups: payload['urn:zitadel:iam:org:project:roles']
      ? Object.keys(payload['urn:zitadel:iam:org:project:roles'])
      : payload.groups ?? [],
  };
}

// Fastify middleware
export async function zeroTrustMiddleware(
  request: FastifyRequest,
  reply: FastifyReply
) {
  const cfJwt = request.headers['cf-access-jwt-assertion'] as string;

  if (!cfJwt) {
    // If running locally without Cloudflare, use developer bypass
    if (process.env.NODE_ENV === 'development') {
      request.user = { email: 'dev@yourcompany.com', sub: 'dev', groups: ['engineering'] };
      return;
    }
    return reply.code(401).send({ error: 'Missing Cloudflare Access JWT' });
  }

  try {
    request.user = await verifyCloudflareAccessJWT(cfJwt);
  } catch (err) {
    return reply.code(403).send({ error: 'Invalid or expired access token' });
  }
}

---

mTLS for Service-to-Service Authentication

For internal service-to-service communication, mTLS (mutual TLS) ensures both parties prove their identity:

# Istio mTLS policy — enforce mTLS for all intra-mesh traffic
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT  # All connections must use mTLS; plaintext rejected

---
# Authorization policy — payment service can only be called by checkout service
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: payment-service-authz
  namespace: production
spec:
  selector:
    matchLabels:
      app: payment-service
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - "cluster.local/ns/production/sa/checkout-service"
              - "cluster.local/ns/production/sa/admin-service"

Without mTLS, a compromised pod can call any other service in the cluster. With mTLS + AuthorizationPolicy, each service can only be called by explicitly allowed clients.

---

Device Posture Checks

Zero trust isn't just about user identity — device health matters too:

# Cloudflare WARP device posture rules
resource "cloudflare_device_posture_rule" "managed_device" {
  account_id  = var.account_id
  name        = "Managed Device Requirements"
  type        = "serial_number"
  description = "Device must be in MDM-managed device list"

  # Check multiple posture signals
  input {
    # OS must be updated within 30 days
    os_distro_rev_minimum = "14.0"  # macOS 14+
  }
}

resource "cloudflare_device_posture_rule" "disk_encryption" {
  account_id  = var.account_id
  name        = "Disk Encryption"
  type        = "disk_encryption"

  input {
    enabled = true  # FileVault/BitLocker must be enabled
  }
}

resource "cloudflare_device_posture_rule" "endpoint_protection" {
  account_id  = var.account_id
  name        = "Endpoint Protection"
  type        = "crowdstrike_s2s"  # Crowdstrike sensor must be active
}

---

Zero Trust Implementation Roadmap

---

Working With Viprasol

We design and implement zero trust architectures for engineering organizations — Cloudflare Access deployment, identity provider integration, service mesh mTLS, and device posture enforcement. Zero trust is the right answer for remote-first and security-conscious organizations.

→ Talk to our security team about zero trust implementation.

---

See Also

• Mobile App Security — zero trust principles on mobile
• Fintech Compliance Software — compliance requirements driving zero trust
• API Gateway Patterns — edge authentication patterns
• GitOps Workflows — secure deployment pipelines
• Cloud Solutions — security architecture and infrastructure