Zero Trust ও Advanced Security Architecture

Zero Trust ⭐

"Never trust, always verify."

Perimeter-based trust obsolete। Cloud, remote work-এ ভাঙে।

Principles

1. Verify explicitly (every request)
2. Least privilege
3. Assume breach (limit blast radius)
4. Continuous monitoring
5. Micro-segmentation

Implementation

SSO+MFA, device health, conditional access, service mesh (mTLS), IAP, BeyondCorp।

STRIDE Threat Model ⭐

Threat	উদাহরণ
Spoofing	Identity fake
Tampering	Data modify
Repudiation	"আমি করিনি"
Info Disclosure	Leak data
DoS	Service down
Elevation	User → Admin

STRIDE Process

1. Architecture diagram (data flow)
2. Identify trust boundaries
3. STRIDE check per component
4. Rate risk (likelihood × impact)
5. Mitigations plan
6. Re-evaluate

Other Frameworks

PASTA (risk-centric), OCTAVE (operational), VAST (agile), Trike।

Pen Testing

• Black/White/Gray box
• Phases: Recon → Scan → Exploit → Post-exploit → Report
• Tools: nmap, nikto, Metasploit, Burp Suite

SAST in CI/CD ⭐

- name: Snyk Code
  run: snyk code test

- name: Semgrep
  run: semgrep --config=auto

- name: SonarQube
  uses: sonarsource/sonarqube-scan-action@master
# Block PR on critical findings

DAST in CI/CD

- name: OWASP ZAP Baseline
  uses: zaproxy/action-baseline@v0
  with: { target: "https://staging.app.com" }

Compliance Frameworks

Standard	Scope
GDPR	EU personal data
PCI-DSS	Credit card
HIPAA	US healthcare
SOC 2	SaaS audit
ISO 27001	InfoSec mgmt

GDPR Requirements

• Consent before collection
• Data minimization
• Right to access, erasure, portability
• Breach notification 72h
• DPO for big orgs
• Privacy by Design

Incident Response (NIST 6) ⭐

1. Preparation — team, runbook, tools
2. Identification — detect, classify
3. Containment — isolate
4. Eradication — root cause
5. Recovery — restore, monitor
6. Lessons Learned — postmortem

Severity

• SEV1 — full outage, breach
• SEV2 — major degradation
• SEV3 — partial
• SEV4 — minor

Postmortem

Blameless, timeline, 5 Whys root cause, what went well/wrong, action items with owners, share org-wide।

SOC

SIEM (Splunk, ELK, Sentinel), SOAR (automation), EDR (endpoint), threat intel, 24/7 monitor।