Zero-Trust Reference Architecture (N7)¶
How the SnowOps control set realizes a zero-trust architecture on Azure. This is the technical reference that maps the zero-trust pillars and principles to concrete SnowOps assets — the engineering counterpart to the GTM reference platforms (
Z1/Z2/Z3) and the umbrella Information Security Policy.
The three principles (applied)¶
| Principle | How SnowOps applies it |
|---|---|
| Verify explicitly | Every access is authenticated + authorized on identity, device, and context — not network location. Conditional Access (H2) requires phishing-resistant MFA + compliant device; OIDC federation replaces standing secrets. |
| Use least-privilege access | Just-in-time, time-bound, scoped. PIM for Azure + Entra roles (H3), RBAC by group, a monitored break-glass exception (H7), private-by-default networking (N5/N6). |
| Assume breach | Minimize blast radius + detect/respond fast. Segmentation (F2/N1), deny-by-default policy (F1/M/N initiatives), continuous detection (J3/J4), automated containment (K3), immutable audit (J6). |
The pillars → SnowOps assets¶
1. Identity¶
The primary control plane.
- Entra baseline — named locations, authentication strength (H1).
- Conditional Access — MFA + compliant-device + risk policies, break-glass
exclusion (H2).
- Privileged access — PIM just-in-time for Azure + Entra roles (H3); a
permanent, monitored, alerting break-glass account (H7).
- Workload identity — OIDC federation for CI/CD + AKS workload identity (no
long-lived secrets) (C1/F3).
- Verify continuously — risky/failed sign-in alerts (J4); quarterly access
reviews (E6).
2. Devices / Endpoints¶
- Compliant-device enforcement via Conditional Access (
H2). - Endpoint posture (Intune / Defender for Endpoint) is the O-series (roadmap, M4) — until then device trust is asserted via CA + managed access.
3. Network¶
Assume the network is hostile; segment and inspect.
- Hub-spoke segmentation + forced-tunnel egress through the firewall (F2),
plus the connectivity landing zone — Bastion, gateways, DNS resolver (N1).
- Deep inspection — Azure Firewall Premium with IDPS + TLS inspection
(N2); WAF on public entry points (N3); DDoS protection (N4).
- Private-by-default — private endpoints enforced by Deny policy (N5);
hardened NSG baselines + flow logs + traffic analytics (N6).
4. Applications¶
- Secure delivery — signed images + provenance (
C2), gated AKS deploy with rollback (C3), Kyverno admission policy (D4). - Pre-production assurance — SAST (
I3), dependency (I2) + image (I1) scanning, DAST against running apps (I4).
5. Data¶
- Encryption everywhere — CMK/HSM (
M2), encryption + TLS Deny initiatives (M1/M3), data-residency enforcement (M6). - Protect & recover — immutable backup (
L1), cross-region replication (L2), tested restore (L4). - Secrets — Key Vault with RBAC + purge protection + private endpoint (
F5).
Cross-cutting: Visibility, Analytics & Automation¶
Zero trust requires a telemetry + response spine across all pillars.
- Collect — central Log Analytics (J1), DINE diagnostics (J2), immutable
audit archive (J6).
- Detect — Sentinel (J3), alert rule pack (J4), Defender → ticket (I5).
- Respond — SOAR playbooks (K3), IR runbooks (K1) + on-call (K2).
- Govern — Azure Policy guardrails (F1), drift detection (S1), compliance
snapshot/dashboard/scorecard (E0/S2/S4), waiver expiry (D5),
posture report (V5).
Maturity & gaps¶
| Pillar | SnowOps coverage | Notable gap (roadmap) |
|---|---|---|
| Identity | Strong (H-series, E6) | SCIM provisioning (H4), native AAD access reviews (H6) |
| Devices | Partial (CA-asserted) | Endpoint management / Defender for Endpoint (O-series) |
| Network | Strong (F2, N1–N6) | Zero-trust micro-segmentation beyond hub-spoke (advanced) |
| Applications | Strong (C/I/D series) | DAST coverage breadth |
| Data | Strong (M/L/F5) | Purview classification + DLP (M4/M5), GDPR/DSAR (M7) |
| Visibility | Strong (J/K/E/S series) | — |
How to use this reference¶
- Architects — use the pillar → asset map to compose a client environment and to spot which pillars are Baseline vs Advanced.
- Auditors / prospects — read it alongside the control mappings to see how zero-trust principles trace to enforced, evidence-backed controls.
- Sales — the maturity table frames Baseline → Advanced upsell conversations (mirrors the tier tagging in the posture report).
Asset codes resolve via
docs/context/00-asset-glossary.md.