[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CQ258KVYP77YENBD286T2":3,"skill-same:01M71CQ258KVYP77YENBD286T2":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":61,"commitSha":62,"skillDirectory":63,"forksCount":14,"repositoryHtmlUrl":64,"repositoryHomepageUrl":6,"ownerHtmlUrl":65,"ownerBlogUrl":6,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M71CQ258KVYP77YENBD286T2","zerotrust-beyondcorpmodel-exploit",null,"Implementing Google''s BeyondCorp zero trust access model to eliminate implicit trust from the network perimeter, enforce identity-aware access controls using IAP, Access Context Manager, and Chrome Enterprise Premium for VPN-less secure application access.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fbeyondcorpmodel\u002Fexploit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"exploit","zerotrust beyondcorpmodel exploit","manager","vpn","google","network","secure","read","iap","beyondcorp","vpn-less","ztna","zero-trust","context manager","architecture","Bash","access","cybersecurity","implementing","model","2026-11-10 10:12:30",false,"---\nname: zerotrust-beyondcorpmodel-exploit\ndescription: Implementing Google''s BeyondCorp zero trust access model to eliminate implicit trust from the network perimeter, enforce identity-aware access controls using IAP, Access Context Manager, and Chrome Enterprise Premium for VPN-less secure application access.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- beyondcorp\n- zero-trust\n- google-cloud\n- iap\n- identity-aware-proxy\n- ztna\n- access-context-manager\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\ncapec: []\n---\n\n# Implementing BeyondCorp Zero Trust Access Model\n\n## When to Use\n\n- When replacing traditional VPN infrastructure with identity-based application access\n- When migrating to Google Cloud and requiring zero trust access for internal applications\n- When implementing device trust verification as a prerequisite for resource access\n- When needing context-aware access policies based on user identity, device posture, and location\n- When securing access for remote and hybrid workforce without network-level trust\n\n**Do not use** when applications require raw network-level access (e.g., UDP-based protocols not supported by IAP), for consumer-facing public applications, or when the organization lacks an identity provider with MFA capabilities.\n\n## Prerequisites\n\n- Google Cloud organization with Cloud Identity or Google Workspace\n- Identity-Aware Proxy (IAP) API enabled on the GCP project\n- Chrome Enterprise Premium license for endpoint verification\n- Applications deployed behind a Google Cloud Load Balancer or on App Engine\u002FCloud Run\n- Endpoint Verification extension deployed on all corporate devices\n- Access Context Manager API enabled\n\n## Workflow\n\n### Step 1: Configure Access Context Manager with Access Levels\n\nDefine access levels that represent trust tiers based on device and user attributes.\n\n```bash\n# Enable required APIs\ngcloud services enable iap.googleapis.com\ngcloud services enable accesscontextmanager.googleapis.com\ngcloud services enable beyondcorp.googleapis.com\n\n# Create an access policy (organization level)\ngcloud access-context-manager policies create \\\n  --organization=ORG_ID \\\n  --title=\"BeyondCorp Enterprise Policy\"\n\n# Create a basic access level for corporate managed devices\ncat > corporate-device-level.yaml \u003C\u003C 'EOF'\n- devicePolicy:\n    allowedEncryptionStatuses:\n      - ENCRYPTED\n    osConstraints:\n      - osType: DESKTOP_CHROME_OS\n        minimumVersion: \"13816.0.0\"\n      - osType: DESKTOP_WINDOWS\n        minimumVersion: \"10.0.19045\"\n      - osType: DESKTOP_MAC\n        minimumVersion: \"13.0.0\"\n    requireScreenlock: true\n    requireAdminApproval: true\n  regions:\n    - US\n    - GB\n    - DE\nEOF\n\ngcloud access-context-manager levels create corporate-managed \\\n  --policy=POLICY_ID \\\n  --title=\"Corporate Managed Device\" \\\n  --basic-level-spec=corporate-device-level.yaml\n\n# Create a custom access level using CEL expressions\ngcloud access-context-manager levels create high-trust \\\n  --policy=POLICY_ID \\\n  --title=\"High Trust Level\" \\\n  --custom-level-spec=high-trust-cel.yaml\n```\n\n### Step 2: Deploy Identity-Aware Proxy on Applications\n\nEnable IAP on backend services to enforce identity verification before granting access.\n\n```bash\n# Create OAuth consent screen\ngcloud iap oauth-brands create \\\n  --application_title=\"Corporate Applications\" \\\n  --support_email=security@company.com\n\n# Create OAuth client for IAP\ngcloud iap oauth-clients create BRAND_NAME \\\n  --display_name=\"BeyondCorp IAP Client\"\n\n# Enable IAP on a backend service (GCE\u002FGKE behind HTTPS LB)\ngcloud compute backend-services update internal-app-backend \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# Enable IAP on App Engine\ngcloud iap web enable \\\n  --resource-type=app-engine \\\n  --oauth2-client-id=CLIENT_ID \\\n  --oauth2-client-secret=CLIENT_SECRET\n\n# Enable IAP on Cloud Run service\ngcloud run services add-iam-policy-binding internal-api \\\n  --member=\"serviceAccount:service-PROJECT_NUM@gcp-sa-iap.iam.gserviceaccount.com\" \\\n  --role=\"roles\u002Frun.invoker\" \\\n  --region=us-central1\n```\n\n### Step 3: Configure IAM Bindings with Access Level Conditions\n\nBind IAP access to specific groups with access level requirements.\n\n```bash\n# Grant access to engineering group with corporate device requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:engineering@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fcorporate-managed,title=Require Corporate Device\"\n\n# Grant access to contractors with high-trust requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:contractors@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fhigh-trust,title=Require High Trust\"\n\n# Configure re-authentication settings (session duration)\ngcloud iap settings set --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=internal-app-backend \\\n  --reauth-method=LOGIN \\\n  --max-session-duration=3600s\n```\n\n### Step 4: Deploy Endpoint Verification on Corporate Devices\n\nRoll out Chrome Enterprise Endpoint Verification for device posture collection.\n\n```bash\n# Deploy Endpoint Verification via Chrome policy (managed browsers)\n# In Google Admin Console > Devices > Chrome > Apps & extensions\n# Force-install: Endpoint Verification extension ID: callobklhcbilhphinckomhgkigmfocg\n\n# Verify device inventory in Admin SDK\ngcloud endpoint-verification list-endpoints \\\n  --filter=\"deviceType=CHROME_BROWSER\" \\\n  --format=\"table(deviceId, osVersion, isCompliant, encryptionStatus)\"\n\n# Create device trust connector for third-party EDR signals\ngcloud beyondcorp app connections create crowdstrike-connector \\\n  --project=PROJECT_ID \\\n  --location=global \\\n  --application-endpoint=host=crowdstrike-api.internal:443,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fconnector-1\n\n# List enrolled devices and their compliance status\ngcloud alpha devices list --format=\"table(name,deviceType,complianceState)\"\n```\n\n### Step 5: Implement BeyondCorp Enterprise Threat Protection\n\nEnable URL filtering, malware scanning, and DLP for Chrome Enterprise users.\n\n```bash\n# Configure Chrome Enterprise Premium threat protection rules\n# In Google Admin Console > Security > Chrome Enterprise Premium\n\n# Create a BeyondCorp Enterprise connector for on-prem apps\ngcloud beyondcorp app connectors create onprem-connector \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --display-name=\"On-Premises App Connector\"\n\ngcloud beyondcorp app connections create hr-portal \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --application-endpoint=host=hr.internal.company.com,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fonprem-connector\n\n# Enable security investigation tool for access anomaly detection\ngcloud logging read '\n  resource.type=\"iap_tunnel\"\n  jsonPayload.decision=\"DENY\"\n  timestamp >= \"2026-02-22T00:00:00Z\"\n' --project=PROJECT_ID --format=json --limit=100\n```\n\n### Step 6: Monitor and Audit BeyondCorp Access Decisions\n\nSet up comprehensive logging and alerting for zero trust policy enforcement.\n\n```bash\n# Create a log sink for IAP access decisions\ngcloud logging sinks create iap-access-audit \\\n  --destination=bigquery.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Fdatasets\u002Fbeyondcorp_audit \\\n  --log-filter='resource.type=\"iap_tunnel\" OR resource.type=\"gce_backend_service\"'\n\n# Query BigQuery for access pattern analysis\nbq query --use_legacy_sql=false '\nSELECT\n  protopayload_auditlog.authenticationInfo.principalEmail AS user,\n  resource.labels.backend_service_name AS application,\n  JSON_EXTRACT_SCALAR(protopayload_auditlog.requestMetadata.callerSuppliedUserAgent, \"$\") AS device,\n  protopayload_auditlog.status.code AS decision_code,\n  COUNT(*) AS request_count\nFROM `PROJECT_ID.beyondcorp_audit.cloudaudit_googleapis_com_data_access`\nWHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 24 HOUR)\nGROUP BY user, application, device, decision_code\nORDER BY request_count DESC\nLIMIT 50\n'\n\n# Create an alert policy for repeated access denials\ngcloud alpha monitoring policies create \\\n  --display-name=\"BeyondCorp Repeated Access Denials\" \\\n  --condition-display-name=\"High denial rate\" \\\n  --condition-filter='resource.type=\"iap_tunnel\" AND jsonPayload.decision=\"DENY\"' \\\n  --condition-threshold-value=10 \\\n  --condition-threshold-duration=300s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| BeyondCorp | Google's zero trust security framework that shifts access controls from network perimeter to per-request identity and device verification |\n| Identity-Aware Proxy (IAP) | Google Cloud service that intercepts HTTP requests and verifies user identity and device context before forwarding to backend applications |\n| Access Context Manager | GCP service that defines fine-grained attribute-based access control policies using access levels and service perimeters |\n| Endpoint Verification | Chrome Enterprise extension that collects device attributes (OS version, encryption, screen lock) for access level evaluation |\n| Access Levels | Named conditions in Access Context Manager that define minimum requirements (device posture, IP range, geography) for resource access |\n| Chrome Enterprise Premium | Google's commercial BeyondCorp offering providing threat protection, URL filtering, DLP, and continuous access evaluation |\n\n## Tools & Systems\n\n- **Google Cloud IAP**: Identity-aware reverse proxy enforcing per-request authentication and authorization for GCP-hosted applications\n- **Access Context Manager**: Policy engine defining access levels based on device attributes, IP ranges, and geographic locations\n- **Chrome Enterprise Premium**: Extended BeyondCorp capabilities including real-time threat protection and data loss prevention\n- **Endpoint Verification**: Device posture collection agent deployed as Chrome extension to all corporate endpoints\n- **BeyondCorp Enterprise Connectors**: Secure tunnel connectors enabling IAP protection for on-premises applications\n- **Cloud Audit Logs**: Immutable log records of all IAP access decisions for compliance and forensic analysis\n\n## Common Scenarios\n\n### Scenario: Migrating 50+ Internal Applications from VPN to BeyondCorp\n\n**Context**: A technology company with 3,000 employees uses Cisco AnyConnect VPN for accessing internal applications. The VPN introduces latency, creates a single point of failure, and grants excessive network access after authentication.\n\n**Approach**:\n1. Inventory all 50+ applications and categorize by hosting (GCP, on-prem, SaaS) and protocol (HTTPS, TCP, SSH)\n2. Deploy Endpoint Verification to all corporate devices and establish baseline device posture data over 2 weeks\n3. Create access levels in Access Context Manager: corporate-managed, contractor-device, high-trust\n4. Enable IAP on GCP-hosted HTTPS applications first (App Engine, Cloud Run, GKE services)\n5. Deploy BeyondCorp Enterprise connectors for on-premises applications\n6. Migrate users in 3 phases: IT\u002FEngineering (week 1-2), General staff (week 3-4), Executives\u002FFinance (week 5-6)\n7. Configure re-authentication policies: 8 hours for general apps, 1 hour for financial systems\n8. Set up BigQuery audit pipeline for continuous monitoring and anomaly detection\n9. Decommission VPN after 30-day parallel operation period\n\n**Pitfalls**: Some legacy applications may not support HTTPS proxying and require TCP tunnel mode. Device enrollment takes time; plan a 2-week onboarding period before enforcing device posture requirements. Break-glass accounts with bypassed access levels must be created and tested for identity provider outages.\n\n## Output Format\n\n```\nBeyondCorp Zero Trust Implementation Report\n==================================================\nOrganization: TechCorp Inc.\nImplementation Date: 2026-02-23\nMigration Phase: Phase 2 of 3\n\nACCESS ARCHITECTURE:\n  Identity Provider: Google Workspace\n  Access Proxy: Google Cloud IAP\n  Device Management: Chrome Enterprise + Endpoint Verification\n  Threat Protection: Chrome Enterprise Premium\n  On-Prem Connector: BeyondCorp Enterprise Connector (3 instances)\n\nACCESS LEVEL COVERAGE:\n  Access Level: corporate-managed\n    Devices enrolled:              2,847 \u002F 3,000 (94.9%)\n    Compliant devices:             2,712 \u002F 2,847 (95.3%)\n  Access Level: high-trust\n    Devices enrolled:              312 \u002F 350 (89.1%)\n    Compliant devices:             298 \u002F 312 (95.5%)\n\nAPPLICATION MIGRATION:\n  GCP HTTPS apps (IAP-protected):  32 \u002F 35 (91.4%)\n  On-prem apps (via connector):    12 \u002F 15 (80.0%)\n  SaaS apps (via SAML\u002FOIDC):       8 \u002F 8 (100%)\n  Total migrated:                  52 \u002F 58 (89.7%)\n\nSECURITY METRICS (last 30 days):\n  Total access requests:           1,247,832\n  Denied by IAP policy:            3,412 (0.27%)\n  Denied by access level:          1,208 (0.10%)\n  Re-authentication triggered:     45,219\n  Anomalous access patterns:       12 (investigated)\n  VPN-related incidents (before):  8\u002Fmonth\n  BeyondCorp incidents (after):    1\u002Fmonth\n\nVPN DECOMMISSION STATUS:\n  Parallel operation remaining:    14 days\n  Users still on VPN:              148 (5%)\n  Planned decommission:            2026-03-15\n```\n","# Implementing BeyondCorp Zero Trust Access Model\n\n## When to Use\n\n- When replacing traditional VPN infrastructure with identity-based application access\n- When migrating to Google Cloud and requiring zero trust access for internal applications\n- When implementing device trust verification as a prerequisite for resource access\n- When needing context-aware access policies based on user identity, device posture, and location\n- When securing access for remote and hybrid workforce without network-level trust\n\n**Do not use** when applications require raw network-level access (e.g., UDP-based protocols not supported by IAP), for consumer-facing public applications, or when the organization lacks an identity provider with MFA capabilities.\n\n## Prerequisites\n\n- Google Cloud organization with Cloud Identity or Google Workspace\n- Identity-Aware Proxy (IAP) API enabled on the GCP project\n- Chrome Enterprise Premium license for endpoint verification\n- Applications deployed behind a Google Cloud Load Balancer or on App Engine\u002FCloud Run\n- Endpoint Verification extension deployed on all corporate devices\n- Access Context Manager API enabled\n\n## Workflow\n\n### Step 1: Configure Access Context Manager with Access Levels\n\nDefine access levels that represent trust tiers based on device and user attributes.\n\n```bash\n# Enable required APIs\ngcloud services enable iap.googleapis.com\ngcloud services enable accesscontextmanager.googleapis.com\ngcloud services enable beyondcorp.googleapis.com\n\n# Create an access policy (organization level)\ngcloud access-context-manager policies create \\\n  --organization=ORG_ID \\\n  --title=\"BeyondCorp Enterprise Policy\"\n\n# Create a basic access level for corporate managed devices\ncat > corporate-device-level.yaml \u003C\u003C 'EOF'\n- devicePolicy:\n    allowedEncryptionStatuses:\n      - ENCRYPTED\n    osConstraints:\n      - osType: DESKTOP_CHROME_OS\n        minimumVersion: \"13816.0.0\"\n      - osType: DESKTOP_WINDOWS\n        minimumVersion: \"10.0.19045\"\n      - osType: DESKTOP_MAC\n        minimumVersion: \"13.0.0\"\n    requireScreenlock: true\n    requireAdminApproval: true\n  regions:\n    - US\n    - GB\n    - DE\nEOF\n\ngcloud access-context-manager levels create corporate-managed \\\n  --policy=POLICY_ID \\\n  --title=\"Corporate Managed Device\" \\\n  --basic-level-spec=corporate-device-level.yaml\n\n# Create a custom access level using CEL expressions\ngcloud access-context-manager levels create high-trust \\\n  --policy=POLICY_ID \\\n  --title=\"High Trust Level\" \\\n  --custom-level-spec=high-trust-cel.yaml\n```\n\n### Step 2: Deploy Identity-Aware Proxy on Applications\n\nEnable IAP on backend services to enforce identity verification before granting access.\n\n```bash\n# Create OAuth consent screen\ngcloud iap oauth-brands create \\\n  --application_title=\"Corporate Applications\" \\\n  --support_email=security@company.com\n\n# Create OAuth client for IAP\ngcloud iap oauth-clients create BRAND_NAME \\\n  --display_name=\"BeyondCorp IAP Client\"\n\n# Enable IAP on a backend service (GCE\u002FGKE behind HTTPS LB)\ngcloud compute backend-services update internal-app-backend \\\n  --iap=enabled,oauth2-client-id=CLIENT_ID,oauth2-client-secret=CLIENT_SECRET \\\n  --global\n\n# Enable IAP on App Engine\ngcloud iap web enable \\\n  --resource-type=app-engine \\\n  --oauth2-client-id=CLIENT_ID \\\n  --oauth2-client-secret=CLIENT_SECRET\n\n# Enable IAP on Cloud Run service\ngcloud run services add-iam-policy-binding internal-api \\\n  --member=\"serviceAccount:service-PROJECT_NUM@gcp-sa-iap.iam.gserviceaccount.com\" \\\n  --role=\"roles\u002Frun.invoker\" \\\n  --region=us-central1\n```\n\n### Step 3: Configure IAM Bindings with Access Level Conditions\n\nBind IAP access to specific groups with access level requirements.\n\n```bash\n# Grant access to engineering group with corporate device requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:engineering@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fcorporate-managed,title=Require Corporate Device\"\n\n# Grant access to contractors with high-trust requirement\ngcloud iap web add-iam-policy-binding \\\n  --resource-type=backend-services \\\n  --service=internal-app-backend \\\n  --member=\"group:contractors@company.com\" \\\n  --role=\"roles\u002Fiap.httpsResourceAccessor\" \\\n  --condition=\"expression=accessPolicies\u002FPOLICY_ID\u002FaccessLevels\u002Fhigh-trust,title=Require High Trust\"\n\n# Configure re-authentication settings (session duration)\ngcloud iap settings set --project=PROJECT_ID \\\n  --resource-type=compute \\\n  --service=internal-app-backend \\\n  --reauth-method=LOGIN \\\n  --max-session-duration=3600s\n```\n\n### Step 4: Deploy Endpoint Verification on Corporate Devices\n\nRoll out Chrome Enterprise Endpoint Verification for device posture collection.\n\n```bash\n# Deploy Endpoint Verification via Chrome policy (managed browsers)\n# In Google Admin Console > Devices > Chrome > Apps & extensions\n# Force-install: Endpoint Verification extension ID: callobklhcbilhphinckomhgkigmfocg\n\n# Verify device inventory in Admin SDK\ngcloud endpoint-verification list-endpoints \\\n  --filter=\"deviceType=CHROME_BROWSER\" \\\n  --format=\"table(deviceId, osVersion, isCompliant, encryptionStatus)\"\n\n# Create device trust connector for third-party EDR signals\ngcloud beyondcorp app connections create crowdstrike-connector \\\n  --project=PROJECT_ID \\\n  --location=global \\\n  --application-endpoint=host=crowdstrike-api.internal:443,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fconnector-1\n\n# List enrolled devices and their compliance status\ngcloud alpha devices list --format=\"table(name,deviceType,complianceState)\"\n```\n\n### Step 5: Implement BeyondCorp Enterprise Threat Protection\n\nEnable URL filtering, malware scanning, and DLP for Chrome Enterprise users.\n\n```bash\n# Configure Chrome Enterprise Premium threat protection rules\n# In Google Admin Console > Security > Chrome Enterprise Premium\n\n# Create a BeyondCorp Enterprise connector for on-prem apps\ngcloud beyondcorp app connectors create onprem-connector \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --display-name=\"On-Premises App Connector\"\n\ngcloud beyondcorp app connections create hr-portal \\\n  --project=PROJECT_ID \\\n  --location=us-central1 \\\n  --application-endpoint=host=hr.internal.company.com,port=443 \\\n  --type=TCP_PROXY_TUNNEL \\\n  --connectors=projects\u002FPROJECT_ID\u002Flocations\u002Fus-central1\u002Fconnectors\u002Fonprem-connector\n\n# Enable security investigation tool for access anomaly detection\ngcloud logging read '\n  resource.type=\"iap_tunnel\"\n  jsonPayload.decision=\"DENY\"\n  timestamp >= \"2026-02-22T00:00:00Z\"\n' --project=PROJECT_ID --format=json --limit=100\n```\n\n### Step 6: Monitor and Audit BeyondCorp Access Decisions\n\nSet up comprehensive logging and alerting for zero trust policy enforcement.\n\n```bash\n# Create a log sink for IAP access decisions\ngcloud logging sinks create iap-access-audit \\\n  --destination=bigquery.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Fdatasets\u002Fbeyondcorp_audit \\\n  --log-filter='resource.type=\"iap_tunnel\" OR resource.type=\"gce_backend_service\"'\n\n# Query BigQuery for access pattern analysis\nbq query --use_legacy_sql=false '\nSELECT\n  protopayload_auditlog.authenticationInfo.principalEmail AS user,\n  resource.labels.backend_service_name AS application,\n  JSON_EXTRACT_SCALAR(protopayload_auditlog.requestMetadata.callerSuppliedUserAgent, \"$\") AS device,\n  protopayload_auditlog.status.code AS decision_code,\n  COUNT(*) AS request_count\nFROM `PROJECT_ID.beyondcorp_audit.cloudaudit_googleapis_com_data_access`\nWHERE timestamp > TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 24 HOUR)\nGROUP BY user, application, device, decision_code\nORDER BY request_count DESC\nLIMIT 50\n'\n\n# Create an alert policy for repeated access denials\ngcloud alpha monitoring policies create \\\n  --display-name=\"BeyondCorp Repeated Access Denials\" \\\n  --condition-display-name=\"High denial rate\" \\\n  --condition-filter='resource.type=\"iap_tunnel\" AND jsonPayload.decision=\"DENY\"' \\\n  --condition-threshold-value=10 \\\n  --condition-threshold-duration=300s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| BeyondCorp | Google's zero trust security framework that shifts access controls from network perimeter to per-request identity and device verification |\n| Identity-Aware Proxy (IAP) | Google Cloud service that intercepts HTTP requests and verifies user identity and device context before forwarding to backend applications |\n| Access Context Manager | GCP service that defines fine-grained attribute-based access control policies using access levels and service perimeters |\n| Endpoint Verification | Chrome Enterprise extension that collects device attributes (OS version, encryption, screen lock) for access level evaluation |\n| Access Levels | Named conditions in Access Context Manager that define minimum requirements (device posture, IP range, geography) for resource access |\n| Chrome Enterprise Premium | Google's commercial BeyondCorp offering providing threat protection, URL filtering, DLP, and continuous access evaluation |\n\n## Tools & Systems\n\n- **Google Cloud IAP**: Identity-aware reverse proxy enforcing per-request authentication and authorization for GCP-hosted applications\n- **Access Context Manager**: Policy engine defining access levels based on device attributes, IP ranges, and geographic locations\n- **Chrome Enterprise Premium**: Extended BeyondCorp capabilities including real-time threat protection and data loss prevention\n- **Endpoint Verification**: Device posture collection agent deployed as Chrome extension to all corporate endpoints\n- **BeyondCorp Enterprise Connectors**: Secure tunnel connectors enabling IAP protection for on-premises applications\n- **Cloud Audit Logs**: Immutable log records of all IAP access decisions for compliance and forensic analysis\n\n## Common Scenarios\n\n### Scenario: Migrating 50+ Internal Applications from VPN to BeyondCorp\n\n**Context**: A technology company with 3,000 employees uses Cisco AnyConnect VPN for accessing internal applications. The VPN introduces latency, creates a single point of failure, and grants excessive network access after authentication.\n\n**Approach**:\n1. Inventory all 50+ applications and categorize by hosting (GCP, on-prem, SaaS) and protocol (HTTPS, TCP, SSH)\n2. Deploy Endpoint Verification to all corporate devices and establish baseline device posture data over 2 weeks\n3. Create access levels in Access Context Manager: corporate-managed, contractor-device, high-trust\n4. Enable IAP on GCP-hosted HTTPS applications first (App Engine, Cloud Run, GKE services)\n5. Deploy BeyondCorp Enterprise connectors for on-premises applications\n6. Migrate users in 3 phases: IT\u002FEngineering (week 1-2), General staff (week 3-4), Executives\u002FFinance (week 5-6)\n7. Configure re-authentication policies: 8 hours for general apps, 1 hour for financial systems\n8. Set up BigQuery audit pipeline for continuous monitoring and anomaly detection\n9. Decommission VPN after 30-day parallel operation period\n\n**Pitfalls**: Some legacy applications may not support HTTPS proxying and require TCP tunnel mode. Device enrollment takes time; plan a 2-week onboarding period before enforcing device posture requirements. Break-glass accounts with bypassed access levels must be created and tested for identity provider outages.\n\n## Output Format\n\n```\nBeyondCorp Zero Trust Implementation Report\n==================================================\nOrganization: TechCorp Inc.\nImplementation Date: 2026-02-23\nMigration Phase: Phase 2 of 3\n\nACCESS ARCHITECTURE:\n  Identity Provider: Google Workspace\n  Access Proxy: Google Cloud IAP\n  Device Management: Chrome Enterprise + Endpoint Verification\n  Threat Protection: Chrome Enterprise Premium\n  On-Prem Connector: BeyondCorp Enterprise Connector (3 instances)\n\nACCESS LEVEL COVERAGE:\n  Access Level: corporate-managed\n    Devices enrolled:              2,847 \u002F 3,000 (94.9%)\n    Compliant devices:             2,712 \u002F 2,847 (95.3%)\n  Access Level: high-trust\n    Devices enrolled:              312 \u002F 350 (89.1%)\n    Compliant devices:             298 \u002F 312 (95.5%)\n\nAPPLICATION MIGRATION:\n  GCP HTTPS apps (IAP-protected):  32 \u002F 35 (91.4%)\n  On-prem apps (via connector):    12 \u002F 15 (80.0%)\n  SaaS apps (via SAML\u002FOIDC):       8 \u002F 8 (100%)\n  Total migrated:                  52 \u002F 58 (89.7%)\n\nSECURITY METRICS (last 30 days):\n  Total access requests:           1,247,832\n  Denied by IAP policy:            3,412 (0.27%)\n  Denied by access level:          1,208 (0.10%)\n  Re-authentication triggered:     45,219\n  Anomalous access patterns:       12 (investigated)\n  VPN-related incidents (before):  8\u002Fmonth\n  BeyondCorp incidents (after):    1\u002Fmonth\n\nVPN DECOMMISSION STATUS:\n  Parallel operation remaining:    14 days\n  Users still on VPN:              148 (5%)\n  Planned decommission:            2026-03-15\n```\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"domain":36,"maxTurns":54,"nist_csf":55,"subdomain":60,"description":7},[28,31,45,27,46,30,47],"google-cloud","identity-aware-proxy","access-context-manager",[],"sonnet",[51,34,52,53],"Read","Glob","Grep",20,[56,57,58,59],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fzerotrust\u002Fbeyondcorpmodel\u002Fexploit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-beyondcorpmodel-exploit",{"tool":74,"command":75},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-beyondcorpmodel-exploit",{"tool":77,"command":78},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill zerotrust-beyondcorpmodel-exploit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fbeyondcorpmodel\u002Fexploit\u002FSKILL.md",true,[82],{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"index.json","REFERENCE","参考文档",710,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fzerotrust\u002Fbeyondcorpmodel\u002Fexploit\u002Findex.json",[89,114,134,155,177,193],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,36,113],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[19,96,121,99,122,123,124,36,34,125,126,127,128,129,101,130,131,26,132,133],"services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[141,142,143,144,145,146,36,34,147,125,148,149,101,26,150,151,152,153,154,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[97,162,163,164,165,166,167,102,168,36,113,169,170,171,172,173,174,175,176,101],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[184,185,97,186,164,166,187,102,188,168,36,113,125,189,190,191,192,176,101,103],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":199,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[200,97,164,201,187,102,202,203,36,113,204,205,206,207,208,209,101,103,210,211],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]