zero-trust-architecture
Apply zero trust principles — never trust, always verify, least privilege, assume breach — to access design and architecture. Use when modernizing remote access, segmenting access to applications, or reducing implicit network trust.
- License 许可
- MIT
- 最近更新
- 2026-07-22
- Stars
- ★ 7
- Forks
- 1
01 前言 Front Matter
- name
- zero-trust-architecture
- description
- Apply zero trust principles — never trust, always verify, least privilege, assume breach — to access design and architecture. Use when modernizing remote access, segmenting access to applications, or reducing implicit network trust.
03 SKILL.md 正文
Zero Trust Architecture
Overview
Zero trust replaces implicit trust based on network location with continuous verification of identity, device, and context for each access request.
When to Use
- Replacing flat VPN access models
- Designing application-level access controls
- Reducing lateral movement risk
- Hybrid and multi-cloud access strategies
Core Practices
- Authenticate and authorize every request with strong identity
- Factor device health and context into access decisions where feasible
- Limit lateral movement with micro-segmentation / app-level gateways
- Prefer short-lived credentials and continuous evaluation
- Log access decisions for detection and forensics
- Migrate gradually from implicit trust zones
Principles
- Zero trust is a strategy, not a single product SKU
- Identity becomes the primary control plane
- “Inside the network” is not a sufficient trust signal
- Usability failures drive shadow workarounds
Verification
- [ ] Sensitive apps are not reachable by network location alone
- [ ] Access policies encode least privilege
- [ ] Access logs support investigation
04 同仓库更多 Skills
compliance-monitoring
Design compliance monitoring and testing programs that verify controls work in practice and surface issues before regulators do. Use when building monitoring plans, compliance testing, or continuous control monitoring.
complaints-handling
Operate complaints-handling processes that meet regulatory standards — logging, timely resolution, root-cause analysis, and fair outcomes. Use when designing or improving regulated complaints frameworks or analyzing complaint themes for conduct risk.
aml-kyc-basics
Apply AML/KYC fundamentals — customer due diligence, monitoring, suspicious activity escalation, and recordkeeping — for financial crime compliance. Use when designing onboarding controls, transaction monitoring concepts, or AML program components in financial services.
ai-model-compliance
Apply compliance controls to AI and automated decision systems — transparency, fairness, human oversight, documentation, and regulatory alignment. Use when deploying AI in regulated processes (credit, fraud, customer decisions) or responding to AI governance expectations.
data-quality-management
Manage data quality end-to-end — dimensions, rules, remediation, and prevention — beyond one-off cleaning scripts. Use when building sustained data quality programs or fixing systemic accuracy, completeness, or consistency problems.
data-lineage
Capture and use data lineage — where data comes from, how it transforms, and what depends on it — for impact analysis, debugging, and trust. Use when tracing metric origins, assessing change impact, or diagnosing broken pipelines.