Source: https://www.nist.gov/news-events/news/2025/06/nist-offers-19-ways-build-zero-trust-architecture s The shift towards cloud-native IT infrastructure, which is manifested in the use of containers, Kubernetes orchestration, and Kubernetes serverless, has led to the need to abandon conventional approaches to cybersecurity. In the past, the dominant castle-and-moat theory allowed any entity authenticated at the network perimeter to freely move within the infrastructure. However, current dynamic and distributed cloud-native solutions require a different approach, one which does not assume that the network perimeter is an impenetrable zone. Instead, Zero Trust Architecture (ZTA) was introduced, which requires verifying each request as if it comes from an open network. The security measures that need to be implemented in ZTA to secure the distributed microservices include continuous identity verification and micro-segmentation. Continuous identity verification is the cornerstone of the Zero Trust approach to cybersecurity in the cloud-native context. Unlike traditional single-factor authentication, which takes place once at the beginning of a user’s session, it involves constant checks throughout the interaction with the system. It is especially useful within the context of distributed microservices, where the traffic can originate from any part of the infrastructure, either within the cluster or from external clients. Due to the ephemeral nature of services and the frequent changing of IPs, the location of the traffic source cannot be used for authentication. Instead, the workload’s identity, which is based on cryptographic certificates and tokens, is used to determine the access privileges. Moreover, the verification process is not static and is subject to change depending on the circumstances. For example, if there is a suspicion that a certain service has been compromised, additional steps can be taken to re-authenticate. This capability makes the continuous verification process highly contextual, as it considers risks in real-time and responds accordingly. It is important to note that, when applied in conjunction with distributed microservices, the discussed practice allows for securing each element of the application. Another critical aspect of applying ZTA in the context of distributed microservices is micro-segmentation. It is a method of securing network assets by constantly adjusting the network segmentation in order to reduce the number of lateral movement opportunities within the infrastructure. Traditional macro-segmentation practices, which are based on VLANs, only divide the network into large segments. Once an entity has been authenticated within a certain segment, it may access all other elements that belong to it. However, the perimeter defense approach is incompatible with the distributed nature of cloud-native applications, as their services are subject to frequent changes. Micro-segmentation is especially useful within the context of distributed microservices, as it allows for creating dynamic security policies that are applied directly to workloads. With the help of software-defined network switches and service meshes, such as Istio and Linkerd, network traffic can be secured at the level of individual pods or API requests. In addition to continuous identification of a user in real-time, the concept of micro-segmentation allows building ZTA around distributed microservices. It makes it possible to design fine-grained policies that define what workloads can communicate with each other and what actions they can perform. As soon as a task is performed from one application to another, it becomes possible to verify its source and target. A request should contain a token that will identify the caller and a policy that defines the permissions of the caller. The way of cybersecurity discussed above guarantees that the implementation of distributed applications operates according to the zero-trust principle of denying any traffic. Furthermore, using the mentioned concepts and instruments in every phase of the software development life cycle allows the creation of the appropriate controls and meeting the requirements of NIST, HIPAA, SOC 2, and PCI-DSS. To summarize, the shift towards cloud-native IT infrastructure, which is based on distributed microservices, requires an alternative cybersecurity paradigm. Zero Trust Architecture, which is manifested in continuous identity verification and micro-segmentation, is the most suitable concept in this regard. In combination with distributed microservices, it allows for establishing a robust system of security policies that are based on verified cryptographic tokens and prevent lateral attacks. The continuous nature of this approach makes it possible to adapt to the changing infrastructure and respond to emerging threats in real time.
Sources
https://www.wiz.io/academy/compliance/zero-trust-architecture https://orca.security/glossary/zero-trust-security/