Zero trust : nouvelle approche de la sécurité réseau

Ce que vous saurez faire

1. Principes Zero Trust
2. mTLS entre services
3. OIDC + MFA obligatoire
4. Policy as Code avec OPA

Étape 1 — Principes

Classique: firewall périmétrique (confiance interne)
Zero Trust: AUCUN réseau n'est digne de confiance
Chaque requête: authentifiée, autorisée, chiffrée

ZTNA: Zero Trust Network Access
MFA: Multi-Factor Authentication
mTLS: mutual TLS (certs client + serveur)
PDP/PEP: Policy Decision/Enforcement Point

Étape 2 — Identité forte OIDC + MFA

# Keycloak
realm: itskillscenter
clientPolicies:
  - name: ensure-mfa
    condition: { authenticationFlowBinding: browser }
    executor: { type: force-second-factor, config: { minimum-level: 2 } }
passwordPolicy: "length(12) and upperCase(1) and digits(2)"
sessionIdleTimeout: PT15M
offlineSessionIdleTimeout: PT24H

Étape 3 — mTLS service-to-service

openssl genrsa -out ca.key 4096
openssl req -new -x509 -key ca.key -out ca.crt -days 365 \
  -subj "/CN=ItsSkillsCenter Internal CA"

openssl genrsa -out api.key 4096
openssl req -new -key api.key -out api.csr -subj "/CN=api.internal"
openssl x509 -req -in api.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out api.crt

ssl_client_certificate /etc/nginx/certs/ca.crt;
ssl_verify_client on;

Étape 4 — Service Mesh Istio

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: itsc-prod
spec:
  mtls:
    mode: STRICT
---
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-allowed-callers
spec:
  selector: { matchLabels: { app: api } }
  action: ALLOW
  rules:
    - from:
        - source:
            principals: ["cluster.local/ns/itsc-prod/sa/frontend"]
      to:
        - operation: { methods: ["GET","POST"], paths: ["/v1/*"] }

Étape 5 — Policy as Code avec OPA

package http.authz

default allow := false

allow {
  input.method == "GET"
  input.path == ["v1", "clients", _]
  input.user.role == "admin"
}

allow {
  input.method == "POST"
  input.path == ["v1", "factures"]
  input.user.role == "commercial"
  input.user.region == input.body.region
}

Étape 6 — ZTNA avec Tailscale/Cloudflare

{
  "acls": [
    { "action":"accept", "src":["group:devs"], "dst":["tag:prod-db:5432"] },
    { "action":"accept", "src":["group:sre"], "dst":["*:*"] }
  ],
  "groups": {
    "group:devs": ["aminata@sn","ousmane@sn"]
  },
  "tagOwners": {
    "tag:prod-db": ["group:sre"]
  }
}

Étape 7 — Workload Identity K8s

spec:
  serviceAccountName: api
  containers:
    - name: api
      volumeMounts:
        - name: oidc-token
          mountPath: /var/run/secrets/tokens
  volumes:
    - name: oidc-token
      projected:
        sources:
          - serviceAccountToken:
              path: aws-token
              expirationSeconds: 3600
              audience: sts.amazonaws.com

Étape 8 — Chiffrement au repos

CREATE EXTENSION IF NOT EXISTS pgcrypto;

INSERT INTO clients(nom, email_chiffre) VALUES
  ('SARL', pgp_sym_encrypt('contact@sarl.sn', current_setting('app.key')));

SELECT nom, pgp_sym_decrypt(email_chiffre, current_setting('app.key'))
FROM clients WHERE id = 42;

Étape 9 — Journalisation chaque requête

{
  "ts": "2026-04-22T10:15:03Z",
  "user": "aminata@itsc.sn",
  "service": "api",
  "method": "PATCH",
  "path": "/v1/factures/42",
  "ip": "10.0.3.14",
  "device_id": "mac-amina-01",
  "auth": { "mfa": true, "mfa_age_s": 320, "token_type": "oidc" },
  "decision": "allow",
  "policy": "billing.editor",
  "latency_ms": 118,
  "status": 200
}

Étape 10 — Migration 6 étapes

1. Inventaire : services, flux, identités (machines + humains)
2. MFA obligatoire sur toutes identités humaines
3. Remplacer VPN par ZTNA (Tailscale, Cloudflare, Teleport)
4. mTLS sur services internes critiques
5. Policies par rôle et ressource (OPA, Kyverno)
6. Journalisation centralisée + détection anomalies

Checklist

✓ SSO + MFA forcé partout
✓ mTLS entre services backend
✓ Policies OPA en CI
✓ ZTNA remplace VPN
✓ Short-lived tokens (OIDC)
✓ Chiffrement au repos (colonnes PII)
✓ Journalisation immuable
✓ Tests d'intrusion annuels