HACKING PROJECT · cloud · Advanced
Dynamic Security Policy Enforcer (Zero Trust)
Implement a NIST 800-207 Zero Trust policy engine that makes continuous, context-aware, risk-adaptive access decisions.
Perimeter-based access models grant implicit trust once inside the network, enabling lateral movement after any breach. Static role assignments ignore real-time context — device posture, location, behavior, and risk — leaving access decisions blind to changing threat conditions. Most teams struggle to operationalize Zero Trust beyond slideware.
**What you'll build**
Build a policy decision/enforcement point (PDP/PEP) implementing continuous, context-aware authorization per NIST 800-207: every request is evaluated against identity, device posture, resource sensitivity, and a dynamic risk score, with policy expressed as code (OPA/Rego). Integrate signals from IdP, EDR, and behavior analytics to allow, step-up, or deny in real time, with full decision logging.
**Objective** — Implement a NIST 800-207 Zero Trust policy engine that makes continuous, context-aware, risk-adaptive access decisions.
**Expected outcome** — A working PDP/PEP with policy-as-code, integrated risk signals, step-up/deny enforcement, and an auditable decision log.
**Difficulty** — Advanced — requires policy-engine design, multi-signal integration, and real-time risk-adaptive authorization.
**Primary category** — IAM; Secondary = Cloud Security, Zero Trust Architecture, DevSecOps
**Security domains** — Primary = Cloud Security; Secondary = Blue Team, IAM, DevSecOps, GRC
**Technical focus** — Zero Trust (NIST 800-207), policy-as-code (OPA/Rego), attribute-based access control, continuous authorization, device posture, risk scoring, PDP/PEP architecture, identity federation, decision logging
**Core technologies** — Languages: Go, Python, Rego; Frameworks/Libraries: Open Policy Agent, SPIFFE/SPIRE, Envoy (ext_authz), OAuth2/OIDC; Security Tools: Keycloak/IdP, EDR signal APIs; Cloud/Infra: Kubernetes, service mesh (Istio), AWS/Azure IAM; AI/Data: risk-scoring model, UEBA features; Databases: Redis (session/risk state), PostgreSQL (policy/audit)
**Where it's valued** — Enterprise IT, cloud-native SaaS, finance, government, healthcare, any Zero-Trust-adopting organization
**Careers it builds toward** — Zero Trust / Cloud Security Engineer, IAM Engineer, Security Architect, DevSecOps Engineer, Platform Security Engineer
**Framework alignment**
• MITRE ATT&CK: mitigates Lateral Movement (T1021), Valid Accounts (T1078), Use Alternate Authentication Material (T1550), Account Manipulation (T1098)
• NIST CSF 2.0: Protect (PR.AA, PR.IR), Identify (ID.AM), Detect (DE.CM), Govern (GV.PO); aligns to NIST 800-207
• OWASP: A01 Broken Access Control, A07 Auth Failures; API1 BOLA, API5 Broken Function Level Authorization
• CIS Controls v8: 6 Access Control Management, 3 Data Protection, 13 Network Monitoring, 4 Secure Configuration