Traditional computer networks often trust devices once they are inside the network.
For example, if a device connects to an office Wi-Fi or VPN, it may automatically gain access to internal systems.
This can be risky because if an attacker gains access to the network, they may be able to move between systems easily.
Zero Trust Architecture (ZTA) removes this assumption.
Instead of trusting devices automatically, every user and device must be verified before access is granted.
In this lab you will build a simple environment that demonstrates how Zero Trust security works.
This guide is written so that someone with little or no prior experience can follow it step-by-step.
Before starting this lab, make sure you have:
After completing this lab you will be able to:
The diagram below shows the architecture used in this lab.
graph TD
User[Security Analyst]
User -->|GitHub Login| Tailscale[Tailscale Identity Network]
Tailscale --> Server[Ubuntu Server]
Server --> Service[Internal Web Service :8080]
Server --> Logs[Authentication Logs]
Logs --> GenAI[Generative AI Analysis]
GenAI --> Analyst[Security Insight]
In this architecture:
Traditional networks rely on IP-based trust, where devices inside the network are automatically trusted.
Zero Trust systems verify identity instead of network location.
In this step we will use Tailscale to create a secure identity-based network.
If you are using Ubuntu on WSL:
Run the following command:
curl -fsSL https://tailscale.com/install.sh | sh
This command downloads and installs the Tailscale software.
Run:
sudo tailscale up
A browser window will open asking you to authenticate.
Choose GitHub login.
Run:
tailscale status
Example output:
100.x.x.x ubuntu-server username@ linux
If you see an IP address starting with 100.x.x.x, your device has successfully joined the Tailscale network.
Tip:
Your output may look slightly different. That is normal.
Identity verification ensures that only authenticated users and devices can join the network.
This is one of the core ideas of Zero Trust security.
Next we create a simple internal service.
Run:
python3 -m http.server 8080
Expected output:
Serving HTTP on 0.0.0.0 port 8080
Open a browser and go to:
http://localhost:8080
You should see a directory listing page.
This web server represents an internal application that must be protected from unauthorized access.
Micro-segmentation restricts access to specific services instead of allowing full network access.
This prevents attackers from moving between systems inside the network.
Open the Tailscale admin console:
https://login.tailscale.com/admin
Navigate to:
Access Controls
Replace the policy with the following example:
{
"grants": [
{
"src": ["user_identity"],
"dst": ["*"],
"ip": ["*:8080"]
}
]
}
Explanation:
src → user identitydst → destination deviceip → allowed portThis rule allows access only to port 8080.
Even if a user joins the network, they cannot access every service.
This reduces the risk of lateral movement.
The Principle of Least Privilege means that users should receive only the permissions necessary to perform their tasks.
Run:
sudo adduser junioradmin
Verify the user exists:
id junioradmin
Edit the sudo configuration:
sudo visudo
Add this rule at the bottom of the file:
junioradmin ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx
This allows the user to restart the nginx service but nothing else.
Switch to the user:
su - junioradmin
Allowed command:
sudo systemctl restart nginx
Restricted command:
sudo cat /etc/shadow
The second command should be denied.
Limiting privileges reduces the damage that could occur if an account is compromised.
Security analysts often review logs to identify suspicious activity.
View recent authentication logs:
sudo tail -n 20 /var/log/auth.log
Example log entry:
sudo: junioradmin : command not allowed ; COMMAND=/usr/bin/cat /etc/shadow
These logs can be analyzed using an AI assistant.
Example prompt:
Analyze the following Linux authentication logs.
Identify suspicious login attempts, privilege escalation attempts,
and potential security issues. Explain what happened and recommend
mitigation steps.
AI tools can help analysts:
In this lab you implemented several important Zero Trust concepts:
These techniques help organizations improve security by verifying identity, restricting access, and monitoring system activity.