Deploying Software Defined Perimeter

---
name: Dağıt:ing-software-defined-perimeter
description: Dağıt: a Software-Defined Perimeter using the CSA v2.0 specification with Single Packet Authorization, mutual TLS, and SDP controller/gateway configuration to enforce zero trust network access.
tags:
- software-defined-perimeter
- network-access
- zero-trust-architecture
- ztna
- sdp
- fetih
- cybersecurity
- zero-trust
- siber-güvenlik
triggers:
- alert
- authentication
- certificate
- cloud
- crypto
- defined
- Dağıt:ing
- endpoint
- incident
- log
- network
- perimeter
category: zero-trust-architecture
source_subdomain: zero-trust-architecture
nist_csf:
- PR.AA-01
- PR.AA-05
- PR.IR-01
- GV.PO-01
adapted_for: fetih
---

# Dağıt:ing Software Defined Perimeter


## Ön Gereksinimler

- Understanding of zero trust principles (NIST SP 800-207)
- Bilgi: CSA Software-Defined Perimeter specification
- Familiarity with PKI and mutual TLS authentication
- Experience with network security architecture

## Genel Bakış

A Software-Defined Perimeter (SDP) implements zero trust by creating a dynamically provisioned, identity-centric perimeter around individual resources. Defined by the Cloud Security Alliance (CSA), SDP makes application infrastructure invisible to unauthorized users through a "dark cloud" approach where services are hidden until authenticated and authorized. Unlike traditional VPN, SDP establishes one-to-one encrypted connections between verified users and specific applications.

bu skill covers Dağıt:ing SDP using the CSA v2.0 specification, implementing Single Packet Authorization (SPA), configuring the SDP controller and gateway, and validating the Dağıt:ment against NIST SP 800-207 requirements.


## Ne Zaman Kullanılır

- Dağıt:ing yaparken or configuring Dağıt:ing software defined perimeter capabilities in your environment
- establishing yaparken: security controls aligned to compliance requirements
- building yaparken or improving security architecture for this domain
- conducting yaparken security assessments that require this implementation

## Ön Gereksinimler

- Familiarity with zero trust architecture concepts and tools
- Erişim: a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Architecture

### SDP Components (CSA Specification)

```
┌─────────────────────┐
│ SDP Controller       │
│ - Authentication     │
│ - Authorization      │
│ - Policy management  │
│ - Key management     │
└──────────┬──────────┘
           │
    ┌──────┴──────┐
    │             │
    v             v
┌────────┐  ┌────────────┐
│ IH     │  │ AH         │
│(Client)│  │(Gateway)   │
│        │  │            │
│ SPA    │──│ Protected  │
│ mTLS   │  │ Resources  │
└────────┘  └────────────┘

IH = Initiating Host (User Device)
AH = Accepting Host (Application Gateway)
SPA = Single Packet Authorization
```

### SDP Dağıt:ment Models
1. **Client-to-Gateway**: User device connects through SDP gateway to backend applications
2. **Client-to-Server**: Direct connection between user and application server
3. **Server-to-Server**: Workload-to-workload communication through SDP
4. **Gateway-to-Gateway**: Site-to-site connectivity replacing traditional VPN tunnels

## Key Concepts

### Single Packet Authorization (SPA)
SPA is a network security mechanism where the SDP gateway drops all TCP/UDP packets by default. A cryptographically signed single packet must be sent before any connection is established. The gateway validates the SPA packet, and only then opens a temporary port for the authenticated session. This makes the gateway invisible to port scanners.

### Mutual TLS (mTLS)
After SPA validation, both the client and server authenticate each other using X.509 certificates. This bidirectional authentication prevents man-in-the-middle attacks and ensures both endpoints are verified.

### Dynamic Provisioning
SDP connections are provisioned on-demand based on real-time policy evaluation. No persistent network tunnels exist; each session is individually authorized and encrypted.

## İş Akışı

### Aşama 1: SDP Controller Dağıt:ment

1. **Dağıt: SDP Controller**
   - Install SDP controller on hardened, redundant infrastructure
   - Configure PKI integration for certificate issuance
   - Kur: authentication backend (LDAP, SAML, OIDC)
   - Configure policy database with application definitions
   - Enable audit logging for all controller decisions

2. **Configure Authentication**
   - Integrate with enterprise IdP via SAML 2.0 or OIDC
   - Configure device certificate enrollment (SCEP/EST)
   - Enable multi-factor authentication requirements
   - Kur: certificate revocation checking (OCSP/CRL)

3. **Define Access Policies**
   - Map users/groups to authorized applications
   - Define device posture requirements per application
   - Configure contextual conditions (location, time, risk level)
   - Set session duration and re-authentication intervals

### Aşama 2: SDP Gateway Dağıt:ment

4. **Dağıt: Accepting Hosts (Gateways)**
   - Install SDP gateway instances in front of protected applications
   - Configure default-drop firewall rules (deny all inbound)
   - Enable SPA listener on designated ports
   - Configure mTLS with controller-issued certificates
   - Kur: health monitoring and failover

5. **Configure Application Definitions**
   - Register each protected application with the controller
   - Define backend server IPs, ports, and protocols
   - Configure load balancing for multi-instance applications
   - Kur: application health checks

### Aşama 3: Client Dağıt:ment

6. **Dağıt: Initiating Hosts (Clients)**
   - Install SDP client software on user endpoints
   - Enroll device certificates through automated provisioning
   - Configure SPA key material distribution
   - Test authentication flow: SPA → mTLS → application access

7. **Validate End-to-End Flow**
   - Verify SPA packets are accepted by gateway
   - Confirm mTLS handshake succeeds with valid certificates
   - Test application access through the SDP tunnel
   - Verify unauthorized access is blocked (no SPA = invisible gateway)

### Aşama 4: Operational Validation

8. **Security Testing**
   - Port scan the SDP gateway to confirm invisibility (all ports show filtered/closed)
   - Attempt connection without valid SPA (must fail silently)
   - Test with revoked client certificate (must be denied)
   - Attempt lateral movement from one authorized app to another unauthorized app
   - Validate audit trail completeness

9. **Monitoring and Maintenance**
   - Configure SIEM integration for SDP controller and gateway logs
   - Kur: alerting for failed SPA attempts and certificate errors
   - Establish certificate rotation schedule
   - Document incident response procedures for SDP events

## Doğrulama Checklist

- [ ] SDP Controller Dağıtılmış with HA and audit logging
- [ ] IdP integration tested with SAML/OIDC and MFA
- [ ] SDP Gateways Dağıtılmış with default-drop firewall
- [ ] SPA mechanism validated (gateway invisible to port scans)
- [ ] mTLS established between clients and gateways
- [ ] Access policies enforce least-privilege per user/app
- [ ] Device certificate enrollment automated
- [ ] Unauthorized access attempts blocked silently
- [ ] Lateral movement between apps prevented
- [ ] Logs streaming to SIEM with alerting configured
- [ ] Certificate rotation and revocation procedures tested

## References

- CSA Software-Defined Perimeter Architecture Guide v3
- CSA SDP Specification v2.0
- NIST SP 800-207: Zero Trust Architecture
- CISA Zero Trust Maturity Model v2.0
- fwknop: Single Packet Authorization implementation

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: f1600a22d136fe0e
-->