Security and Resilience by Design in a Zero-Trust Environment
Zero trust replaces the perimeter assumption with "never trust, always verify". Every request is authenticated and authorized on its own merits, regardless of network location; identity - of users, services, and workloads - becomes the control plane. Candidates should be able to name the building blocks: strong workload identity (for example SPIFFE/SPIRE identities or cloud workload identity federation), mutual TLS between services, short-lived credentials instead of static secrets, least-privilege authorization, policy-as-code enforcement, and pervasive logging of authentication and authorization decisions. "Assume breach" then drives design: microsegmentation, encryption in transit and at rest, minimizing blast radius through cell-based or bulkheaded architecture, and a hardened software supply chain (signed artifacts, SBOMs, provenance, dependency pinning).
Resilience patterns sit alongside the security patterns and are frequently tested together: timeouts, bounded retries with jitter and a retry budget, circuit breakers, load shedding and admission control, backpressure, idempotent operations, graceful degradation and feature-flag kill switches, and health-based traffic shifting. Security controls must not silently destroy availability - a pathological auth dependency is itself an outage risk, so authz decisions need caching and fail-safe design.
Traps: treating a firewall or VPN as sufficient (that is the model zero trust rejects); equating authentication with authorization; believing zero trust means "no perimeter at all"; placing all trust in the internal network for service-to-service calls; treating security as a final review gate rather than a design input; and forgetting that retries without jitter and budgets amplify outages rather than absorbing them.
Rule of thumb: for every new service, ask three questions - who can call it and how is that proven, what happens when its dependencies are slow or unavailable, and what is the worst-case blast radius if it is compromised. If any answer is "everything trusts it", the design is not zero trust.