npx claudepluginhub plurigrid/asi --plugin asiThis skill uses the workspace's default tool permissions.
- Understanding of zero trust principles (NIST SP 800-207)
Deploys Software-Defined Perimeter per CSA v2.0 with SPA, mutual TLS, controller/gateway config to enforce zero trust network access.
Deploys Software-Defined Perimeter (SDP) for zero-trust access using CSA v2.0 spec, SPA, mTLS, controllers, gateways, and NIST SP 800-207 verification. For identity-centric network security.
Implements Zero Trust Network Access using Zscaler Private Access (ZPA) to replace VPNs with identity-based, context-aware access to private apps via Zscaler Zero Trust Exchange. For zero-trust deployments and security architecture.
Share bugs, ideas, or general feedback.
A Software-Defined Perimeter (SDP) implements zero trust by creating a dynamically provisioned, identity-centric perimeter around individual resources. Defined by the Cloud Security Alliance (CSA), SDP makes application infrastructure invisible to unauthorized users through a "dark cloud" approach where services are hidden until authenticated and authorized. Unlike traditional VPN, SDP establishes one-to-one encrypted connections between verified users and specific applications.
This skill covers deploying SDP using the CSA v2.0 specification, implementing Single Packet Authorization (SPA), configuring the SDP controller and gateway, and validating the deployment against NIST SP 800-207 requirements.
┌─────────────────────┐
│ SDP Controller │
│ - Authentication │
│ - Authorization │
│ - Policy management │
│ - Key management │
└──────────┬──────────┘
│
┌──────┴──────┐
│ │
v v
┌────────┐ ┌────────────┐
│ IH │ │ AH │
│(Client)│ │(Gateway) │
│ │ │ │
│ SPA │──│ Protected │
│ mTLS │ │ Resources │
└────────┘ └────────────┘
IH = Initiating Host (User Device)
AH = Accepting Host (Application Gateway)
SPA = Single Packet Authorization
SPA is a network security mechanism where the SDP gateway drops all TCP/UDP packets by default. A cryptographically signed single packet must be sent before any connection is established. The gateway validates the SPA packet, and only then opens a temporary port for the authenticated session. This makes the gateway invisible to port scanners.
After SPA validation, both the client and server authenticate each other using X.509 certificates. This bidirectional authentication prevents man-in-the-middle attacks and ensures both endpoints are verified.
SDP connections are provisioned on-demand based on real-time policy evaluation. No persistent network tunnels exist; each session is individually authorized and encrypted.
Deploy SDP Controller
Configure Authentication
Define Access Policies
Deploy Accepting Hosts (Gateways)
Configure Application Definitions
Deploy Initiating Hosts (Clients)
Validate End-to-End Flow
Security Testing
Monitoring and Maintenance