Perimeter firewalls assume the inside of the network is safe. Zero trust assumes the opposite: every user and device is untrusted until proven otherwise — and then proven again on the next request.
I built a Zero-Trust Network Simulator to make that model concrete: a web app where access is earned through continuous verification, not a one-time login. The repo lives at github.com/fayzan101/ZeroTrustNetworkArchitecture.
What the simulator does
- Continuous verification — sessions are re-checked against policy, not only at sign-in
- Dynamic risk scoring — device, location, and behaviour feed a score that can tighten or relax access
- Policy-based access control — resources declare who may touch them and under which conditions
- Attack simulation — you can push the system with suspicious flows and watch policies respond
Stack
Spring Boot on the backend for identity, scoring, and policy evaluation. PostgreSQL for users, devices, audit events, and policy documents. Angular for the control-plane UI. Docker so the whole estate — API, database, frontend — stands up with one compose file.
The design that mattered
The interesting part was not the login form. It was treating every resource request as a decision:
- Who is asking, and from which device?
- What is their current risk score?
- Does the policy for this resource allow this combination right now?
- Log the decision so an attack simulation can be replayed.
That kept the Angular UI honest: it never assumed a token meant “open everything.” The backend remained the source of truth.
What I’d tighten next
I’d add more realistic device posture signals and make attack scenarios scriptable. The core idea already holds: never trust, always verify is easier to teach when you can watch it fail closed.