# Corporate Security Architecture

## Google

### BeyondCorp (Zero Trust)
- Overview: https://cloud.google.com/beyondcorp
- Original paper: https://research.google.com/pubs/archive/44860.pdf
- USENIX: https://www.usenix.org/publications/loginonline/beyondcorp-and-long-tail-zero-trust
- Eliminates privileged corporate LAN. Access based on device trust + user identity + context.
- Papers: "A New Approach to Enterprise Security", "Design to Deployment", "The Access Proxy", "Maintaining Productivity"

### Infrastructure Security Design Overview
- Web: https://cloud.google.com/docs/security/infrastructure/design
- PDF: https://cloud.google.com/docs/security/infrastructure/design/resources/google_infrastructure_whitepaper_fa.pdf
- Physical security, Titan chip, service identity, inter-service encryption, storage encryption

### BeyondProd (Zero Trust for Production)
- URL: https://cloud.google.com/docs/security/beyondprod
- Service-to-service auth, workload isolation, container security

## Microsoft

### Zero Trust Hub
- Main: https://learn.microsoft.com/en-us/security/zero-trust/
- Deployment: https://learn.microsoft.com/en-us/security/zero-trust/deploy/overview
- Adoption framework: https://learn.microsoft.com/en-us/security/zero-trust/adopt/zero-trust-adoption-overview
- Architecture diagrams: https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-tech-illus
- CISA ZTM guidance (Dec 2024): https://www.microsoft.com/en-us/security/blog/2024/12/19/new-microsoft-guidance-for-the-cisa-zero-trust-maturity-model/
- DoD ZT guidance (Apr 2024): https://www.microsoft.com/en-us/security/blog/2024/04/16/new-microsoft-guidance-for-the-dod-zero-trust-strategy/

## Cloudflare

### Security Architecture
- Reference: https://developers.cloudflare.com/reference-architecture/architectures/security/
- Securing Data in Transit: https://developers.cloudflare.com/reference-architecture/diagrams/security/securing-data-in-transit/
- SASE Architecture: https://developers.cloudflare.com/reference-architecture/architectures/sase/
- Zero Trust Roadmap (PDF): https://cf-assets.www.cloudflare.com/slt3lc6tev37/9jyDLdW3VXPGwChDCCnrx/a4b7f7825e229f2caeaa1a12a2d16b24/Whitepaper_A-Roadmap-to-Zero-Trust-Architecture.pdf

## CIS Benchmarks

- Download: https://www.cisecurity.org/cis-benchmarks (free PDF for non-commercial)
- Learning: https://learn.cisecurity.org/benchmarks
- 100+ benchmarks across 25+ vendor families
- Cisco: https://www.cisecurity.org/benchmark/cisco
- Check Point: https://www.cisecurity.org/benchmark/checkpoint_firewall
- pfSense: https://www.cisecurity.org/benchmark/pfsense

## MITRE ATT&CK

- URL: https://attack.mitre.org/
- Map every defensive control to specific ATT&CK techniques you're mitigating
- NSA Unfetter: https://github.com/nsacyber/unfetter