System and method for zero trust network security

A system for providing zero trust network security, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• send a unique intermediate certificate authority (CA) certificate to each of a plurality of entities, wherein each entity of the plurality of entities is installed on a respective node of a plurality of nodes in a network environment;
• and
• cause deployment of an agent on each of the plurality of nodes, each agent corresponding to the entity installed on the same node as the agent is configured to enforce at least one network firewall policy based on the intermediate CA certificate sent to the corresponding entity.

A method for enforcing zero trust network security, comprising:

• receiving, at a first node, an entity identifier and a host certificate from a sending entity installed on a second node, wherein the first node is deployed in a network environment having a known network infrastructure, wherein the first entity is issued an intermediate certificate authority (CA) certificate from a central authority system;
• determining whether the received host certificate is valid based on at least one network firewall policy and the intermediate CA certificate, wherein determining whether the received host certificate is valid further comprises determining whether the received host certificate is a non-expired CA certificate issued by the central authority system;
• and
• determining whether the received entity identifier is valid based on the known network infrastructure, wherein determining whether the received entity identifier is valid further comprises determining whether the sending entity being installed on the second node is indicated in the known network infrastructure.

A method for providing zero trust network security, comprising:

• sending a unique intermediate certificate authority (CA) certificate to each of a plurality of entities, wherein each entity of the plurality of entities is installed on a respective node of a plurality of nodes in a network environment;
• and
• causing deployment of an agent on each of the plurality of nodes, each agent corresponding to the entity installed on the same node as the agent;
• causing, by each agent, enforcement of at least one network firewall policy based on the intermediate CA certificate sent to the corresponding entity.