Zero Trust-ontwerp Voor Veilige Remote Access

<# .SYNOPSIS Zero Trust-remote access toetsen, baselines publiceren en monitoringrapportages genereren. .DESCRIPTION Controleert Conditional Access-beleid, Entra Global Secure Access connectors, Application Proxy status en named locations. Het script kan een referentieconfiguratie schrijven, monitoring uitvoeren en ondersteunt DebugMode voor lokale tests binnen vijftien seconden. .NOTES Filename: zero-trust-remote-access.ps1 Author: Nederlandse Baseline voor Veilige Cloud Created: 2025-11-27 Version: 1.0 Gerelateerd JSON: content/m365/remote-work/zero-trust-remote-access.json Workload: m365 Category: remote-work .EXAMPLE .\zero-trust-remote-access.ps1 -Assessment -ReportPath .\rapporten\ztra-assessment.json Voert een gezondheidsscan uit en schrijft de output naar JSON. .EXAMPLE .\zero-trust-remote-access.ps1 -PublishBaseline Genereert of actualiseert het referentieconfiguratiebestand voor Zero Trust-remote access. .EXAMPLE .\zero-trust-remote-access.ps1 -Monitoring -ReportPath .\rapporten\ztra-monitoring.json Combineert actuele metingen met de baseline voor audit- en KPI-doeleinden. #> #Requires -Version 5.1 [CmdletBinding()] param( [switch]$Assessment, [switch]$PublishBaseline, [switch]$Monitoring, [string]$ReportPath, [switch]$DebugMode, [switch]$WhatIf ) $ErrorActionPreference = 'Stop' $VerbosePreference = 'Continue' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Zero Trust Remote Access Toolkit" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Get-ZtraConfigPath { [CmdletBinding()] param() $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath "zero-trust-remote-access.config.json") } function Test-RequiredModules { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string[]]$ModuleNames ) foreach ($moduleName in $ModuleNames) { if (-not (Get-Module -ListAvailable -Name $moduleName -ErrorAction SilentlyContinue)) { throw "Vereiste module '$moduleName' is niet gevonden. Installeer de module en voer het script opnieuw uit." } } } function Ensure-GraphConnection { [CmdletBinding()] param() Test-RequiredModules -ModuleNames @('Microsoft.Graph.Authentication') Import-Module Microsoft.Graph.Authentication -ErrorAction Stop | Out-Null $requiredScopes = @( 'Policy.Read.All', 'Application.Read.All', 'Directory.Read.All', 'NetworkAccess.Read.All' ) $context = Get-MgContext -ErrorAction SilentlyContinue $needsConnect = $true if ($context) { $scopeDifference = Compare-Object -ReferenceObject $requiredScopes -DifferenceObject $context.Scopes if ($scopeDifference.Count -eq 0 -and $context.ExpirationTime -gt (Get-Date)) { $needsConnect = $false } } if ($needsConnect) { Write-Host "Verbinding maken met Microsoft Graph..." -ForegroundColor Gray Connect-MgGraph -Scopes $requiredScopes -NoWelcome | Out-Null } try { Select-MgProfile -Name beta } catch { throw "Het Microsoft Graph-profiel 'beta' kan niet worden geselecteerd. Update de Microsoft.Graph modules." } } function Invoke-GraphPagedRequest { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$Uri ) $results = @() $nextLink = $Uri while ($nextLink) { $response = Invoke-MgGraphRequest -Method GET -Uri $nextLink -OutputType PSObject if ($response.value) { $results += $response.value } else { $results += $response } $nextLink = $response.'@odata.nextLink' } return $results } function Get-ZtraConditionalAccessSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ PolicyId = 'remote-admins' Name = 'CA - Remote admins Zero Trust' State = 'enabled' RequiresMfa = $true RequiresCompliant = $true SessionControls = @('signInFrequency', 'appEnforcedRestrictions') SignInRiskLevels = @('high', 'medium') }, [PSCustomObject]@{ PolicyId = 'remote-suppliers' Name = 'CA - Leveranciers Private Access' State = 'enabled' RequiresMfa = $true RequiresCompliant = $false SessionControls = @('continuousAccessEvaluation') SignInRiskLevels = @('high') } ) } Ensure-GraphConnection $uri = "https://graph.microsoft.com/beta/identity/conditionalAccess/policies?`$select=id,displayName,state,conditions,grantControls,sessionControls" $policies = Invoke-GraphPagedRequest -Uri $uri $snapshots = @() foreach ($policy in $policies) { $grantControls = $policy.grantControls $sessionControls = @() if ($policy.sessionControls) { if ($policy.sessionControls.signInFrequency) { $sessionControls += 'signInFrequency' } if ($policy.sessionControls.applicationEnforcedRestrictions) { $sessionControls += 'appEnforcedRestrictions' } if ($policy.sessionControls.cloudAppSecurity) { $sessionControls += 'defenderSessionControl' } if ($policy.sessionControls.continuousAccessEvaluation) { $sessionControls += 'continuousAccessEvaluation' } } $requiresMfa = $false $requiresCompliant = $false if ($grantControls -and $grantControls.builtInControls) { $requiresMfa = $grantControls.builtInControls -contains 'mfa' $requiresCompliant = $grantControls.builtInControls -contains 'compliantDevice' } $signInRiskLevels = @() if ($policy.conditions -and $policy.conditions.signInRiskLevels) { $signInRiskLevels = $policy.conditions.signInRiskLevels } $snapshots += [PSCustomObject]@{ PolicyId = $policy.id Name = $policy.displayName State = $policy.state RequiresMfa = $requiresMfa RequiresCompliant = $requiresCompliant SessionControls = $sessionControls SignInRiskLevels = $signInRiskLevels } } return $snapshots } function Get-ZtraNetworkAccessSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ ConnectorId = 'branch-ams-01' Name = 'Rijkskantoor Amsterdam' Status = 'running' Region = 'West-Europe' RemoteNetwork = 'PrivateAccess' LastHeartbeat = (Get-Date).AddMinutes(-3) }, [PSCustomObject]@{ ConnectorId = 'branch-utrecht-02' Name = 'SSC-Utrecht' Status = 'running' Region = 'North-Europe' RemoteNetwork = 'PrivateAccess' LastHeartbeat = (Get-Date).AddMinutes(-6) } ) } Ensure-GraphConnection $snapshots = @() try { $uri = "https://graph.microsoft.com/beta/networkAccess/connectivity/branches?`$expand=connectivityConfiguration" $branches = Invoke-GraphPagedRequest -Uri $uri foreach ($branch in $branches) { $connectorStatus = if ($branch.connectivityConfiguration -and $branch.connectivityConfiguration.status) { $branch.connectivityConfiguration.status } else { 'unknown' } $lastHeartbeat = $null if ($branch.connectivityConfiguration -and $branch.connectivityConfiguration.lastUpdatedDateTime) { $lastHeartbeat = [datetime]$branch.connectivityConfiguration.lastUpdatedDateTime } $snapshots += [PSCustomObject]@{ ConnectorId = $branch.id Name = $branch.displayName Status = $connectorStatus Region = $branch.region RemoteNetwork = $branch.connectivityConfiguration.type LastHeartbeat = $lastHeartbeat } } } catch { Write-Warning "Kon Global Secure Access-gegevens niet ophalen: $_" } return $snapshots } function Get-ZtraApplicationProxySnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ ConnectorId = 'apxy-01' Name = 'App Proxy Amsterdam' Status = 'active' Machine = 'APPX01' Version = '1.6.3805.0' } ) } Ensure-GraphConnection $uri = "https://graph.microsoft.com/beta/onPremisesPublishingProfiles/applicationProxy/connectors?`$select=id,displayName,externalIp,connectorMachineName,version,connectorGroupId,systemStatus" $connectors = Invoke-GraphPagedRequest -Uri $uri $snapshots = @() foreach ($connector in $connectors) { $status = if ($connector.systemStatus -and $connector.systemStatus.status) { $connector.systemStatus.status } else { 'unknown' } $snapshots += [PSCustomObject]@{ ConnectorId = $connector.id Name = $connector.displayName Status = $status Machine = $connector.connectorMachineName Version = $connector.version } } return $snapshots } function Get-ZtraNamedLocationSnapshot { [CmdletBinding()] param( [switch]$DebugMode ) if ($DebugMode) { return @( [PSCustomObject]@{ LocationId = 'trusted-gov' Name = 'Trusted Rijksnetwerk' Type = 'ip' IsTrusted = $true } ) } Ensure-GraphConnection $uri = "https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations?`$select=id,displayName,isTrusted,@odata.type" $locations = Invoke-GraphPagedRequest -Uri $uri $snapshots = @() foreach ($location in $locations) { $type = $location.'@odata.type' if ($type -match 'ipNamedLocation') { $typeName = 'ip' } elseif ($type -match 'countryNamedLocation') { $typeName = 'country' } else { $typeName = 'unknown' } $snapshots += [PSCustomObject]@{ LocationId = $location.id Name = $location.displayName Type = $typeName IsTrusted = [bool]$location.isTrusted } } return $snapshots } function Invoke-ZtraAssessment { [CmdletBinding()] param( [switch]$DebugMode ) $caPolicies = Get-ZtraConditionalAccessSnapshot -DebugMode:$DebugMode $gsaConnectors = Get-ZtraNetworkAccessSnapshot -DebugMode:$DebugMode $appProxy = Get-ZtraApplicationProxySnapshot -DebugMode:$DebugMode $namedLocations = Get-ZtraNamedLocationSnapshot -DebugMode:$DebugMode $issues = [System.Collections.Generic.List[string]]::new() if (-not $caPolicies -or $caPolicies.Count -eq 0) { $issues.Add("Er zijn geen Conditional Access-beleidsregels gevonden.") } else { $remotePolicies = $caPolicies | Where-Object { $_.State -eq 'enabled' } if ($remotePolicies.Count -lt 2) { $issues.Add("Configureer minimaal twee actieve Conditional Access-beleidsregels specifiek voor remote access scenario\u2019s.") } if (-not ($remotePolicies | Where-Object { $_.RequiresMfa })) { $issues.Add("Geen enkel actief beleid vereist MFA voor remote toegang.") } if (-not ($remotePolicies | Where-Object { $_.RequiresCompliant })) { $issues.Add("Geen enkel actief beleid vereist een compliant apparaat of device signaal.") } foreach ($policy in $remotePolicies) { if ($policy.SessionControls.Count -eq 0) { $issues.Add("Policy '$($policy.Name)' gebruikt geen sessiecontroles zoals Defender voor Cloud Apps of sign-in frequenties.") } if ($policy.SignInRiskLevels.Count -eq 0) { $issues.Add("Policy '$($policy.Name)' monitort sign-in risk niet. Activeer minimaal medium risk.") } } } if (-not $gsaConnectors -or $gsaConnectors.Count -lt 2) { $issues.Add("Er zijn minder dan twee Global Secure Access connectors actief. Configureer redundantie over meerdere locaties.") } else { foreach ($connector in $gsaConnectors) { if ($connector.Status -ne 'running') { $issues.Add("Connector '$($connector.Name)' heeft status '$($connector.Status)'.") } if ($connector.LastHeartbeat -and ((Get-Date) - $connector.LastHeartbeat).TotalMinutes -gt 15) { $issues.Add("Connector '$($connector.Name)' heeft langer dan 15 minuten geen heartbeat verstuurd.") } } } if (-not $appProxy -or $appProxy.Count -eq 0) { $issues.Add("Geen Application Proxy-connectors gevonden. Legacy-applicaties kunnen daardoor niet Zero Trust worden ontsloten.") } else { foreach ($connector in $appProxy) { if ($connector.Status -ne 'active') { $issues.Add("Application Proxy-connector '$($connector.Name)' heeft status '$($connector.Status)'.") } } } if (-not $namedLocations -or -not ($namedLocations | Where-Object { $_.IsTrusted })) { $issues.Add("Er zijn geen vertrouwde named locations gedefinieerd voor Rijks- of partnernetwerken.") } $assessment = [PSCustomObject]@{ Script = 'zero-trust-remote-access.ps1' Timestamp = Get-Date ConditionalAccess = $caPolicies GlobalSecureAccess = $gsaConnectors ApplicationProxy = $appProxy NamedLocations = $namedLocations Issues = $issues IsHealthy = ($issues.Count -eq 0) } return $assessment } function Initialize-ZtraConfig { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Assessment ) $config = [ordered]@{ version = "1.0" lastUpdated = (Get-Date).ToString("yyyy-MM-dd") owner = "Zero Trust Remote Access Stuurgroep" governance = @( "Voorzie alle remote toegang van MFA, compliant device-eisen en sessiecontroles.", "Houd Global Secure Access connectors redundant in minimaal twee regio's.", "Combineer Application Proxy met Defender for Cloud Apps session policies." ) conditionalAccess = @() connectors = @() applicationProxy = @() namedLocations = @() } foreach ($policy in $Assessment.ConditionalAccess) { $config.conditionalAccess += [ordered]@{ id = $policy.PolicyId name = $policy.Name requiresMfa = $policy.RequiresMfa requiresCompliant = $policy.RequiresCompliant sessionControls = $policy.SessionControls } } foreach ($connector in $Assessment.GlobalSecureAccess) { $config.connectors += [ordered]@{ id = $connector.ConnectorId name = $connector.Name region = $connector.Region type = $connector.RemoteNetwork } } foreach ($proxy in $Assessment.ApplicationProxy) { $config.applicationProxy += [ordered]@{ id = $proxy.ConnectorId name = $proxy.Name version = $proxy.Version } } foreach ($location in $Assessment.NamedLocations) { $config.namedLocations += [ordered]@{ id = $location.LocationId name = $location.Name type = $location.Type isTrusted = $location.IsTrusted } } return $config } function Invoke-ZtraBaselinePublish { [CmdletBinding()] param( [switch]$DebugMode ) $assessment = Invoke-ZtraAssessment -DebugMode:$DebugMode $config = Initialize-ZtraConfig -Assessment $assessment $configPath = Get-ZtraConfigPath if ($WhatIf) { Write-Host "[WhatIf] Configuratie zou worden opgeslagen op $configPath" -ForegroundColor Yellow } else { $config | ConvertTo-Json -Depth 6 | Out-File -FilePath $configPath -Encoding UTF8 -Force Write-Host "[OK] Zero Trust-configuratie opgeslagen: $configPath" -ForegroundColor Green } return $config } function Invoke-ZtraMonitoring { [CmdletBinding()] param( [switch]$DebugMode ) $assessment = Invoke-ZtraAssessment -DebugMode:$DebugMode $configPath = Get-ZtraConfigPath $config = $null if (Test-Path -Path $configPath) { $config = Get-Content -Path $configPath -Raw | ConvertFrom-Json } else { Write-Host "[WARN] Geen configuratiebestand gevonden op $configPath." -ForegroundColor Yellow } $monitoring = [PSCustomObject]@{ Script = 'zero-trust-remote-access.ps1' Timestamp = Get-Date ConfigPath = $configPath ConfigDetected = [bool]$config ConfigVersion = if ($config) { $config.version } else { "not-found" } LastConfigUpdate = if ($config) { $config.lastUpdated } else { $null } Assessment = $assessment } return $monitoring } function Write-ZtraReport { [CmdletBinding()] param( [Parameter(Mandatory = $true)] $Payload, [Parameter(Mandatory = $true)] [string]$Path ) if (-not $Path) { return } $directory = Split-Path -Parent $Path if ($directory -and -not (Test-Path -Path $directory)) { New-Item -ItemType Directory -Path $directory -Force | Out-Null } $Payload | ConvertTo-Json -Depth 6 | Out-File -FilePath $Path -Encoding UTF8 -Force Write-Host "[OK] Rapport geschreven naar $Path" -ForegroundColor Green } $executed = $false if ($PublishBaseline) { $config = Invoke-ZtraBaselinePublish -DebugMode:$DebugMode if ($ReportPath) { Write-ZtraReport -Payload $config -Path $ReportPath } $executed = $true $config } if ($Assessment) { $result = Invoke-ZtraAssessment -DebugMode:$DebugMode if ($ReportPath) { Write-ZtraReport -Payload $result -Path $ReportPath } $executed = $true $result } if ($Monitoring) { $monitoringResult = Invoke-ZtraMonitoring -DebugMode:$DebugMode if ($ReportPath) { Write-ZtraReport -Payload $monitoringResult -Path $ReportPath } $executed = $true $monitoringResult } if (-not $executed) { Write-Host "Geen modus opgegeven. Gebruik ten minste een van de volgende opties:" -ForegroundColor Yellow Write-Host " -Assessment Voer een Zero Trust-gezondheidsscan uit." -ForegroundColor Yellow Write-Host " -PublishBaseline Genereer of vernieuw het configuratiebestand." -ForegroundColor Yellow Write-Host " -Monitoring Combineer assessmentgegevens met het configuratiebestand." -ForegroundColor Yellow Write-Host "Optioneel: -DebugMode voor lokale tests, -ReportPath voor JSON-rapportage." -ForegroundColor Yellow } Write-Host "`n========================================`n" -ForegroundColor Cyan