Zero Trust
36 items tagged with "zero-trust"
Best Practices3
Zero Trust Architecture Principles (NIST SP 800-207)
Conceptual zero-trust model: continuous verification, least privilege, assume breach.
Principle of Least Privilege
A security principle that grants every user, service, and process only the minimum access required to perform its function, and no more.
OAuth 2.0 and OpenID Connect
OAuth 2.0 delegates authorization via access tokens; OpenID Connect adds an identity layer for authentication. Together they secure API access and single sign-on.
Tutorials2
How to restrict pod traffic with Kubernetes NetworkPolicies
Lock down pod-to-pod traffic with default-deny and selective allow rules using NetworkPolicy resources.
How to Set Up Mutual TLS Between Services
Create a private CA, issue client and server certificates, and require both sides to authenticate with mTLS for service-to-service calls.
Blueprints5
On-Prem to Hybrid Cloud Blueprint
Build a hybrid cloud that keeps regulated or latency-bound workloads on-prem while extending elastic workloads to public cloud with consistent networking and governance.
Secrets in Config to HashiCorp Vault Blueprint
Move plaintext secrets out of config files and environment variables into HashiCorp Vault with dynamic secrets, leasing, and rotation.
Perimeter Security to Zero Trust Blueprint
Move from VPN and network-perimeter trust to a zero-trust architecture with identity-aware access, microsegmentation, and continuous verification.
Password Auth to OIDC SSO Blueprint
Replace per-app password authentication with centralized OpenID Connect single sign-on, MFA, and a single identity provider.
Standing SSH Access to Just-in-Time Access Blueprint
Replace standing SSH keys and shared bastion logins with short-lived, identity-based just-in-time access, certificates, and full session audit.
Reference Architectures8
Zero Trust Network Architecture
Security architecture assuming no implicit trust, verifying every request
Container Platform with Service Mesh
A Kubernetes container platform with an Istio service mesh providing mTLS, traffic management, and uniform observability across services.
Zero-Trust Network Architecture on AWS
Identity-aware, least-privilege access design that authenticates and authorizes every request regardless of network location.
Centralized Secrets Management Platform
HashiCorp Vault-based platform for issuing, rotating, and auditing secrets and short-lived credentials across hybrid environments.
SSO and Identity Federation with OIDC and SAML
Centralized single sign-on using Entra ID as identity provider, federating apps over OpenID Connect and SAML.
PKI and Certificate Lifecycle Management
Private public-key infrastructure for issuing, renewing, and revoking TLS certificates automatically across services.
Privileged Access Management on AWS
Just-in-time, audited access to production with short-lived elevated credentials and session recording.
Service Mesh with mTLS on Kubernetes
Istio-based service mesh providing mutual TLS, traffic management, and observability for microservices.
Playbooks7
AWS Landing Zone Rollout Playbook
A phased program to establish a secure, multi-account AWS foundation with guardrails, networking, and identity before workloads arrive.
Azure Landing Zone Rollout Playbook
A phased program to deploy an enterprise-scale Azure landing zone with management groups, policy guardrails, hub-spoke networking, and subscription vending.
GCP Landing Zone Rollout Playbook
A phased program to build a Google Cloud foundation with a resource hierarchy, org policies, shared VPC networking, and automated project factory.
Service Mesh Adoption Program Playbook
A phased program to roll out a service mesh for mTLS, traffic management, and observability across a Kubernetes microservices estate.
Zero-Trust Architecture Rollout Playbook
A phased program to adopt zero-trust security: verify every request, enforce least privilege, and remove implicit network trust.
SSO and Identity Migration Playbook
A program to consolidate authentication onto a single identity provider with SSO, SCIM provisioning, and OIDC across applications.
Service Mesh Adoption Playbook
A program to introduce a service mesh for secure service-to-service communication, traffic control, and observability across microservices.
Checklists6
Cloud Network Security Review Checklist
Audit a cloud network's segmentation, access controls, and exposure to reduce the blast radius of a compromise.
Security Hardening Checklist
Reduce the attack surface of an application and its infrastructure across identity, network, runtime, and supply chain.
Secrets Management Audit Checklist
Audit how an organization stores, distributes, rotates, and revokes secrets such as keys, tokens, and credentials.
Zero-Trust Readiness Checklist
Assess readiness to adopt a zero-trust architecture where no user, device, or network is implicitly trusted.
SSO Migration Checklist
Plan and execute a migration to centralized single sign-on with minimal disruption to users and applications.
API Security (OAuth/OIDC) Review Checklist
Security review items for an API protected by OAuth 2.0 and OpenID Connect, covering tokens, flows, scopes, and validation.
FAQs2
What is mutual TLS (mTLS)?
Mutual TLS extends standard TLS so that both the client and the server present and verify certificates, rather than only the client verifying the serv...
What is zero trust security?
Zero trust is a security model that assumes no user, device, or network is inherently trustworthy, even inside the corporate perimeter. Every access r...
Glossaries3
Zero Trust
Zero trust is a security model that assumes no user, device, or network is inherently trustworthy and requires continuous verification of every access request, regardless of its origin.
Principle of Least Privilege
The principle of least privilege is a security practice that grants each user, process, or system only the minimum access rights needed to perform its task, and no more.
Multi-Factor Authentication (MFA)
Multi-factor authentication is a security method that requires two or more independent forms of verification, drawn from different categories, before granting access.