The Long and Windy Road that leads to Cloud Native Security
summary
Define zero trust as an identity–policy–control framework and prove it on one app: issue short-lived X.509 certificates (use SPIRE or equivalent) so workloads authenticate with mutual TLS, make policies declarative and managed via GitOps, automate observability and enforcement, start with intra-service restrictions then expand to inter-service, treat Infosec as partners by iterating on small wins, and feed lessons back into community projects like the CNCF Security TAG.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:15Engagement
- 1:29CIA Triad
- 2:10Risk Management
- 5:23Do Care and Due Diligence
- 6:16Perimeter Defense
- 7:01Zero Trust
- 7:36Defining Zero Trust
- 8:24Identity Policy and Control
- 11:50Declarative Policy
- 14:54Control
- 15:59Model Trust
- 16:47Cooperation
- 17:16Start small
- 18:19Share findings
- 20:15Policy and standards
- 21:00Engage with the community
- 22:03Help your peers
- 22:47Collaboration is key
- 22:57Superior
related talks
35mDemystifying Zero-Trust for Cloud Native Technologies
39mOn Establish a Production Zero Trust Architecture
41mZero-Trust Networks: Identity, AuthN, AuthZ, Audit
23mKeynote: Cloud & Cloud Native Identity and Access Management: Challenges & Opportunities
45mZero Trusting as a True Cloud Native Dev
26mA DevSecOps Approach to Zero Trust Network Security
06mZero Trust: Security Without Boundaries
45mZero Trust: Getting to Step One..and What to Do When You Get There