On Establish a Production Zero Trust Architecture
summary
Argument and recipe for rolling out Zero Trust: establish cryptographic identities for workloads using SPIFFE/SPIRE and short‑lived x509 certificates, enforce access with policy engines (examples: OPA/Kubernetes admission hooks), and terminate/validate with mutual TLS at service edges (Envoy or sidecars). Onboard legacy systems with identity‑backed proxies, federate CAs across trust domains, automate issuance and observability, and gate inter‑application changes via policy‑as‑code reviews so blast radius shrinks without breaking availability.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:14Reality/Assumption Gap
- 1:52Drivers
- 2:46Change comes with Risk
- 3:48Triangle of Trust
- 5:58Perimeter Defense - Zero Trust
- 6:43Zero Trust Environment
- 8:51User Identity
- 10:45Attest Workloads
- 11:42Establish Policy
- 12:46Establish Trust between Organizations
- 14:22Application needs a connection to the Secure Corporate Intranet!
- 15:01Advanced Use Case: Multi-Party Edge Compute
- 17:24Identities for Infrastructure too
- 19:06No Workload Authentication
- 20:08Multi-factor Authorization (SPIFFE+JWT)
- 21:42Workload 2FA: Identity Provider + Application Identity
- 23:18Let's back up and talk strategy
- 24:34Information Security 101
- 25:57One possible early strategy
- 28:11Observability
- 30:18Education
- 32:18An Aside: Legacy Systems
- 35:35Automate
- 36:45Educate
related talks
41mZero-Trust Networks: Identity, AuthN, AuthZ, Audit
23mThe Long and Windy Road that leads to Cloud Native Security
18mImplementing Zero Trust at Enterprise Scale
10mEconomics of Zero Trust
01h 02mIntroduction to Zero Trust Security
49mZero Trust Security
45mZero Trust: Getting to Step One..and What to Do When You Get There
22mBuilding Secure AI Platform Infrastructure: A Zero Trust Framework