4 ms·

From Zero to Zero Trust

80 points by gk1 7y ago

Vmody2 7y ago
Hey everyone, author here. I wrote this post in an attempt to better understand how cybersecurity evolved to the Zero Trust model, and what that means, practically. If your organizations have implemented some form of Zero Trust or you are aware of other resources, please comment so I can keep learning. Here are some resources I found useful for further reading: https://about.gitlab.com/blog/2019/04/01/evolution-of-zero-trust/ https://about.gitlab.com/blog/2019/04/01/evolution-of-zero-t... https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207-draft2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S... https://www.oreilly.com/library/view/zero-trust-networks/9781491962183/ch01.html https://www.oreilly.com/library/view/zero-trust-networks/978...
- basch 7y ago
  https://telegra.ph/ZeroTrust-Vendors-04-23 https://telegra.ph/ZeroTrust-Vendors-04-23 If it's missing anyone important, let me know.
  - 1cvmask 7y ago
    SAASPASS offers ZTNA as both a service and has an on-premise version.
  - ithkuil 7y ago
    Does https://www.pomerium.io/ https://www.pomerium.io/ fit there?
- nfarmer44646 7y ago
  Check out https://github.com/pomerium/awesome-zero-trust https://github.com/pomerium/awesome-zero-trust
- bdesimone 7y ago
  Here's a collection of resources you might find helpful. https://github.com/pomerium/awesome-zero-trust/ https://github.com/pomerium/awesome-zero-trust/ Contributions/PRs very welcome.
- jiveturkey 7y ago
  decent enough introduction. i do disagree with how you introduce zero trust without mentioning Forrester.
  - gk1 7y ago
    > Six years later, John Kindervag coined the term Zero Trust during his tenure as Analyst and VP at Forrester Research. Or do you mean this should've come sooner?
    - jiveturkey 7y ago
      how'd i miss that???!
someonehere 7y ago
Currently looking at bastion/jit solutions to move away from ssh keys. Two options we’ve looked at were PrivX from ssh.com and ScaleFT (now owned by Okta). Both offer role based access to servers. PrivX seems better because it allows ssh session recordings with metadata playback search. Perfect to find out who ran the wrong command and what happened before and afterwards. They also keep a copy of any files transferred in/out over the ssh session. ScaleFT is good it’s very expensive compared to PrivX. But we are looking at using a service like this as we move to zero trust.
- jiveturkey 7y ago
  > Currently looking at bastion/jit solutions to move away from ssh keys. You lost me. How does bastion get you away from ssh keys?
  - Vmody2 7y ago
    Could mean moving away from manual SSH key management to something like a bastion-hosted SSH Certificate Authority.
- alexk 7y ago
  Check out our open core version as well: https://github.com/gravitational/teleport/ https://github.com/gravitational/teleport/ (I work at Gravitational)
viahoptop 7y ago
I've been working on a Zero Trust project that requires client certs and implementing SCEP for cert distribution has been a huge headache. The best part of this Zero Trust movement is that it seems most of these projects are "moving away" from painful specs like IPSec, 802.1x, and SAML to much more simple & modern solutions.
gpcastle 7y ago
to ZeroTier. https://www.zerotier.com/ https://www.zerotier.com/

80 points by gk1 7y ago

Hey everyone, author here. I wrote this post in an attempt to better understand how cybersecurity evolved to the Zero Trust model, and what that means, practically. If your organizations have implemented some form of Zero Trust or you are aware of other resources, please comment so I can keep learning. Here are some resources I found useful for further reading: https://about.gitlab.com/blog/2019/04/01/evolution-of-zero-trust/ https://about.gitlab.com/blog/2019/04/01/evolution-of-zero-t... https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207-draft2.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S... https://www.oreilly.com/library/view/zero-trust-networks/9781491962183/ch01.html https://www.oreilly.com/library/view/zero-trust-networks/978...

basch 7y ago
https://telegra.ph/ZeroTrust-Vendors-04-23 https://telegra.ph/ZeroTrust-Vendors-04-23 If it's missing anyone important, let me know.
- 1cvmask 7y ago
  SAASPASS offers ZTNA as both a service and has an on-premise version.
- ithkuil 7y ago
  Does https://www.pomerium.io/ https://www.pomerium.io/ fit there?
nfarmer44646 7y ago
Check out https://github.com/pomerium/awesome-zero-trust https://github.com/pomerium/awesome-zero-trust
bdesimone 7y ago
Here's a collection of resources you might find helpful. https://github.com/pomerium/awesome-zero-trust/ https://github.com/pomerium/awesome-zero-trust/ Contributions/PRs very welcome.
jiveturkey 7y ago
decent enough introduction. i do disagree with how you introduce zero trust without mentioning Forrester.
- gk1 7y ago
  > Six years later, John Kindervag coined the term Zero Trust during his tenure as Analyst and VP at Forrester Research. Or do you mean this should've come sooner?
  - jiveturkey 7y ago
    how'd i miss that???!

someonehere 7y ago

Currently looking at bastion/jit solutions to move away from ssh keys. Two options we’ve looked at were PrivX from ssh.com and ScaleFT (now owned by Okta). Both offer role based access to servers. PrivX seems better because it allows ssh session recordings with metadata playback search. Perfect to find out who ran the wrong command and what happened before and afterwards. They also keep a copy of any files transferred in/out over the ssh session. ScaleFT is good it’s very expensive compared to PrivX. But we are looking at using a service like this as we move to zero trust.

jiveturkey 7y ago
> Currently looking at bastion/jit solutions to move away from ssh keys. You lost me. How does bastion get you away from ssh keys?
- Vmody2 7y ago
  Could mean moving away from manual SSH key management to something like a bastion-hosted SSH Certificate Authority.
alexk 7y ago
Check out our open core version as well: https://github.com/gravitational/teleport/ https://github.com/gravitational/teleport/ (I work at Gravitational)

viahoptop 7y ago

I've been working on a Zero Trust project that requires client certs and implementing SCEP for cert distribution has been a huge headache. The best part of this Zero Trust movement is that it seems most of these projects are "moving away" from painful specs like IPSec, 802.1x, and SAML to much more simple & modern solutions.

gpcastle 7y ago

to ZeroTier. https://www.zerotier.com/ https://www.zerotier.com/