Zero Trust in a Cloud-Native Enterprise

Transcript

1. Zero Trust in Cloud Native Enterprises
2. API Expert / Senior Solutions Architect
4. Beyond Corp “A new approach to Enterprise Security”
6. BeyondProd “A new approach to cloud-native security”
7. Foundational pillars of Zero Trust Service Identity DevSecOps Policy Management GitOps Service Mesh
8. GitOps
9. GitOps - Maintenance of the preferred state of your system in a Git repository - Git as the “single source of truth” - immutable infrastructure => Infrastructure as Code - immutable containers => Docker - declarative container orchestration => Kubernetes
10. DevSecOps
11. DevSecOps - A zero-trust mindset is needed for all aspects of the software development lifecycle - A security team should be part of the engineering team - Scanning during development - Assuming defence in depth for read/write access across environments - Hardening of containers - Secure deployment of containers into Kubernetes
12. Service Mesh
13. Service Mesh - Embed zero trust deeply into the Virtual Machine or the container - Sidecar pattern
14. Service Identity
15. Service Identity - Trust no container - A container requires a service identity with rotating credentials - The service identity is tied to authorized code from a trusted source repository
16. Policy Management
17. Policy Management - Policy Management infrastructure is fundamental - manage whitelists, attribute level access controls - automation and real-time auditing of each service identity - network identity and certificate policy
18. Roadmap to Zero Trust
19. Disclaimer Working in a greenfield environment, an enterprise would find themselves at different levels of maturity to get them to a zero trust cloud-native architecture.
20. Adopt a declarative approach to how code is pushed
21. Security operations cannot operate in a silo
22. Learning the complexities of managing and securing Kubernetes
23. Control traffic, security, permissions, and observability with a Service Mesh
24. Using certificate-based mTLS (mutual transport layer security)