WHAT’S IN IT FOR ME
1. Conventional vs. zero trust architecture
2. User identity vs. machine identity
3. Platform example vs. application example
4.What should I use in my project?
Slide 3
Slide 3 text
3
HI
• Damjan Gjurovski
• Software all-rounder J
• Set up Keycloak and
zero trust in a large
developer platform,
worked on some
Keycloak plugins
Slide 4
Slide 4 text
CONVENTIONAL VS. ZERO
TRUST ARCHITECTURE
1
Slide 5
Slide 5 text
5
PERIMETER-
BASED
SECURITY
• Network perimeter
• DMZ and internal zone
• Trust those inside the
zone
• Check all entry points
Slide 6
Slide 6 text
6
ZERO TRUST
• Push security controls
down
• Always verify
authentication and
authorization
• Follow the principle of
least privilege
Slide 7
Slide 7 text
7
THE ROOT OF
TRUST
PROBLEM
• Turtles all the way down
• Who compiles the
compiler
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
Slide 8
Slide 8 text
USER IDENTITY VS. MACHINE
IDENTITY
2
Slide 9
Slide 9 text
9
USER
IDENTITY
• User accounts
• Groups, roles,
permissions bound to
work roles
• Least privilege
according to current
task/role
https://gist.github.com/angelo-v/e0208a18d455e2e6ea3c40ad637aac53
Slide 10
Slide 10 text
10
MACHINE
IDENTITY
• Service accounts
• Groups and permissions
bound to use-case, type
or network perimeter
• Least privilege is
difficult