Zero Trust Security

Preface

Zero Trust is not a project, but a new way of thinking about information security. – John Kindervag, author of the founding Zero Trust paper, ‘No More Chewy Centers’

The essential paper that started the Zero Trust idea was John Kindervag’s ‘No More Chewy Centers: Introducing The Zero Trust Model of Information Security’. It was an unfortunate name because how can you run a network if you do not trust anything or anybody? That was not what Kindervag meant by the word Zero Trust. The concept is based on how the military thinks about protecting secrets. Everything requires a ‘need to know’ basis. If you don’t require the information to do your job, you shouldn’t have access to it. That’s all there is to Zero Trust. This idea of only granting access to what is required should apply to users, servers, network equipment and applications. We grant users access only to what they explicitly need for their work. That whole idea of Zero Trust. This way, we can reduce the attack surface of our environment by limiting access to services and data.

This book offers a practical guide to implementing Zero Trust principles in a simulated environment. The goal is to provide hands-on experience with the technologies and concepts that underpin Zero Trust, allowing readers to understand how to apply these principles in real-world scenarios. The book is structured to take you through the process of setting up a simulated environment using Docker, implementing network segmentation, monitoring ...