From Zero to Zero Trust

Hey everyone, author here. I wrote this post in an attempt to better understand how cybersecurity evolved to the Zero Trust model, and what that means, practically.

If your organizations have implemented some form of Zero Trust or you are aware of other resources, please comment so I can keep learning.

Here are some resources I found useful for further reading:

https://about.gitlab.com/blog/2019/04/01/evolution-of-zero-t...

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

https://www.oreilly.com/library/view/zero-trust-networks/978...

Currently looking at bastion/jit solutions to move away from ssh keys. Two options we’ve looked at were PrivX from ssh.com and ScaleFT (now owned by Okta). Both offer role based access to servers. PrivX seems better because it allows ssh session recordings with metadata playback search. Perfect to find out who ran the wrong command and what happened before and afterwards. They also keep a copy of any files transferred in/out over the ssh session. ScaleFT is good it’s very expensive compared to PrivX.

But we are looking at using a service like this as we move to zero trust.

I've been working on a Zero Trust project that requires client certs and implementing SCEP for cert distribution has been a huge headache.

The best part of this Zero Trust movement is that it seems most of these projects are "moving away" from painful specs like IPSec, 802.1x, and SAML to much more simple & modern solutions.

to ZeroTier. https://www.zerotier.com/