Barth Doug - Zero trust networks : building secure systems in untrusted networks

by Evan Gilman and Doug Barth

Copyright 2017 Evan Gilman, Doug Barth. All rights reserved.

Printed in the United States of America.

Published by OReilly Media, Inc. , 1005 Gravenstein Highway North, Sebastopol, CA 95472.

OReilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (http://oreilly.com/safari). For more information, contact our corporate/institutional sales department: 800-998-9938 or corporate@oreilly.com .

• Editors: Courtney Allen and Virginia Wilson
• Production Editor: Kristen Brown
• Copyeditor: Amanda Kersey
• Proofreader: Jasmine Kwityn
• Indexer: Wendy Catalano
• Interior Designer: David Futato
• Cover Designer: Karen Montgomery
• Illustrator: Rebecca Demarest

• July 2017: First Edition

See http://oreilly.com/catalog/errata.csp?isbn=9781491962190 for release details.

The OReilly logo is a registered trademark of OReilly Media, Inc. Zero Trust Networks, the cover image, and related trade dress are trademarks of OReilly Media, Inc.

While the publisher and the authors have used good faith efforts to ensure that the information and instructions contained in this work are accurate, the publisher and the authors disclaim all responsibility for errors or omissions, including without limitation responsibility for damages resulting from the use of or reliance on this work. Use of the information and instructions contained in this work is at your own risk. If any code samples or other technology this work contains or describes is subject to open source licenses or the intellectual property rights of others, it is your responsibility to ensure that your use thereof complies with such licenses and/or rights.

978-1-491-96219-0

[LSI]

Thank you for choosing to read Zero Trust Networks! Building trusted systems in hostile networks has been a passion of ours for many years. In building and designing such systems, we have found frustration in the pace of progress toward solving some of the more fundamental security problems plaguing our industry. Wed very much like to see the industry move more aggressively toward building the types of systems which strive to solve these problems.

To that end, we are proposing that the world take a new stance toward building and maintaining secure computer networks. Rather than being something which is layered on top, considered only after some value has been built, security must be fundamentally infused with the operation of the system itself. It must be ever-present, enabling operation rather than restricting it. As such, this book sets forth a collection of design patterns and considerations which, when heeded, can produce systems that are resilient to the vast majority of modern-day attack vectors.

This collection, when taken as a whole, is known as the zero trust model. In this model, nothing is taken for granted, and every single access requestwhether it be made by a client in a coffee shop or a server in the datacenteris rigorously checked and proven to be authorized. Adopting this model practically eliminates lateral movement, VPN headaches, and centralized firewall management overhead. It is a very different model indeed; one that we believe represents the future of network and infrastructure security design.

Security is a complicated and ever-changing field of engineering. Working on it requires a deep understanding of many layers of a system and how bugs or weaknesses in those layers can allow an attacker to subvert access controls and protections. While this makes defending a system challenging, its also a lot of fun to learn about! We hope youll enjoy learning about it as much as we have!