Zero Trust at GitLab: Data zones & authentication scoring

What this post added

This post introduces the concepts of 'data zones' and 'authentication scoring' as part of GitLab's Zero Trust initiative. Data zones are defined based on data classification (RED, ORANGE, YELLOW, GREEN) to group data with similar access control needs, especially when granular control is not possible on the underlying system. Four zones (RED, ORANGE, YELLOW, GREEN) are defined, with rules that a zone can only contain its own or lower classification data and requires authorization for the highest designation within its boundaries. An authentication scoring system is detailed, assigning points for basic authentication (1 point for GREEN ZONE), U2F (2 points for YELLOW ZONE), managed devices (3 points for ORANGE ZONE), healthy managed devices (4 points for RED ZONE), and geolocation (potential additional point for specific RED data). The goal is to achieve more granular, documented, logged, and automated access control.