Zero Trust Networking

1 post · Mar 2019 – Aug 2019

What this trail covers

GitLab is implementing Zero Trust Networking (ZTN) to enhance security by shifting access control from the perimeter to individual users, devices, and assets. The approach focuses on positive identification of users and devices, real-time authorization, geo-location identification, automated process access control, and comprehensive logging. The company acknowledges challenges in implementing ZTN across diverse environments, including its remote workforce, multi-cloud infrastructure, and customer environments.

All GitLab trails

Aug 2019Zero Trust at GitLab: Problems, goals, and coming challengesThis post defines the problem of implementing Zero Trust Networking (ZTN) in a diverse company like GitLab, where consensus on interpretation is lacking. It outlines GitLab's desired outcomes for ZTN: protecting data with flexible levels, positive real-time identification of team members and devices, geo-location identification, automated process access control, comprehensive logging, maintaining existing controls (data at rest/in transit), and ensuring security streamlines rather than hinders workflows. It also identifies expected challenge areas: the company's perimeter-less network, managing security across multi-cloud offerings (GCP, AWS, Azure, Digital Ocean) and third-party services (Slack, Expensify, etc.), protecting customer data, scaling solutions with company growth, and addressing global team member and customer regulatory and compliance needs.
Jun 2019Ask GitLab Security: Alexander DietrichAlexander Dietrich, a Senior Security Engineer focused on Automation, is contributing to GitLab's Zero Trust initiative by building upon the existing SSO solution. His work involves developing automation tools for the security department to streamline tasks, reduce friction for application security engineers (e.g., automating HackerOne report imports), and laying the groundwork for Zero Trust by enhancing the SSO solution.
Jun 2019When technology outpaces security complianceThis post discusses the evolution of technology outpacing security compliance frameworks. It highlights the shift from traditional network perimeters to modern infrastructure deployment (cloud, CDNs, serverless, containers) and the rise of zero trust. GitLab is on its own journey toward zero trust, and the post advocates for compliance frameworks to evolve to be more relevant and supportive of modern security practices, focusing on customer protection over auditor satisfaction.
May 2019A shift left strategy for the cloudThis post advocates for a Zero Trust approach to application infrastructure and the software development lifecycle (SDLC). It emphasizes treating security as a critical outcome, not a department, and integrating security practices with DevSecOps through automated scans at code commit. It highlights the use of review apps and DAST for early vulnerability detection and resolution. The post also stresses the importance of horizontal security scanning across applications, containers, orchestrators, and access management, advocating for simplicity and integration of security tools within a single platform like GitLab.
Apr 2019The evolution of Zero TrustThis post introduces the historical evolution of Zero Trust Networking, tracing its roots from the 'death of the perimeter' with the rise of firewalls, through the shift to cloud computing, and finally to the era of mobility with VPNs and 2FA. It highlights key events like Operation Aurora and Google's BeyondCorp as catalysts for adopting Zero Trust principles. The post sets the stage for future discussions on how GitLab is tackling Zero Trust.
Advertisement