Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 35 hours
Course Outline
Foundations of Zero Trust
- Transitioning from perimeter-based security to the Zero Trust model
- Core Zero Trust tenets: never trust, always verify, and the principle of least privilege
- The NIST SP 800-207 Zero Trust Architecture framework
- Comparing Zero Trust with conventional network security approaches
- The open-source ecosystem available for Zero Trust deployments
Key Components of Zero Trust Architecture
- Treating identity as the primary security boundary
- Validating device trust and security posture
- Network segmentation and micro-segmentation strategies
- Protecting application workloads
- Data classification and safeguarding methods
- Configuring policy enforcement points and policy decision points
Establishing an Identity Foundation for Zero Trust
- Identity providers such as Keycloak, Authentik, and Dex
- Integrating OAuth 2.0, OIDC, and SAML
- Implementing multi-factor authentication (MFA)
- Risk-based authentication and step-up verification
- Managing the identity lifecycle
- Process for identity proofing and verification
Device Trust and Posture Assessment
- Device enrollment and attestation procedures
- Verifying device compliance using tools like Kolide and OSQuery
- Integrating endpoint detection and response (EDR) capabilities
- Using certificates for device authentication
- Incorporating MDM systems for posture data
- Performing continuous device trust evaluations
Network-Level Zero Trust Implementation
- Concepts of Software-Defined Perimeter (SDP)
- Open-source SDP solutions and implementations
- Achieving micro-segmentation with OVN, Cilium, and Calico
- Architecting Zero Trust Network Access (ZTNA)
- Replacing traditional VPNs with zero trust access methods
- Defining network policies as code
Identity-Aware Proxies and Access Gateways
- Architecture of Pomerium as an identity-aware proxy
- Integrating vouch-proxy with nginx/Apache
- Deploying and configuring OAuth2 Proxy
- Utilizing Traefik with forward authentication
- Configuring Kong Gateway with OIDC plugins
- Setting up and enforcing access policies
Service Mesh in Zero Trust Environments
- Using service mesh as the zero trust fabric
- Configuring Istio for zero trust requirements
- Deploying Linkerd with secure patterns
- Enforcing mTLS everywhere for service-to-service authentication
- Using SPIFFE/SPIRE for workload identity
- Defining authorization policies within the service mesh
- Managing trust domains in multi-cluster service meshes
PKI and Certificate Management
- Certificate-based authentication in zero trust contexts
- Using Smallstep CA for workload identities
- Leveraging the HashiCorp Vault PKI engine
- Automating certificate rotation and lifecycle
- Establishing internal trust via private CAs
- Monitoring certificate transparency
Secrets Management
- Managing secrets with HashiCorp Vault
- Using Sealed Secrets in Kubernetes
- Implementing the External Secrets Operator
- Utilizing SOPS (Secrets OPerationS)
- Dynamic secrets and automatic rotation mechanisms
- Patterns for secret injection into applications
Policy as Code and Authorization
- Fundamentals of Open Policy Agent (OPA)
- Basics of the Rego policy language
- Integrating OPA with Kubernetes admission control
- Using OPA with Envoy for service authorization
- Applying OPA to API gateways
- Testing and validating policies
- Integrating Apache APISIX with OPA
API Security in Zero Trust
- Security patterns for API gateways
- Using Kong open source with security plugins
- Implementing rate limiting and DDoS protection
- API authentication and authorization strategies
- Security considerations for GraphQL
- Discovering APIs and detecting shadow APIs
Data Protection and DLP
- Frameworks for data classification
- Integrating open-source DLP tools
- Encryption of data in transit and at rest
- Strategies for tokenization and data masking
- Defining data loss prevention policies
- Handling sovereign data within zero trust frameworks
Continuous Authentication and Authorization
- Session management in zero trust environments
- Mechanisms for continuous authentication
- Making context-aware access decisions
- Applying risk scoring and dynamic authorization
- Triggering step-up authentication events
- Enforcing policies in real-time
Monitoring and Observability in Zero Trust
- Collecting security telemetry
- Integrating SIEMs with open-source tools
- User and Entity Behavior Analytics (UEBA)
- Generating audit logs and compliance reports
- Detecting anomalies using machine learning
- Creating security dashboards and alerts
Zero Trust for Cloud-Native Workloads
- Securing containers in a zero trust context
- Managing ephemeral workload identities
- Enforcing zero trust via admission controllers
- Implementing runtime security with Falco and Tetragon
- Defining network policies for container segmentation
- Adopting immutable infrastructure patterns
Implementing a Zero Trust Roadmap
- Conducting maturity assessments and gap analysis
- Following a phased implementation approach
- Designing and executing pilot projects
- Managing change and driving user adoption
- Measuring success through zero trust metrics
- Avoiding common challenges and pitfalls
Production Deployment and Operations
- Designing for high availability
- Disaster recovery for zero trust infrastructure
- Optimizing performance strategies
- Troubleshooting authentication and authorization issues
- Upgrading and patching zero trust components
- Creating documentation and runbooks
The Future of Zero Trust and Open Source
- Emerging standards and protocols
- Considerations for quantum-safe zero trust
- Role of AI/ML in zero trust decision-making
- Federated zero trust architectures
- Community resources and ongoing development
- Summary and recommended next steps
Requirements
- A strong understanding of network security concepts and principles
- Experience with identity and access management systems
- Knowledge of PKI, certificates, and encryption fundamentals
- Familiarity with microservices and container architectures
- Experience deploying and managing open-source software
Audience
- Security Architects and Engineers
- Infrastructure Architects designing modern security postures
- DevSecOps Engineers implementing security pipelines
- Network Administrators transitioning to zero trust models
