The Zero Trust Security Handbook

The complete guide to transforming your approach to AppSec, from the inside out
An application security career guide featuring contributions from industry veterans
Mark Willis, Tanya Janca, Brian Levine, Derek Fisher, and Ashish Rajan!
Read a brief summary of the ebook 👇

What is Zero Trust?

Before the concept of a ‘Zero Trust Network’ was introduced in 2010 by Forrester Research analyst John Kindervag, networks were protected using the perimeter model of security. Think of it like a castle surrounded by a large moat: all your trusted users and precious resources were within the castle walls, safeguarded from the outside world by the moat. Only those who were given access to cross the moat were allowed inside the castle, but once they were inside, they had free access to most parts of the castle. It’s pretty simple, and it makes sense, right?

Just one problem: what if someone managed to get inside without authorisation? Maybe they disguised themselves as a trusted user, or found a way to cross the moat without raising the alarm? Now the castle has a dangerous outsider roaming its innermost sanctums, and no protocols have been established to even look for—let alone identify—the intruder.

How does Zero Trust address this issue?

Zero trust is the direct answer to the issues with the perimeter model, both on a conceptual and technological level.

As a concept, zero trust says that your network can’t implicitly trust users to be who they purport to be. Any device or user trying to access resources on the private network needs to verify their identity first, regardless of whether they’re within the network perimeter or not. The system assumes that there are always attackers present within the network, so no user can be trusted by default.

This is just a short excerpt of our ebook. Get the full copy for free by clicking here.

Principles of Zero Trust

While the technical implementation of the zero trust model can vary wildly from one organisation to the next, there are several core principles or practices you need to follow in order for it to be effective.

Here are the 6 main principles of zero trust:
How to Adopt Zero Trust at Your Organisation

Zero trust isn’t a singular milestone or ‘event’ that you can reach simply by implementing the right security controls. It’s a complex, multi-stage process that involves making incremental changes to your system, assessing the needs of the tech stack, and gradually adopting more secure practices and technologies at every level of your organisation. This, as you might imagine, takes time and consistent effort. 

It helps to break down the process of zero trust adoption into various stages or levels of maturity, letting you answer questions like:

There are typically 5 stages to implementing zero trust at your organisation:

Implement zero trust. Build a bulletproof network. All with one ebook.

Get your free copy of the Zero Trust Handbook here:

Hands-on. Defensive. Bleeding-Edge.

There's no other training platform that does all three. Except AppSecEngineer.
Get Our Newsletter
Get Started

Contact Support

1603 Capitol Avenue,
Suite 413A #2898,
Cheyenne, Wyoming 82001,
United States

Copyright AppSecEngineer © 2023