Understanding zero trust principles

Zero trust really means zero trust, for starters. The principles of zero trust have gained a lot of traction in IT security over the past few years, and for a good reason. Attacks don't just come from the outside, but also from the internal networks in enterprises. Zero trust advocates that any user, or maybe every identity, is authenticated, regardless of whether the user is inside or outside the enterprise's network. When authenticated, the user must be validated against security policies and authorized before access to applications is granted. Data access should only be granted through verified applications to which users are authenticated and authorized.

Before we learn how this would work in DevSecOps, and particularly in Continuous Integration/Continuous Deployment (CI/CD) pipelines, we need to have a deeper look at the principles of zero trust.

Zero trust starts with knowing who's in the enterprise's network. There...