In my first Zero Trust posts last year I wrote that you can never trust any data and that all principles of the Secure Development Lifecycle must be followed. Let me go a bit deeper on that.<\/p>\n
The classic SDL is about building software without vulnerabilities: training, threat modelling, code review, static analysis, testing and a plan for when things go wrong. All of that still applies. What Zero Trust adds is a different assumption: the application can no longer rely on the network to protect it.<\/p>\n
That changes a few things. Every application must know who is calling it, user or service, and verify it on every call, not only at logon. Service accounts and secrets must be treated as identities, not hidden in configuration files. Use managed identities and a key vault and rotate the secrets. Every input must be validated even if it comes from \u2018inside\u2019, because inside doesn\u00b4t mean anything anymore. And the application should log enough for the SOC to see who did what.<\/p>\n
The threat model also changes. Stop drawing a big box called \u2018internal network\u2019 where everything is trusted. Draw the identities instead, and ask what happens when one of them is stolen.<\/p>\n
Zero Trust is not something you bolt on after go live. It starts with the first line of the threat model.<\/p>\n","protected":false},"excerpt":{"rendered":"
In my first Zero Trust posts last year I wrote that you can never trust any data and that all principles of the Secure Development Lifecycle must be followed. Let me go a bit deeper on that. The classic SDL is about building software without vulnerabilities: training, threat modelling, code review, static analysis, testing and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4,13],"tags":[59,60,23],"class_list":["post-1204","post","type-post","status-publish","format-standard","hentry","category-security-architecture","category-technology","tag-sdl","tag-secure-development","tag-zero-trust"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1204","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1204"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1204\/revisions"}],"predecessor-version":[{"id":1232,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1204\/revisions\/1232"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1204"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1204"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1204"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}