Implementing Zero Trust
summary
Company moves from single-VPN choke point to a Zero Trust stack, handling ~36 million HTTP requests/sec and ~124 billion blocked attacks/day, by productizing an nginx Lua identity proxy (Cloudflare Access — ~60–70 lines of Lua), issuing YubiKeys and enforcing WebAuthn via the AMR flag labelled "swk" to force adoption, and building cloudflared that mints SSH certificates so SSH/UDP traffic runs over HTTP. Approval flows use a Grouper/Meru fork and a remote browser rasterizes pages to PNG for isolation; result: near-zero account compromises after enforcement.
AI-written summary · about
chapters (8)
- 0:00Start
- 2:21Where did we start?
- 5:14What did we want?
- 6:02The beginning (2015-2017)
- 7:33New beginnings (2018)
- 15:55Security Keys Adoption (2018-2021)
- 19:44Security Keys! (2021-Present)
- 28:24Takeaways
related talks
37mThe Zero Trust Odyssey: Our Journey to Modernize Internal Access
40mClarifying Zero Trust: The Model, the Philosophy, the Ethos
31mEmbracing Zero Trust When You Aren't the World's Largest Internet Company
39mProtect Your Application, Not the Network. Add Zero Trust Superpowers to Your Critical...
23mZero Trust: From Airports to Identity-Aware Proxies
18mImplementing Zero Trust at Enterprise Scale
40mZero Trust, Zero Pain: A Practical Implementation with Intrinsic Security
01h 02mIntroduction to Zero Trust Security