Identity Based Segmentation for a ZTA
summary
Advocates replacing perimeter rules with cryptographic identities enforced at the runtime proxy layer, using service mesh proxies (Envoy) with mTLS and SPIFFE certificates for service identity, plus five runtime controls: encryption, service authn, service authz, end‑user authn and end‑user authz. A super control plane pushes uniform policies across meshes and clouds, identity‑aware gateways bridge DMZs to avoid per‑app firewall churn, OPA or NGAC/Zanzibar style decision services evaluate claims, and eBPF can accelerate enforcement; standards work (SP 800‑204/207) documents the approach.
AI-written summary · about
chapters (8)
- 0:00Start
- 4:22Identity Based Segmentation a.k.a. Zero Trust Segmentation
- 5:16Implementing Identity Based Segmentation at Runtime We need a minimum of 5 policy checks on each request in our infrastructure: 1. Encryption in Transit
- 9:47Realizing Identity Based Segmentation with a Service Mesh 1 Encryption in Transit
- 17:18Multi-tier Policies for Enterprise ZTA
- 21:02How to Define and Deploy Identity-tier policies towards an Enterprise ZTA
- 23:05Identity Policies coexists with various Network Policy
- 23:59Advantages of Multi-tier Policy • Identity-tier policies sit on top of your existing network policies
related talks
23mZero Trust: From Airports to Identity-Aware Proxies
19mZero Trust: From Airports to Identity-Aware Proxies
25mRisk-based authentication and zero trust architecture ZTA
18mImplementing Zero Trust at Enterprise Scale
25mIdentity Theft Is Not a Joke, Jim! How Istio Ambient Mesh Safeguards Our Pod...
26mZero Trust: Continuous Verification in the Modern Enterprise
29mZero Trust Security with Service Mesh
29mZero Trust for APIs: From Edge to Mesh with Istio