Zero Trust Training Courses with the Linux Foundation

As a major provider of cloud native training material, The Linux Foundation (opens in a new tab) commissioned ControlPlane to author two hands-on courses on how to architect and build secure Zero Trust networks:

• LFS183x (opens in a new tab), a free e-learning course entitled "Introduction to Zero Trust"
• LFS482 (opens in a new tab), a three day, instructor-led course on "Zero Trust Security with SPIFFE and SPIRE"

A Zero Trust approach to networking requires traffic authorisation decisions to be made based on cryptographically verifiable identity documents associated with the entities making the network requests. For humans, we have long-established procedures for obtaining identity documents such as passports, identity cards and driving licenses. These documents can then be used to establish that someone is who they claim to be when they sign up for an application or system account. However, for cloud native, potentially ephemeral workloads, obtaining identity documents by relying on manually provisioned long-lived secrets is not feasible (and not good for security!). Both LFS183x (opens in a new tab) and LFS482 (opens in a new tab) focus on SPIFFE (opens in a new tab) and SPIRE (opens in a new tab) to allow heterogeneous workloads to obtain short-lived, automatically rotated identity documents, without requiring access to a pre-provisioned secret.

Once we have a mechanism for workloads to seamlessly obtain identity documents, we can enforce the principle of least privilege by making authorisation decisions based on these identities, using a policy engine. LFS183x (opens in a new tab) and LFS482 (opens in a new tab) explore in detail how Open Policy Agent (opens in a new tab) can make policy decisions based on structured data.

The final element needed is enforcement of our policy decisions based on identity, and both courses discuss different ways in which this can be achieved. One common architecture which enables Zero Trust is a service mesh, where proxies run alongside workloads to enforce policy, and abstract away service-to-service traffic management from application functionality. Service meshes have some very attractive Zero Trust properties, such as mutual TLS between workloads, with certificates issued by an internal authority within the service mesh control plane.

LFS183x - "Introduction to Zero Trust" (opens in a new tab) and LFS482 - "Zero Trust Security with SPIFFE and SPIRE" (opens in a new tab) are live now - Enrol Today!