Zero Trust: The Good Parts

The talk covers a three-year effort at Cloudflare to replace VPN-based perimeter access with zero trust identity and access management across a workforce of a few thousand people. It starts from the premise that access should never depend on network position or IP address, and explains why cloud services, DevOps and containers made the old model unworkable.

The rollout began with web applications. The team built an identity-aware proxy that checked identity provider logins and issued session cookies, then placed a small set of internal tools behind it to show value before protecting everything. Hardware security keys replaced weaker second factors, with keys mailed to staff and enforcement phased in, first on a handful of sensitive applications and later across the board. Access control moved from subnet-based rules tracked in spreadsheets to identity provider groups. For SSH and other raw TCP services, the team tunneled TCP over an HTTP/2 connection and tested short-lived SSH certificates.

The later sections turned to device identity. Corporate machines received WireGuard clients tied to device serial numbers, and client certificates for mutual TLS were being phased in, with endpoint posture checks delegated to specialist vendors. Experimental work included an SSH client compiled to WebAssembly in the browser and a remote browser running on the edge. The main takeaways are to enforce a phishing-resistant second factor, solve both HTTP and non-HTTP access, and build strong device identity.