# Zero Trust Zero trust is an evolving cybersecurity paradigm and architecture that requires explicit authentication and authorization for resource access rather than relying on network location. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Constraining AI agents with Red Hat AI: Containment, identity, and governance DevFeed: [Constraining AI agents with Red Hat AI: Containment, identity, and governance]() Original publisher: [Read original article]() Author: Grace Ableidinger Published: 2026-09-16T13:01:59Z Content type: tutorial Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [Artificial Intelligence](), [Security](), [Zero Trust](), [Containers](), [Kubernetes](), [Architecture & Design]() Tags: [ai](), [ai-agents](), [containers](), [deployment](), [kubernetes](), [prompt-injection](), [security](), [trust]() ### AI overview This tutorial explains how to secure AI agents running on Red Hat OpenShift using containment, verifiable identity, and governance. It covers namespace isolation, quotas, sandboxing, workload identity, and admission control, with OpenClaw used in the demo. ### Source excerpt When an agent process runs on your laptop, it typically inherits anything your user has access to. Often this includes the full network stack, the file system, and the credentials sitting in memory. When integrating with GitHub, Slack, or a cloud provider, you could be one faulty permission or well-crafted prompt injection away from a security incident. The post Constraining AI agents with Red Hat AI: Containment, identity, and governance appeared first on Red Hat Developer. ## Build zero-trust AI agents that judge intent, not just syntax DevFeed: [Build zero-trust AI agents that judge intent, not just syntax]() Original publisher: [Read original article]() Author: Eric Dong; Shubham Saboo Published: 2026-09-16T01:23:36.799575Z Content type: article Language: en Sources: [Google Developers Blog]() Topics: [Artificial Intelligence](), [Security](), [Zero Trust]() Tags: [agents](), [ai](), [ai-agents](), [gemini](), [model-context-protocol](), [python](), [security](), [zero-trust]() ### AI overview This blog post explains how to move AI-agent security from static, build-time controls to dynamic runtime governance on the Gemini Enterprise Agent Platform. It covers Model Armor, Semantic Governance Policies, and Agent Anomaly Detection with Closed-Loop Remediation for evaluating intent, enforcing business rules, and detecting multi-turn attacks. ### Source excerpt This blog post explores how to transition AI agents from static, build-time security controls to dynamic runtime governance using the Gemini Enterprise Agent Platform. It highlights three primary managed defenses: Model Armor for screening edge prompts, Semantic Governance Policies for evaluating tool intent against business rules, and Agent Anomaly Detection for catching multi-turn exploits. By shifting these capabilities to the platform level, security administrators can dynamically enforce policies and neutralize complex attacks without needing to modify or redeploy the agent's underlying code. ## Cisco and the DISA STIG: Turning Zero Trust Policy into Repeatable Practice - Part 2: Cisco SNA DevFeed: [Cisco and the DISA STIG: Turning Zero Trust Policy into Repeatable Practice - Part 2: Cisco SNA]() Original publisher: [Read original article]() Author: Norman St. Laurent Published: 2026-09-15T13:13:53Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Cybersecurity](), [Cisco](), [telemetry](), [Zero Trust](), [vulnerability](), [Network]() Tags: [benchmark](), [cisco](), [cisco-secure-network-analytics-sna](), [cybersecurity](), [department-of-defense-dod](), [government](), [hardening](), [industries](), [nist](), [public-sector](), [stig](), [visibility]() ### AI overview The article explains how the DISA Security Technical Implementation Guide for Cisco Secure Network Analytics turns Zero Trust policy into testable configuration requirements. The STIG provides a shared hardening baseline for the platform and its management functions, with 31 requirements derived from NIST SP 800-53 and related requirements. ### Source excerpt Discover how the new DISA STIG for Cisco Secure Network Analytics helps defense organizations securely configure and harden their analytics platform, ensuring trusted network visibility for Zero Trust operations. ## Build zero-trust AI agents with Google's Agent Development Kit DevFeed: [Build zero-trust AI agents with Google's Agent Development Kit]() Original publisher: [Read original article]() Author: Shubham Saboo; Eric Dong Published: 2026-09-12T11:04:33.891311Z Content type: article Language: en Sources: [Google Developers Blog]() Topics: [AI Agent](), [Security](), [Zero Trust](), [Google](), [prompt injection](), [Architecture & Design](), [Code](), [Python](), [Open Source]() Tags: [agent](), [agents](), [ai](), [architecture](), [code](), [google](), [open-source](), [prompt-injection](), [python](), [sandboxes](), [security](), [zero-trust]() ### AI overview This article explains how to build zero-trust AI agents with Google's Agent Development Kit (ADK). It presents an autonomous customer support and returns agent as an example and recommends hard infrastructure-level controls: cryptographic signatures for database writes, kernel-level sandboxing with gVisor for dynamic code execution, and deterministic gateways for validating I/O, business logic, and data leakage. These controls address prompt injection, unauthorized state changes, credential leakage, and host compromise. ### Source excerpt Building autonomous AI agents that mutate production state requires moving beyond soft system prompts to a robust zero-trust architecture. To secure Google Agent Development Kit (ADK) workflows against prompt injections and malicious execution, developers must implement hardware-backed cryptographic signatures for database writes, kernel-level sandboxing with gVisor for dynamic code, and deterministic semantic gateways for I/O validation. By enforcing these hard security boundaries at the infrastructure level, you can safely deploy multi-tool AI agents without risking unauthorized data manipulation or server compromise. ## The Unexpected Winner of Cisco IT's Wi-Fi 7 Upgrade? Security. DevFeed: [The Unexpected Winner of Cisco IT's Wi-Fi 7 Upgrade? Security.]() Original publisher: [Read original article]() Author: Chris Tomazic Published: 2026-09-11T12:30:05Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Security](), [Network](), [Zero Trust]() Tags: [agenticops](), [ai-in-it-operations](), [cisco-it](), [cisco-on-cisco](), [cisco-secure-networking](), [enterprise-networking](), [network](), [network-security](), [network-segmentation](), [security](), [wi-fi-7](), [zero-trust]() ### AI overview Cisco IT's Wi-Fi 7 upgrade delivered expected improvements in connectivity, availability, and performance, but its most significant result was stronger security. The article argues that networking and security should be designed and operated as one system, highlighting zero trust access and Cisco Secure Networking as practical outcomes of that approach. ### Source excerpt Cisco IT's Wi-Fi 7 upgrade delivered more than faster connectivity -- it transformed enterprise security. Discover how Zero Trust Access, AI agents, and secure-by-design infrastructure are redefining what a modern network can do. ## Securing the Modern Workforce: The Evolution of Cisco Umbrella DevFeed: [Securing the Modern Workforce: The Evolution of Cisco Umbrella]() Original publisher: [Read original article]() Author: Negisa Taymourian Published: 2026-09-08T13:00:48Z Content type: article Language: en Sources: [OpenDNS]() Topics: [Cisco Secure Access](), [Security](), [data loss prevention](), [Zero Trust](), [digital experience monitoring](), [ThousandEyes]() Tags: [ai-security](), [cisco](), [cisco-secure-access](), [cloud-security](), [digital-experience-monitoring](), [dlp](), [products-services](), [security](), [security-service-edge-sse](), [thousandeyes](), [zero-trust-network-access]() ### AI overview Cisco Umbrella has evolved into Cisco Secure Access, a cloud-delivered Security Service Edge solution for hybrid work. The platform retains Umbrella's DNS-layer security while adding zero trust network access, data loss prevention, digital experience monitoring powered by ThousandEyes, firewall as a service, and controls for generative AI applications and autonomous AI agents. ### Source excerpt For years, Cisco Umbrella has been the industry gold standard for DNS-layer security. By blocking threats before a connection is even established, it provides IT teams with a critical first line of defense and the visibility needed to keep networks safe. However, the threat landscape has changed. With the rise of hybrid work, the proliferation [...] The post Securing the Modern Workforce: The Evolution of Cisco Umbrella appeared first on Cisco Umbrella. ## Infrastructure identity for platform engineers DevFeed: [Infrastructure identity for platform engineers]() Original publisher: [Read original article]() Author: Sam Barlien Published: 2026-09-08T12:20:22Z Content type: tutorial Language: en Sources: [Platform Engineering Blog]() Topics: [Platform Engineering](), [internal developer platform](), [Zero Trust](), [IAM](), [AI Agent]() Tags: [iam](), [identity](), [internal-developer-platform](), [platform-engineering](), [zero-trust]() ### AI overview A guide for platform engineers on adopting infrastructure identity: assigning cryptographic identities and short-lived, just-in-time access to people, machines, workloads, and AI agents. It argues that this approach can replace static secrets and network-based trust in an internal developer platform. ### Source excerpt Discover how platform engineers can eliminate static secrets and embed Zero Trust into their IDP using short-lived, cryptographic infrastructure identities. ## The Default Deny Dilemma: A Practical Guide to Kubernetes Network Policies DevFeed: [The Default Deny Dilemma: A Practical Guide to Kubernetes Network Policies]() Original publisher: [Read original article]() Author: Wellingtone Luvonga Published: 2026-09-08T03:00:00Z Content type: tutorial Language: en Sources: [CYBERTEC PostgreSQL | Services & Support]() Topics: [Kubernetes](), [Network](), [Security](), [Zero Trust](), [Architecture & Design]() Tags: [blog](), [cni](), [container](), [guide](), [how-to](), [ingress](), [kubernetes](), [network](), [network-security](), [postgersql](), [security](), [test](), [yaml](), [zero-trust]() ### AI overview A hands-on lab for implementing zero-trust network segmentation in Kubernetes with NetworkPolicies. It demonstrates default-deny rules, label-based ingress and egress permissions, DNS access, external API restrictions, and traffic validation in a three-tier frontend, backend, and PostgreSQL architecture enforced by Calico. ### Source excerpt This blog is a deep walkthrough about network policies in Kubernetes, read to know more. The post The Default Deny Dilemma: A Practical Guide to Kubernetes Network Policies appeared first on CYBERTEC PostgreSQL | Services & Support. ## Fine-Grained Access Control Now Available for All Heroku Customers DevFeed: [Fine-Grained Access Control Now Available for All Heroku Customers]() Original publisher: [Read original article]() Author: Alberto Sigismondi Published: 2026-08-21T17:07:29Z Content type: release Language: en Sources: [Heroku]() Topics: [Heroku](), [Access Control](), [Security](), [IAM](), [Zero Trust](), [legacy]() Tags: [access-control](), [deploy](), [heroku](), [iam](), [identity-and-access-management](), [least-privilege](), [legacy](), [news](), [permissions](), [pipelines](), [security](), [security-compliance](), [zero-trust]() ### AI overview Heroku announces that Fine-Grained Access Control is available to all customers. The feature replaces fixed legacy roles with capability-based roles and app-specific permissions for roles such as view, deploy, operate, and manage. ### Source excerpt Fine-Grained Access Controls is now available to all Heroku customers. Heroku's legacy system gave you predefined roles like admin, member, or collaborator, each with a fixed bundle of permissions. It replaces that system with fine-grained roles like view, deploy, operate, and manage, with specific capability sets. Access control is managed at an app-specific layer, giving [...] The post Fine-Grained Access Control Now Available for All Heroku Customers appeared first on Heroku. ## Going Beyond Zero: A New Paradigm For Enterprise Security DevFeed: [Going Beyond Zero: A New Paradigm For Enterprise Security]() Original publisher: [Read original article]() Author: Archana Ramamoorthy Published: 2026-07-27T16:00:00Z Content type: article Language: en Sources: [Security]() Topics: [Security](), [Zero Trust](), [Authorization](), [Artificial Intelligence](), [Model Context Protocol](), [Architecture & Design](), [Google]() Tags: [ai](), [apis](), [enterprise](), [mcp](), [model-context-protocol](), [none](), [security](), [zero-trust]() ### AI overview Google introduces Beyond Zero, a contextual and risk-based enterprise security paradigm designed for the AI era. It extends zero trust into the authorization layer by evaluating every action on specific resources, including actions performed through front ends, APIs, and MCP. ### Source excerpt An IT security team working ## Zero trust architecture for platform engineers: Securing modern developer platforms DevFeed: [Zero trust architecture for platform engineers: Securing modern developer platforms]() Original publisher: [Read original article]() Author: Ajay Chankramath Published: 2026-07-23T05:40:01Z Content type: article Language: en Sources: [Platform Engineering Blog]() Topics: [Zero Trust](), [Security](), [Architecture & Design](), [Platform Engineering](), [Authentication](), [Authorization](), [Cloud](), [Kubernetes](), [Network Segmentation](), [SPIFFE](), [SPIRE]() Tags: [architecture](), [authentication](), [authorization](), [cloud](), [cloud-native](), [developer](), [identity](), [kubernetes](), [network-segmentation](), [platform](), [platform-engineering](), [policy](), [security](), [spiffe](), [spire](), [zero-trust]() ### AI overview This article explains how zero-trust architecture secures cloud-native developer platforms. It describes continuous authentication and authorization, cryptographic service identity through SPIFFE/SPIRE, network segmentation, policy-as-code enforcement, and runtime verification for Kubernetes-based, multi-tenant environments. ### Source excerpt Secure your cloud-native platform with Zero Trust Architecture. Explore ZTA principles, service identity (SPIFFE/SPIRE), and policy-as-code for automated, developer-friendly security ## Private analytics via zero-trust aggregation DevFeed: [Private analytics via zero-trust aggregation]() Original publisher: [Read original article]() Published: 2026-05-27T16:56:00Z Content type: article Language: en Sources: [The latest research from Google]() Topics: [Security, Privacy and Abuse Prevention](), [Security](), [Zero Trust](), [Google](), [On-device AI](), [Artificial Intelligence](), [Android]() Tags: [ai](), [android](), [cryptographic](), [on-device-ai](), [privacy](), [security](), [security-privacy-and-abuse-prevention](), [zero-trust]() ### AI overview Google Research introduces a private analytics solution that combines cryptographic secure aggregation with the transparency and attestation properties of trusted execution environments. The design follows a zero-trust principle so Google can obtain only anonymized, aggregated population insights while individual user data remains protected. The article discusses applications of federated analytics and on-device technologies, including Android SafetyCore, Pixel Recorder, and Gboard. ### Source excerpt Security, Privacy and Abuse Prevention ## How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs DevFeed: [How to Extend SPIFFE Beyond Kubernetes: Bring Zero Trust Identity to Your VMs]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeffrey Ellin) Published: 2026-05-21T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [SPIFFE](), [Zero Trust](), [certificates](), [istio](), [Kubernetes]() Tags: [api](), [certificates](), [istio](), [kubernetes](), [mesh](), [spiffe](), [zero-trust]() ### AI overview This tutorial explains how to extend SPIFFE-based zero-trust workload identity beyond Kubernetes to VMs, edge gateways, and legacy services. It describes separating identity issuance from consumption, using short-lived identities through a local API, with Envoy consuming identity via SDS and Teleport managing the trust chain. ### Source excerpt Discover how Envoy + SDS and Teleport Workload Identity let off-cluster workloads securely call Istio services without distributing certificates. ## How Claude Helped Build a Proxmox Environment (and What I Learned Along the Way) DevFeed: [How Claude Helped Build a Proxmox Environment (and What I Learned Along the Way)]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Oakley) Published: 2026-04-24T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Claude](), [Homelab](), [Proxmox](), [Ansible](), [Terraform](), [rhel 10](), [Zero Trust](), [Windows](), [ssh]() Tags: [ansible](), [claude](), [homelab](), [proxmox](), [rhel-10](), [ssh](), [terraform](), [windows](), [zero-trust]() ### AI overview Steven Oakley describes using Claude with Terraform and Ansible to build and migrate a Proxmox homelab. The project includes RHEL 10 and Windows infrastructure, automated domain deployment, and Teleport agent connections to self-hosted and cloud environments. ### Source excerpt Enterprise Solutions Engineer Steven Oakley walks through building a Proxmox homelab using Claude as an engineering assistant and the lessons learned along the way. ## Reverse Proxy: How It Works & Example Architecture DevFeed: [Reverse Proxy: How It Works & Example Architecture]() Original publisher: [Read original article]() Author: info@goteleport.com (Peter ONeill) Published: 2026-04-21T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Architecture & Design](), [servers](), [Authentication](), [Authorization](), [Keycloak](), [Virtual Private Network](), [TLS (Transport Layer Security)](), [Zero Trust](), [Back end]() Tags: [architecture](), [authentication](), [authorization](), [keycloak](), [network](), [proxy](), [reverse-proxy](), [tls](), [zero-trust]() ### AI overview This article explains what reverse proxies are, how they process inbound requests, how they differ from VPNs, and how identity-aware reverse proxy architectures can use Envoy and Keycloak. It describes functions including TLS termination, identity-token validation, per-route authorization, path rewriting, and access logging. ### Source excerpt Learn what reverse proxies are, how they work, how they compare to VPNs, and what an example architecture looks like. ## NIST and AI agents: 1Password's approach to agent identity DevFeed: [NIST and AI agents: 1Password's approach to agent identity]() Original publisher: [Read original article]() Author: info@1password.com (Jacob DePriest; Nancy Wang; Jeff Malnick) Published: 2026-04-08T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [AI Agent](), [Authorization](), [Authentication](), [Zero Trust](), [Security](), [Artificial Intelligence](), [identity and access management](), [interoperability](), [IAM](), [Deployment](), [Architecture & Design]() Tags: [ai](), [ai-agents](), [authentication](), [deployment](), [iam](), [identity-and-access-management](), [interoperability](), [security](), [zero-trust]() ### AI overview This article presents 1Password's approach to agent identity for AI agents. It describes identity as a set of challenges involving identification, attestation, enrollment, authentication, and authorization, with an emphasis on interoperability, continuous access decisions, and Zero Trust for reasoning workloads. ### Source excerpt NIST published a concept paper stating, "Organizations need to understand how identity principles such as identification, authentication, and authorization can apply to agents to provide appropriate protections while enabling business value." This post, and the series that follows, is 1Password's response to NIST's call for input on how those principles should apply to agents. At 1Password, we approach security through simplicity. We are developing an agent identity architecture to simplify and enhance the security of AI agents, ensuring interoperability with existing systems. Our approach is built in collaboration with customers, partners, and the standards community. As part of this work, we recently responded to NIST's AI agent authorization paper. Our view is that agent identity is not a single problem. It is a set of challenges spanning identification, attestation, enrollment, authentication, and authorization for machine workloads with reasoning capabilities. The ability to reason is what sets AI agents apart from traditional machine workloads. This post is the first in a multi-part series on why agent-driven systems require us to rethink identity to enable continuous authentication and authorization for reasoning agents, and how that shapes both our response to NIST and our own approach to agent identity. The agent identity problem Where traditional machine workloads have a "set and forget" policy, the nature of reasoning workloads means a static policy can become out of date as the agent interprets and takes its next action. Agents that automatically deploy software are a great example of this escalation chain. A deployment agent begins with access to QA resources, but its access needs evolve when tests pass and may then require access to production services. The principle of Zero Trust maintains that you should provide only the minimum access needed, but infinitely evolving logic makes it difficult to apply the correct access for the lifetime of an agent pr ## Go beyond device health with External Checks in 1Password Device Trust DevFeed: [Go beyond device health with External Checks in 1Password Device Trust]() Original publisher: [Read original article]() Author: info@1password.com (1Password) Published: 2026-04-02T00:00:00Z Content type: article Language: en Sources: [Blog on 1Password Blog]() Topics: [Device Trust](), [Zero Trust](), [API](), [Security](), [MFA]() Tags: [api](), [compliance](), [device-trust](), [external](), [mfa](), [security](), [zero-trust]() ### AI overview 1Password Device Trust now supports custom External Checks that use signals from third-party systems, such as compliance status, policy acknowledgments, MFA enrollment, and employment status, in access decisions for protected applications. ### Source excerpt Most organizations already have the policies they need in place. The problem is enforcement. Employees must complete security awareness training, contractors must acknowledge updated agreements, and teams must meet compliance requirements. But the systems that track these requirements rarely connect to the systems that control user and device access. As a result, access is granted even when required conditions haven't been met. That's why we're excited to announce that 1Password Device Trust can now take signals from other systems into account before allowing users to reach sensitive company apps and data. External Checks in Device Trust Until now, 1Password Device Trust focused primarily on device telemetry. That meant administrators could block employees from accessing company resources if their device failed to meet certain requirements, but they couldn't enforce compliance based on signals that live outside of the device. With the ability to create custom External Checks, that changes. Access to protected apps can now depend on: User compliance status Policy acknowledgments MFA enrollment status Active employment status Many other external verification signals Access decisions are no longer limited to what's happening on the device. They reflect whether the user of the device has met required conditions across systems. How External Checks work Administrators configure an External Check by connecting Device Trust to a third-party system via API. That external system becomes a source of truth for a specific requirement, such as whether a user has completed training or acknowledged a required policy. When a user attempts to access a protected application: Device Trust evaluates device posture as it does today. Device Trust sends a request to the configured external system. The external system returns a simple result: pass or fail. Device Trust incorporates that result into the overall access decision. If the check passes, access proceeds normally. If the check fail ## New integrations between 1Password SaaS Manager and EPM DevFeed: [New integrations between 1Password SaaS Manager and EPM]() Original publisher: [Read original article]() Author: info@1password.com (1Password) Published: 2026-03-31T00:00:00Z Content type: news Language: en Sources: [Blog on 1Password Blog]() Topics: [Software as a service](), [passwords](), [Single sign-on (SSO)](), [Zero Trust](), [Extension](), [Authorization](), [App](), [SOC]() Tags: [app](), [browser](), [compliance](), [enterprise](), [extension](), [integrations](), [news](), [passwords](), [saas](), [saas-management](), [soc](), [zero-trust]() ### AI overview 1Password announces integrations between Enterprise Password Manager and SaaS Manager to help IT teams discover, assess, and govern shared and sensitive non-SSO accounts. The features include vault and browser insights, account risk reporting, and transferring account control to IT, extending access governance beyond SSO. ### Source excerpt Most organizations can tell you which apps sit behind SSO. Far fewer can tell you what other apps teams are using, or who has access to the credentials. Shared and sensitive non-SSO logins remain some of the hardest access paths to govern. Credentials are often tied to individuals, scattered across vaults and browsers, and difficult to rotate or revoke when roles change. For many teams, this creates a gap in their Zero Trust strategy. For the last several months, we've been hard at work connecting 1Password Enterprise Password Manager and SaaS Manager to help close that gap. Today, we're announcing several integrated features that help IT admins discover and govern shared and sensitive logins. EPM and SaaS Manager integration demo Want to see how these integrations work in action? Check out our self-guided, interactive demo. Try the demo Extending governance beyond SSO For more than a decade, 1Password Enterprise Password Manager (EPM) has helped thousands of businesses securely store and manage credentials and secrets. More recently, SaaS Manager has helped organizations discover shadow IT, manage employee access, and control SaaS spending. Now, we're bringing these solutions together. When customers use Enterprise Password Manager and SaaS Manager together, they gain new capabilities: Vault insights: Discover SaaS accounts from 1Password vault credentials for better IT visibility into sensitive and shared app use. Browser insights: Reveal login activity from the 1Password browser extension to show app usage, even when credentials aren't saved in a company vault. Account risk report: Identify high-risk accounts based on access risk, data sensitivity, privileges, and attack patterns. Account governance: Transfer control of sensitive accounts to IT to enable secure access control and auditability without exposing passwords. Together, these capabilities extend Zero Trust governance beyond SSO and ensure that organizations can discover and secure credential-based acces ## Zero Trust Architecture: From Perimeter Walls to "Never Trust, Always Verify" DevFeed: [Zero Trust Architecture: From Perimeter Walls to "Never Trust, Always Verify"]() Original publisher: [Read original article]() Author: hello@ankit-rana.com Published: 2026-03-16T00:00:00Z Content type: tutorial Language: en Sources: [Ankit Rana | Mechanical Sympathy]() Topics: [Zero Trust](), [Architecture & Design](), [Encryption](), [least privilege](), [zero trust network access](), [Authentication](), [Authorization](), [Monitoring](), [Network]() Tags: [architecture](), [authentication](), [cloud](), [encryption](), [identity-and-access](), [least-privilege](), [monitoring](), [network](), [network-security](), [observability](), [security](), [security-architecture](), [zero-trust](), [zero-trust-network-access](), [ztna]() ### AI overview This article explains Zero Trust Architecture as a security model that assumes the network may already be compromised. It contrasts Zero Trust with perimeter security and describes explicit verification, contextual authorization, least privilege, encryption, segmentation, and continuous monitoring. It also distinguishes the broader ZTA model from Zero Trust Network Access (ZTNA). ### Source excerpt Zero Trust starts from the assumption that the network is already compromised, so every request is authenticated, authorised, and encrypted regardless of where it originates. It rests on explicit verification, least privilege, micro-segmentation, continuous monitoring, and encryption everywhere. It is an architectural direction, not a product you buy. ## CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration DevFeed: [CockroachDB Plans Native X.509 SAN Support for SPIFFE and SPIRE Integration]() Original publisher: [Read original article]() Author: Sanchit Khanna,Biplav Saraf Published: 2026-03-13T00:00:00Z Content type: article Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [Databases](), [SPIFFE](), [SPIRE](), [certificates](), [Zero Trust](), [Security](), [Microservice]() Tags: [architectures](), [auditability](), [aws-iam](), [certificates](), [cockroachdb](), [compliance](), [cryptographic](), [database](), [distributed](), [processor](), [regex](), [security](), [soc](), [soc-2](), [spiffe](), [spire](), [standards](), [teams](), [verification](), [zero-trust]() ### AI overview The article previews planned CockroachDB authentication support for Subject Alternative Name fields in X.509 certificates. It explains how SAN support is intended to enable integration with SPIFFE and SPIRE and support regex-based identity mapping for cloud-native workloads. ### Source excerpt In the evolution of cloud-native security, identity has become the new perimeter. ## How to Secure Microservices with SPIFFE and Istio DevFeed: [How to Secure Microservices with SPIFFE and Istio]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeff Ellin, Boris Kurktchiev) Published: 2026-02-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [istio](), [Microservices](), [SPIFFE](), [Zero Trust](), [Authorization](), [Architecture & Design](), [Secrets Management](), [certificates]() Tags: [architecture](), [authorization](), [backend](), [certificates](), [cloud-native](), [firewalls](), [how-to](), [istio](), [kubernetes](), [microservices](), [policies](), [secrets-management](), [security](), [service-mesh](), [spiffe](), [zero-trust]() ### AI overview This guide explains how to secure microservices with SPIFFE identities, Istio service-mesh mTLS, short-lived certificates, and Zero Trust authorization policies. It addresses the limits of network-based trust and long-lived certificates in dynamic Kubernetes environments. ### Source excerpt Learn how to deploy a secure microservices application, configure default-deny authorization policies, and rebuild service connectivity with SPIFFE-based allow rules. ## CockroachDB v26.1 Adds Security and Compliance Features DevFeed: [CockroachDB v26.1 Adds Security and Compliance Features]() Original publisher: [Read original article]() Author: David Bressler Published: 2026-02-03T00:00:00Z Content type: release Language: en Sources: [Cockroach Labs]() Topics: [CockroachDB](), [Security](), [data-governance](), [Zero Trust](), [Cloud](), [Databases](), [JSON Web Tokens](), [OpenID connect (OIDC)](), [Self-hosted](), [Azure]() Tags: [azure](), [cloud](), [cockroachdb](), [compliance](), [data-governance](), [database](), [encryption](), [jwt](), [oidc](), [security](), [self-hosted](), [zero-trust]() ### AI overview CockroachDB v26.1 introduces security and compliance improvements for CockroachDB Cloud and self-hosted deployments. The release includes data governance and zero-trust access controls for AI agents, expanded HIPAA and PCI/DSS compliance participation on Azure, and identity integrations using JWT and OpenID Connect. ### Source excerpt Enterprise security is a key factor in reducing cost-of-ownership and getting new solutions into production efficiently. With CockroachDB v26.1, available as of February 3rd in CockroachDB Cloud and February 18th for CockroachDB self-hosted, we are introducing security improvements that help organizations integrate CockroachDB more seamlessly with their existing security infrastructure. ## Branch-Based Deployments with Private Staging on Cloudflare DevFeed: [Branch-Based Deployments with Private Staging on Cloudflare]() Original publisher: [Read original article]() Author: EduuhMuraya Published: 2026-01-14T00:00:00Z Content type: tutorial Language: en Sources: [EduuhMuraya]() Topics: [Cloudflare](), [Cloudflare Access](), [Deployment](), [Authentication](), [GitHub Actions](), [Zero Trust](), [Amazon Route 53](), [API](), [hosting](), [OAuth]() Tags: [api](), [authentication](), [cloudflare](), [cloudflare-access](), [deployment](), [dns](), [github](), [github-actions](), [hosting](), [my-blog](), [oauth](), [self-hosted](), [zero-trust]() ### AI overview A practical guide to deploying a blog's production and private staging environments with Cloudflare Pages, protecting staging with Cloudflare Access and email OTP authentication, and automating deployments through GitHub Actions. ### Source excerpt How I use Cloudflare Pages for deployments and Cloudflare Access to protect my staging environment with email OTP authentication. ## Zero Standing Privileges vs Credential Vaulting DevFeed: [Zero Standing Privileges vs Credential Vaulting]() Original publisher: [Read original article]() Author: jpitts@goteleport.com (Jack Pitts) Published: 2025-10-28T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [Zero Trust](), [Security](), [legacy](), [passwords](), [ssh](), [API]() Tags: [api](), [legacy](), [password](), [rotation](), [secrets](), [security](), [ssh](), [vault](), [vulnerability](), [zero-trust]() ### AI overview This article compares credential vaulting with vault-free, just-in-time and identity-based approaches to privileged access management. It examines how stored and reusable credentials may preserve standing privileges and create operational and security challenges when organizations pursue Zero Standing Privileges. ### Source excerpt Discover how Zero Standing Privileges (ZSP) compares to credential vaulting in privileged access management and why vault-free PAM is key to true ZSP. [Next page]()