pomerium / awesome-zero-trust

A curated collection of awesome resources for the zero-trust security model.

Pomerium builds secure, clientless connections to internal web apps and services without a corporate VPN.

Pomerium is:

• Easier because you don’t have to maintain a client or software.
• Faster because it’s deployed directly where your apps and services are. No more expensive data backhauling.
• Safer because every single action is verified for trusted identity, device, and context.

It’s not a VPN alternative – it’s the trusted, foolproof way to protect your business.

Docs

For comprehensive docs, and tutorials see our documentation.

Contributing

See Contributing for information on how you can contribute to Pomerium.

awesome-zero-trust's Issues

Add software section back

why was it removed? not awesome

new NIST doc

wasn't able to push to a branch, so here's new URL https://doi.org/10.6028/NIST.SP.800-207

Additional Trust

For what its worth, the OSSTMM talks in depth about Trust, and that Trust is a Vulnerability (well before 2010).
Using the OSSTMM to test/measure security can give you an accurate view of your security landscape and where controls are needed or where some are over used (and you can save money by not having redundant controls)

nist 800 207 url update

If you prefer a pr for this let me know.
The nist 207 url in the readme is now out of date, please refer to this one.

• old url now withdrawn
• to be replaced by https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207-draft2.pdf

thanks for this repo.

OSSTMM trust

The OSSTMM addresses trust, and called trust a vulnerability years before zero trust. I really recommend checking out the OSSTMM and chapter 5 covers trust

Add links to relevant projects

• https://zerotier.com
• https://zero.pritunl.com/
• https://github.com/pomerium/pomerium (:D)
• https://github.com/cogolabs/transcend
• more?

You might want to fix the credit line for who created zero trust

Stephen Paul Marsh created Zero trust in 1994.
https://www.stackscale.com/blog/zero-trust-security/
https://en.wikipedia.org/wiki/Zero_trust_security_model

And his original thesis from 1994 https://www.cs.stir.ac.uk/~kjt/techreps/pdf/TR133.pdf
Credit should go where credit is due. It should be telling that someone claims to have invented something
when its a farce.

New Nist document

wasn't able to push to a branch, so here's new URL https://doi.org/10.6028/NIST.SP.800-207