Zero-trust networking
Zero-trust networking is a security architecture that grants no implicit trust based on network location or prior access and verifies and authorizes access requests explicitly.
Authorization in Action
A zero-trust environment is a security architecture that grants no implicit trust based solely on network location or system boundary.
- How it is used
- Replaces perimeter-based trust with continuous, contextual authorization for distributed users, services, and resources.
- How deep it goes
- Explains the architectural decision flow, policy layers, enforcement options, governance signals, and progress indicators without prescribing one product.
- Examples
- Uses company-managed-device and after-hours safeguards alongside ownership, membership, relationship, and attribute-based policy patterns.
- What you can do after
- Evaluate/understand how to replace implicit network trust with consistent policy decisions and assess architectural progress.
Read how Authorization in Action explains zero-trust networking →
Secure APIs
A security model that continuously verifies requests, denies implicit trust, and grants only explicitly authorized access regardless of network location or origin.
- How it is used
- Applies security-by-design principles to API requests, responses, internal services, third-party systems, databases, and operational traffic.
- How deep it goes
- Explains the trust failure, access principles, validation practices, monitoring, and lifecycle placement, while deferring detailed policy implementation.
- Examples
- Uses complex API data flows, an e-commerce catalog, internal-API exposure, DTOs, parameterized queries, and fuzz-testing tools.
- What you can do after
- Apply it by validating all data, enforcing explicit access controls, protecting internal APIs, and testing implementations with security tools.
Effective Platform Engineering
A zero-trust network control restricts network access based on explicit verification and policy rather than implicit trust in network location.
- How it is used
- Applies security assessment to every connected system without treating network location as an implicit trust boundary.
- How deep it goes
- Explains the principle, contrasts network-layer enforcement, and works through service-only API access without detailing implementation internals.
- Examples
- Uses Epetech’s service-only APIs, IP and pod-network rules, and a REGISTRY_ONLY outbound traffic policy.
- What you can do after
- Apply it by securing systems independently and enforcing portable trust requirements through platform policy-as-code.
Read how Effective Platform Engineering explains zero-trust networking →
Google Anthos in Action
A zero-trust policy requires each access request to be explicitly authenticated and authorized instead of trusting a network location by default.
- How it is used
- Implements identity-based access controls for hybrid clusters, service-to-service traffic, users, and Google Cloud APIs.
- How deep it goes
- Explains certificate authorities, workload identities, mTLS, claims-aware policies, and API boundaries, while deferring detailed policy procedures.
- Examples
- Uses regulated hybrid applications, pod-to-pod restrictions, JWT claims, and managed or enterprise-configured certificate authorities.
- What you can do after
- Apply declarative identity, encryption, and authorization controls without modifying application code.
Read how Google Anthos in Action explains zero-trust networking →
Software Security for Developers
The zero-trust principle is a security approach that requires continuous verification and grants no implicit trust based on network location or prior access.
- How it is used
- Protects service-to-service and external requests by replacing implicit network trust with identity verification and authorization.
- How deep it goes
- Explains the principle through a concrete impersonation failure and surveys tokens, signing, mTLS, gateways, and replay protection.
- Examples
- Uses a Kubernetes debug pod, forged service header, fake invoices, request signing, and service-mesh sidecars.
- What you can do after
- Apply it by requiring verifiable service identity, authenticating every request, enforcing authorization, and rejecting replayed credentials.
Read how Software Security for Developers explains zero-trust networking →
Microsoft Azure in Action
Zero trust is a security model that grants no implicit trust and continuously verifies each identity and access request before authorizing resource access.
- How it is used
- Applies deny-by-default identity controls across Azure resources, using Entra ID to manage authentication and authorization.
- How deep it goes
- Explains the access principle and connects it to Entra ID, MFA, and RBAC, but stops short of detailed network-policy configuration.
- Examples
- Demonstrates creating an Entra ID user, withholding default access, and granting scoped permissions to subscriptions or resources.
- What you can do after
- Configure it through Entra ID by creating identities, requiring MFA, and assigning narrowly scoped RBAC permissions.
Read how Microsoft Azure in Action explains zero-trust networking →
Related concepts
- authenticationuses · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- principle of least privilegehas part · The principle of least privilege is a security principle that grants each user, process, or other subject only the access rights necessary for its authorized tasks.
- authorizationuses · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.