This article helps you, as a developer, to understand the guiding principles of Zero Trust so that you can improve your application security. You play a key role in organizational security. Applications and their developers can no longer assume that the network perimeter is secure. Compromised applications can affect the entire organization.
Organizations are deploying new security models that adapt to complex modern environments and embrace the mobile workforce. New models protect people, devices, applications, and data wherever they're located. Organizations are striving to achieve Zero Trust, a security strategy and approach for designing and implementing applications that follow these guiding principles:
Verify explicitly
Use least privilege access
Assume breach
Instead of believing everything behind the corporate firewall is safe, the Zero Trust model assumes breach and verifies each request as though it originated from an uncontrolled network. Regardless of where the request originates or what resource it accesses, the Zero Trust model requires us to never trust, always verify.
Understand that Zero Trust isn't a replacement for security fundamentals. With work originating from anywhere on any device, design your applications to incorporate Zero Trust principles throughout your development cycle.
Why develop with a Zero Trust perspective?
We see a rise in the level of sophistication of cybersecurity attacks.
The work from anywhere workforce redefined the security perimeter. Data is being accessed outside the corporate network and shared with external collaborators such as partners and vendors.
Corporate applications and data are moving from on-premises to hybrid and cloud environments. Traditional network controls can no longer be relied on for security. Controls need to move to where the data resides on devices and inside apps.
The development guidance in this section helps you to increase security, reduce the blast radius of a security incident, and swiftly recover with Microsoft technology.
Developer guidance overview
What do we mean by Zero Trust compliance? provides an overview of application security from a developer's perspective to address the guiding principles of Zero Trust.
Register applications introduces developers to the application registration process and its requirements. It helps them to ensure that apps satisfy Zero Trust principles of use least privileged access and assume breach.
Authenticate users for Zero Trust helps developers to learn best practices for authenticating application users in Zero Trust application development. It describes how to enhance application security with the Zero Trust principles of least privilege and verify explicitly.
Develop delegated permissions strategy helps you to implement the best approach for managing permissions in your application and develop with Zero Trust principles.
Manage tokens for Zero Trust helps developers to build security into applications with ID tokens, access tokens, and security tokens that they can receive from the Microsoft identity platform.
Customize tokens describes the information that you can receive in Microsoft Entra tokens and how you can customize tokens.
API Protection describes best practices for protecting your API through registration, defining permissions and consent, and enforcing access to achieve your Zero Trust goals.
Call an API from another API helps you to ensure Zero Trust when you have one API that needs to call another API. You learn how to securely develop your application when it's working on behalf of a user.
Authorization best practices helps you to implement the best authorization, permission, and consent models for your applications.
Secure the DevOps platform environment helps you to implement Zero Trust principles in your DevOps platform environment and highlights best practices for secret and certificate management.
Secure the developer environment helps you to implement Zero Trust principles in your development environments with best practices for least privilege, branch security, and trusting tools, extensions, and integrations.
Zero Trust is not a product or tool, but an essential security strategy that seeks to continuously verify every transaction, asserts least privilege access, and assumes that every transaction could be a possible attack. Through the modules in this learning path, you'll gain an understanding of Zero Trust and how it applies to identity, endpoints, applications, networks, infrastructure, and data.