GoDaddy has successfully implemented a zero trust security model to enhance agility and security across its organization. By adopting this approach, GoDaddy ensures that every user and device is continuously authenticated and authorized, minimizing potential security risks.

In this video, GoDaddy's Director of Information Security shares best practices for enabling agility within a zero trust environment:

• Organizational separation and isolation: Each organizational unit operates within isolated environments, ensuring that development accounts are segregated by account boundaries. This enhances security by limiting potential attack surfaces.

• Dedicated VPCs with isolated subnets: Every account is set up with its own Virtual Private Cloud (VPC), featuring isolated subnets and private IPs to securely contain resources within their designated environments.

• Daily node rotation with updated Golden AMIs: GoDaddy performs daily rotations of nodes using updated Golden Amazon Machine Images (AMIs). This extends from individual EC2 instances to entire EKS clusters, eliminating the need for traditional patching processes.

• Custom configuration scanning tools: Open-source tools developed by GoDaddy allow for configuration scans, ensuring adherence to internal security standards, maintaining compliance and consistency across the organization.

• Elimination of VPC peering: By disallowing VPC peering, GoDaddy prevents horizontal movement within the network. Instead, accounts communicate through NAT Gateways, enabling quick isolation to reduce the blast radius in case of a compromise.

• Governed account creation via cloud portal: A centralized cloud portal governs account creation, performing Cloud Readiness Reviews to ensure applications follow best practices and security standards. Approved applications are onboarded through the portal, with baseline environments created using security-approved CloudFormation templates.

By integrating these practices, GoDaddy effectively balances security and agility, enabling rapid development and deployment within a robust Zero Trust framework.

Watch the full video to gain deeper insights into GoDaddy's approach to Zero Trust security.