I am very jaded against "zero trust". Google had a nice publication now everyone and their mother have a "zero trust" something. Just ask people what the diffe

I am very jaded against "zero trust". Google had a nice publication now everyone and their mother have a "zero trust" something. Just ask people what the difference between zero trust and role based access control is. If you have rbac and everything uses it, is that zero trust? A smart policy engine like... Windows AD? To me "zero trust" just means do authentication the right way for everything. You can ask 10 security companies what it means and you will get 10 diffrent answers. I fear the hype train is drowning the architectural philosophy. Ideally, if I ping a device in some random subnet unless I am authenticated and authorized to specifically reach that node and this authorization is audited routinely my icmp packet should never reach the destination. In reality,nothing out there is that granular so people define it at diffrent levels of granularity and scope and have their own zero trust. Also, Cisco's TACACS+ was made for this. 802.1x was suppose to enable NAC for this as well (for those who don't know TACACS supports granular authorization like sudo-ish) people just never took it that far. Zero trust is easily hijacked as a marketing slang, maybe something like "authenticated explicit authorization" is better to avoid the awkardity of having to debate "no,I don't think that is zero trust",especially given how people are trying to apply it outside of infosec.