> Zero Trust networking means treating the internal network just like an external network: authenticate every connection, encrypt all traffic, log everything. P

> Zero Trust networking means treating the internal network just like an external network: authenticate every connection, encrypt all traffic, log everything. Plan as if every machine (virtual or otherwise) as if it is sitting on a public IP address. Everyone knows that's the ideal network, but in practice it takes a lot of resources, that's why people prioritize internet exposed things. I mean, outside of tech companies (even then..) Most companies don't even fix critical security vulns internally fast enough. Behold exemptions galore! My problem is this term is used way beyond netwoking to mean so many different things. What the author describes is not what half security vendors think zero trust means. I don't dislike the term because it's a jargon but because the ambiguity leaves too much room to turn it into another box people check to have a false sense of security. Something like "AAA resource access" (Authentication,Authorization,Auditing is an very old networking concept from cisco land) might be a better term. You gotta be unambiguous so it's easier to say "No, you have not implemented that".