4 ms·
Does anyone else feel like this is a misnomer? I always considered "zero trust" to mean something like I generate and hold the key that encrypted the data befo
by rkagerer 6y ago
Does anyone else feel like this is a misnomer?
I always considered "zero trust" to mean something like I generate and hold the key that encrypted the data before it was sent to your cloud.
Not this:
The Zero Trust model eliminates trust in any one element, node, or service by assuming that a breach is inevitable or has already occurred. The data-centric security model constantly limits access while also looking for anomalous or malicious activity.
- watermelon0 6y agoI think this is the definition everyone uses. I know the phrase from Google's BeyondCorp, which seems to be the first implementation of a zero trust network. [0] However, some providers, such as SpiderOak, claim they are zero trust compliant, which in that case means that they cannot access your data, even if they were persuaded. In that sense, data is encrypted/decrypted solely on your own hardware. [0] https://en.wikipedia.org/wiki/Zero_trust_networks https://en.wikipedia.org/wiki/Zero_trust_networks
- deleted 6y ago[deleted]
- neolog 6y agoWarrant canary issues https://www.schneier.com/blog/archives/2018/08/spideroaks_warr.html https://www.schneier.com/blog/archives/2018/08/spideroaks_wa...
- closeparen 6y agoTo be pedantic, the central example of a zero trust network is the internet. BeyondCorp popularized the idea of running corporate services the same way as internet facing services, instead of relying on the internal network as a security boundary.
- tenebrisalietum 6y agoI thought "Zero trust" meant nodes that are linked among the LAN should be treated the same as nodes linked among the WAN - e.g. ideally no unencrypted and unauthenticated traffic even on LAN links, and no lack of authentication, lack of encryption, or assignment of privilege just because your IP is in the same subnet or is in a private subnet.