It's just a buzzword for the IT security sector similar to how one would now use "machine learning" or "artificial intelligence" in place of "open sesame" to ge

It's just a buzzword for the IT security sector similar to how one would now use "machine learning" or "artificial intelligence" in place of "open sesame" to get a budget increased, decision made or project started. One of the authors of the NIST standard when attempting to describe "zero trust" just loosely states it as a continuation of what is already happening today in any large organisation[1]. If "zero trust" was truer to its name, everyone would be applying the type of engineering techniques[2][3] used to design "critical systems"[4]. However this probably wouldn't be desirable for the IT security sector as it'd show that many IT security products and measures are in fact detrimental to the security of the systems involved. Detriments including: 1. Increasing complexity of the system design and the impact this has on the ability to configure and maintain everything securely (think 5 years later with a new team of people looking after it who don't fully understand how it all works changing configuration). 2. Introduction of new centralised points of failure in the form of security systems having elevated access to an entire network. The recent example of this detriment is SolarWinds Orion. 3. Increasing prevalence of shadow IT as a result of end users fed up with difficulty obtaining access to information or resources they need to do their job. 4. Chilling effect on IT system development within the organisation as the security bureaucracy becomes too difficult to overcome when delivering IT system upgrades. Legacy systems in an insecure state remain connected to the network forever because it costs too much to make even small incremental improvements as the security bureaucracy will demand a complete overhaul or slow down upgrade projects. [1] https://www.youtube.com/watch?v=NWQgh42O8WU https://www.youtube.com/watch?v=NWQgh42O8WU [2] https://en.wikipedia.org/wiki/Failure_mode_and_effects_analysis https://en.wikipedia.org/wiki/Failure_mode_and_effects_analy... [3] https://en.wikipedia.org/wiki/Fault_tree_analysis https://en.wikipedia.org/wiki/Fault_tree_analysis [4] https://en.wikipedia.org/wiki/Safety-critical_system https://en.wikipedia.org/wiki/Safety-critical_system