5 ms·

Zero trust isn't zero trust. It's assigning all trust to a third party, unless you self-host your OpenID service. Is there a rule somewhere that says that tech

by api 5y ago

Zero trust isn't zero trust. It's assigning all trust to a third party, unless you self-host your OpenID service. Is there a rule somewhere that says that tech buzzwords in the networking sector have to be maximally wrong?

staticassertion 5y ago
It has nothing to do with a third party. You can do everything yourself if you'd like. Zero Trust just means: 1. Server is authenticated. Client is authenticated. 2. Client has to pass some kind of attestation / meet policy requirements of the service. 3. Actions are auditable. What would you call it? Zero Trust seems fine to me.
- netr0ute 5y ago
  Those three steps are literally AAA and nothing else, so "zero trust" is sounding like yet another marketing buzzword.
  - unethical_ban 5y ago
    Many, many resources on a traditional internal network do NOT have unified AAA. It's about more than slapping a login page on something, it's about making sure that every gateway to an application or data has a nigh unbreakable access control (think AWS IAM when properly configured). Almost no large scale business network in the world can say this. And with IOT, it's even harder.
  - staticassertion 5y ago
    I'm oversimplifying. The interesting bits are in (2), which typically takes contextual information into account with regards to policy. But sure, AAA is an extremely broad term that absolutely could encompass ZT. Just like SOA encompasses Microservices.
theptip 5y ago
“Zero trust” is referring to the fact that you are not granting trust based on network location; at the IP layer, all connections are untrusted. Unlike a VPN/on-prem network, where you don’t trust IPs outside your network and trust everything inside the perimeter. This is a pretty big conceptual shift in corporate network design. Of course you need to establish trust somehow. It’s just done above the IP layer now. There is nothing in the zero trust network model that requires you to use a third party; you can do the same sort of thing with wireguard right? (A la Tailscale). Probably true that it’s harder to assemble all the pieces than running the minimal OpenVPN setup, granted.

by api 5y ago

staticassertion 5y ago

It has nothing to do with a third party. You can do everything yourself if you'd like. Zero Trust just means: 1. Server is authenticated. Client is authenticated. 2. Client has to pass some kind of attestation / meet policy requirements of the service. 3. Actions are auditable. What would you call it? Zero Trust seems fine to me.

netr0ute 5y ago
Those three steps are literally AAA and nothing else, so "zero trust" is sounding like yet another marketing buzzword.
- unethical_ban 5y ago
  Many, many resources on a traditional internal network do NOT have unified AAA. It's about more than slapping a login page on something, it's about making sure that every gateway to an application or data has a nigh unbreakable access control (think AWS IAM when properly configured). Almost no large scale business network in the world can say this. And with IOT, it's even harder.
- staticassertion 5y ago
  I'm oversimplifying. The interesting bits are in (2), which typically takes contextual information into account with regards to policy. But sure, AAA is an extremely broad term that absolutely could encompass ZT. Just like SOA encompasses Microservices.

theptip 5y ago

“Zero trust” is referring to the fact that you are not granting trust based on network location; at the IP layer, all connections are untrusted. Unlike a VPN/on-prem network, where you don’t trust IPs outside your network and trust everything inside the perimeter. This is a pretty big conceptual shift in corporate network design. Of course you need to establish trust somehow. It’s just done above the IP layer now. There is nothing in the zero trust network model that requires you to use a third party; you can do the same sort of thing with wireguard right? (A la Tailscale). Probably true that it’s harder to assemble all the pieces than running the minimal OpenVPN setup, granted.