6 ms·

The State of Zero Trust Security (2021) [pdf]

52 points by vmoore 4y ago

senectus1 4y ago
I know of an org that recently required that the term "Zero Trust" is not used when talking about their security architecture. Because, i kid you not, It makes it sound like they dont trust their staff.
- randomhodler84 4y ago
  Zero trust, it’s not that you don’t trust your staff —- it’s that you don’t need to.
  - MattPalmer1086 4y ago
    Zero trust essentially means you don't have internal trusted networks, so everything works as if it was on the internet, and is protected and authenticated appropriately. It has nothing to do with whether you trust your staff or not. In fact, you should not trust your staff from a security perspective, insider attacks are a valid threat. This is true regardless of whether you use a zero trust architecture or not.
    - aaaaaaaaata 4y ago
      > insider attacks are a valid threat. Especially if their machine's compromised.
      - MattPalmer1086 4y ago
        Technically, that isn't an insider attack. It's an external threat actor who is using the access provided by the compromised machine of the (presumably innocent) insider. Still a valid threat, just not an insider threat.
  - pyuser583 4y ago
    It means “trust, but verify”.
- brazzy 4y ago
  When you could be talking to people not familiar with IT security and the threat models it has to handle, it absolutely makes sense to avoid terms that could give a false impression to those people.
- dflock 4y ago
  What do they use instead of saying "zero trust"?
  - brentis 4y ago
    Probably something like "limited access" or "authenticated users". Could also include micro segmentation. The basics are pretty straight forward, but every vendor has stretched to include their key capabilities which makes the idea murky.
  - ithkuil 4y ago
    BeyondCorp, NoVPN, EndToEndSec, something like that
  - munchbunny 4y ago
    This is probably not what they say, but the unambiguous expansion of the term would be “Don’t put employee computers on internal networks and don’t rely on network topology for authentication.”
- pastawasta 4y ago
  I worked at a start up that was reading all these zero trust blogs or what have you. They outright told us they didn't trust us. We weren't allowed to talk to one another unless we had permission, etc. Was bizarre, but mostly a mechanism so our boss could say whatever they wanted to the CEO and no one knew anything of what was really happening.
  - MattPalmer1086 4y ago
    That sounds incredibly dysfunctional. Even if they thought zero trust means not trusting your staff (it doesn't), behaving like that will not help security, and will almost certainly undermine it.
    - pastawasta 4y ago
      Turn over was very high. It was very dysfunctional for everyone except the two bosses at the top before the ceo. They controlled and manipulated all the information.
  - pyuser583 4y ago
    I’ve worked at companies with similar attitudes, but they dealt with insanely sensitive information. There strict firewalls about who could talk to who. We were given lists of things we could talk about socially (the weather, etc). But the effect was more of an information clean room, rather than a dictatorship. There were always numerous ways to report wrongdoing.
- rst 4y ago
  It also obscures the actual trust relationships in the architecture as deployed. A lot of Okta's clients may be structured to have zero trust in their networking infrastructure -- but as they've delegated identity management to Okta, they have total trust in Okta itself. (If a hostile third party takes contol of Okta, that party can then act as anyone -- and therefore, with any role -- they like.)
- sybercecurity 4y ago
  Unfortunately, the term "zero trust" has been used by some to promote their insider threat tool/service. I've seen a lot of sales pitches from vendors that include slides about how their tool prevents the next Snowden. If you go back to the original sources of the zero trust concept stress that it should only apply to machines. Processes really don't have the concept of "trust" that people do (gain/lose trust, trusted to a degree, etc.). So we should build systems with that in mind.
- pyuser583 4y ago
  It sucks that some companies start their product creation process by imagining a dystopian panopticon with their client in control.
- bitcuration 4y ago
  Zero trust is indeed not a good way to define it, rather a marketing pitch. Ultimately you'd have to trust someone even that reduced to one, do you even trust yourself? It's infeasible to implement something that's absolutely based on trust none. The so called "Zero trust" is merely escalated restriction but still "as need basis".
SahAssar 4y ago
Maybe add (2021) so it doesn't seem like it's a response to their recent breach.

52 points by vmoore 4y ago

I know of an org that recently required that the term "Zero Trust" is not used when talking about their security architecture. Because, i kid you not, It makes it sound like they dont trust their staff.

randomhodler84 4y ago
Zero trust, it’s not that you don’t trust your staff —- it’s that you don’t need to.
- MattPalmer1086 4y ago
  Zero trust essentially means you don't have internal trusted networks, so everything works as if it was on the internet, and is protected and authenticated appropriately. It has nothing to do with whether you trust your staff or not. In fact, you should not trust your staff from a security perspective, insider attacks are a valid threat. This is true regardless of whether you use a zero trust architecture or not.
  - aaaaaaaaata 4y ago
    > insider attacks are a valid threat. Especially if their machine's compromised.
    - MattPalmer1086 4y ago
      Technically, that isn't an insider attack. It's an external threat actor who is using the access provided by the compromised machine of the (presumably innocent) insider. Still a valid threat, just not an insider threat.
- pyuser583 4y ago
  It means “trust, but verify”.
brazzy 4y ago
When you could be talking to people not familiar with IT security and the threat models it has to handle, it absolutely makes sense to avoid terms that could give a false impression to those people.
dflock 4y ago
What do they use instead of saying "zero trust"?
- brentis 4y ago
  Probably something like "limited access" or "authenticated users". Could also include micro segmentation. The basics are pretty straight forward, but every vendor has stretched to include their key capabilities which makes the idea murky.
- ithkuil 4y ago
  BeyondCorp, NoVPN, EndToEndSec, something like that
- munchbunny 4y ago
  This is probably not what they say, but the unambiguous expansion of the term would be “Don’t put employee computers on internal networks and don’t rely on network topology for authentication.”
pastawasta 4y ago
I worked at a start up that was reading all these zero trust blogs or what have you. They outright told us they didn't trust us. We weren't allowed to talk to one another unless we had permission, etc. Was bizarre, but mostly a mechanism so our boss could say whatever they wanted to the CEO and no one knew anything of what was really happening.
- MattPalmer1086 4y ago
  That sounds incredibly dysfunctional. Even if they thought zero trust means not trusting your staff (it doesn't), behaving like that will not help security, and will almost certainly undermine it.
  - pastawasta 4y ago
    Turn over was very high. It was very dysfunctional for everyone except the two bosses at the top before the ceo. They controlled and manipulated all the information.
- pyuser583 4y ago
  I’ve worked at companies with similar attitudes, but they dealt with insanely sensitive information. There strict firewalls about who could talk to who. We were given lists of things we could talk about socially (the weather, etc). But the effect was more of an information clean room, rather than a dictatorship. There were always numerous ways to report wrongdoing.
rst 4y ago
It also obscures the actual trust relationships in the architecture as deployed. A lot of Okta's clients may be structured to have zero trust in their networking infrastructure -- but as they've delegated identity management to Okta, they have total trust in Okta itself. (If a hostile third party takes contol of Okta, that party can then act as anyone -- and therefore, with any role -- they like.)
sybercecurity 4y ago
Unfortunately, the term "zero trust" has been used by some to promote their insider threat tool/service. I've seen a lot of sales pitches from vendors that include slides about how their tool prevents the next Snowden. If you go back to the original sources of the zero trust concept stress that it should only apply to machines. Processes really don't have the concept of "trust" that people do (gain/lose trust, trusted to a degree, etc.). So we should build systems with that in mind.
pyuser583 4y ago
It sucks that some companies start their product creation process by imagining a dystopian panopticon with their client in control.
bitcuration 4y ago
Zero trust is indeed not a good way to define it, rather a marketing pitch. Ultimately you'd have to trust someone even that reduced to one, do you even trust yourself? It's infeasible to implement something that's absolutely based on trust none. The so called "Zero trust" is merely escalated restriction but still "as need basis".

SahAssar 4y ago

Maybe add (2021) so it doesn't seem like it's a response to their recent breach.