11 ms·

'Zero trust’ security is a poor choice of words

153 points by politelemon 4y ago

mt42or 4y ago
The author give implementation details names which are also not good naming as not reflecting the global idea.
- mjw1007 4y ago
  I think "Boundaryless Security" is decent. The first big step that systems people are calling "Zero Trust" have in common is that they don't trust devices based on the (physical or virtual) network they're connecting from. There are all kinds of other things that are still trusted, so "Zero" isn't terribly helpful.
  - fomine3 4y ago
    This. Zero is for device/network but still there are other trusts.
gravitate 4y ago
Zero Trust is really just defense in depth[0]. All the things it implements are DiD solutions that have existed way before the term Zero Trust emerged. [0] https://www.forcepoint.com/cyber-edu/defense-depth https://www.forcepoint.com/cyber-edu/defense-depth
- pid-1 4y ago
  I also like the term "Onion Approach to Security"
- jameshart 4y ago
  Defense in depth, combined with abandoning the pretense that certain things that were regarded as security perimeters (like ‘having an IP address on a specific subnet’) we’re not really defenses in the first place.
  - bee_rider 4y ago
    As someone not working in security -- nobody working in security actually believed in that kind of stuff, right? Even my dumb self knows that the network is fundamentally full of evil nodes.
    - jameshart 4y ago
      .... wish I could tell you 'no'. It's not so much that servers would be left wide open to be hit by anything that plugged into the LAN (although, sure... some of that, too), but more that there was no need seen for things like endpoint firewalls on user desktop machines plugged in to the LAN, because they were 'behind the firewall'. And honestly even today we still see that thinking in datacenter ops and even virtual cloud ops. I've seen people say 'I don't need to worry about those mongo credential compromises because I'm running mongo on a secure VPC'.
    - fulafel 4y ago
      A surprisingly large share of people "working in security" are actually just checking boxes, and are very risk averse so resist all change, especially taking out any boxes.
ozim 4y ago
'Zero Trust' is not for end users. For end users you have magic of single sign on - they use login to their work laptop and seamlessly navigate to whatever they need for their work without ANY login screens. 'Zero Trust' is for back-end services where you assume you need encryption at transit and you always need some authorization to check if someone or something has access to other stuff.
- tgsovlerkhgsel 4y ago
  This. Zero Trust will be a pain for service owners, admins etc., but for the end user, it should be pretty smooth. There may be bugs/errors initially, but there should not be any permanently added friction. Quite the opposite, Zero Trust can mean that the user can now access services that previously needed a VPN from anywhere, without caring what network they are one.
  - jameshart 4y ago
    Honestly one of the hardest things about zero trust is getting end users who aren’t used to it to stop trying to solve problems by turning on the VPN. (We are almost completely zero trust, but obviously there are still a few legacy systems you need to connect to a VPN to access) I don’t do deskside support, but I do have to help nontechnical people interact with apps and services occasionally, and often their first troubleshooting step is ‘make sure the VPN is on’, whereas mine tends to be ‘let’s eliminate a potential source of network craziness and make sure the VPN is definitely off’ So do tend to think that the important messaging for end users is that zero trust is about eliminating something - making things simpler. Maybe ‘networkless’ would be a better word…
- rocqua 4y ago
  That is not the idea currently being pushed. The zero trust idea is 'just because they are on the right subnet doesn't mean you can trust them'. So you add things like healthyness checks (is this device up to date), anomaly detection, and use those to dynamically determine how much authentication challenge you give a user. For this to work, the key is really good and easy single sign on with second factor also made easy. That way you can do more trusted authentication (a SSO token backed by Microsoft login is harder to phish than just a password. More importantly, it really lowers the authentication burden on your users.
qzw 4y ago
I think part of the issue with Zero Trust (ZT) is that it's been applied too broadly in too many contexts. For example, a number of cloud services advertise as ZT, but they probably would actually prefer the nomenclature Zero Knowledge. But of course zero knowledge is being namesquatted (ha!) by an actual cryptography concept, so people who know the difference rightly objected to companies co-opting it. Now a bunch non-cloud offering also want to get on the ZT bandwagon, which just further dilutes and muddies the meaning of the term. Since there's no actual standard defining ZT, it becomes just about as meaningful a descriptor as Best Practices and Military-Grade Encryption.
mattacular 4y ago
Why should the average end user care or know what the internal security model and practices are referred to as? How would they even discover that a given app or brand is trying to enforce zero trust without reading their engineering blog or fine print or something like that? Such motivated person would certainly not be confused by the nomenclature. Many things are named sub-optimally in technology, this seems like a strange one to write a post on.
- ergocoder 4y ago
  Because the terms will inevitably communicate to the users one way of the other. It confuses even engineers who don't focus on security.
tenebrisalietum 4y ago
Well if you say what zero trust really is ... - We treat the internal network the same as external networks, like your home network. Our systems don't care whether you are at home or at work - you'll have to verify and authenticate the same no matter what. then workers will be asking "Oh, so why don't I just work from home..."
- indymike 4y ago
  This is probably one of the best descriptions.
hedora 4y ago
Zero Trust is a fine phrase, but it greatly over claims. (Unless I'm missing something, and it eliminates trust requirements for third party SSO services, software supply chains, infrastructure operators, and other common attack vectors).
- foobiekr 4y ago
  It doesn't eliminate the trust requirement for any of those at all. It's easier to talk about zero trust by identifying the thing it is not. For example, ZT is not "it is sufficient to be inside X" where X is on a host, in a container or not, on a subnet (we are less than ten years way from having to argue with people about "why are we using encryption on our internal connections?"), or some other context, and so on.
  - hedora 4y ago
    So, (precisely speaking) it is increasing the set of network endpoints that are trusted from a LAN to the entire internet.
    - NavinF 4y ago
      The opposite: increasing the set of network endpoints that are untrusted from the internet to both the internet and the LAN.
      - inyourtenement 4y ago
        I get this, but I don’t get why that means we should do away with VPNs, etc. Isn’t “in my private network” an additional piece of information that can be used to help authenticate a client?
        BeefWellington 4y ago
        VPNs aren't necessarily "done away with" in the ZT model, in fact in many circumstances they would still be encouraged.
NovemberWhiskey 4y ago
"Zero trust" is fine as a name; it's basically a reminder to be careful of where you place implicit trust in your security model. Self-reflection showed that typical corporate network models had an increasingly unjustified degree of trust in the integrity of their internal networks and endpoints attached to those networks; so that tends to be referent that people identify.
- indymike 4y ago
  I think zero trust describes the philosophy more than the implementation. Design the network so that we treat every device like it is not to be trusted.
donutshop 4y ago
The buzz around it is a bit annoying but the concept certainly is great. Never trust by default, always verify.
0xCMP 4y ago
Reading the comments here you'd think this article was complaining about what zero trust is or how it is bad. Instead it is about how we explain Zero Trust to others and the very real interpretation of "zero trust for (you)" by end users hearing about this be policy. A realistic interpretation given the way machines and etc are locked down. It doesn't seem like a bad idea to me to come up with a better name to avoid friction with those unfamiliar with the concept. Even as it is on HN people seem to jump to conclusions based on the name so imagine non technical users hearing about this.
Cas6767 4y ago
Trust and you'll be trusted said the liar to the fool.
wmf 4y ago
I wonder what user speed bumps people have seen around zero trust. When IBM started adopting it, employees rejoiced that they could access email and Slack without the VPN.
theptip 4y ago
I suppose the thesis that it’s a bad name is borne out by the fact that many technical people misunderstand it; it’s a contraction of “zero trust networking” and is a fine description of the technical approach: don’t trust anyone by virtue of their network location. (Trust is negotiated at the application layer.) #NoVPN or Zero Perimeter could be better slogans. On the other hand, the only people I have seen confused are technical people that (incorrectly) think they have identified an inconsistency; non-technical folks seem fine to just map name->feature-set.
- otterley 4y ago
  +1 for NoVPN. It's short, sweet, and quickly conveys the benefit. It may also remind people of the frustrations they often face using VPN software, which is often flaky and has a poor UI, so eliminating it could be met with feelings of relief. Nevertheless, it's always a little unsettling whenever some Internet rando confidently posits that a phrase conveys a certain meaning or emotional reaction to people without any evidence whatsoever. I mean, come on, do a little market research. Do your homework. (The same goes for me!)
  - vasco 4y ago
    Makes no sense to do market research for this. You throw a new naming out there and see if it sticks. If it sticks, done, if not, no market research needed.
    - l33t2328 4y ago
      I don’t really have an opinion on this but isn’t “seeing if it sticks” just other words for market research?
      - phonepostingsux 4y ago
        The "fuck it, do it in prod" of market research.
    - otterley 4y ago
jeremygaither 4y ago
Mutually Assured Trust was the first thing that popped into my mind when reading the article. The premise of explaining things to end users and the difficulty of naming things also reminds me of the Kerberos paper [Designing an Authentication System: a Dialogue in Four Scenes](https://web.mit.edu/kerberos/dialogue.html https://web.mit.edu/kerberos/dialogue.html). Zero Trust reminds me of Kerberos, reborn into a web-first world.
- archi42 4y ago
  But it's not mTLS? ;)
bunnie 4y ago
I have to agree that "zero trust" is terrible marketing (alongside "trustless computing" or variations of that). Generally, we think of "trust" as a positive term, and having zero of it seems bad. That's at least the brain-stem reaction I have to this term, and I think no amount of "but but but you see the problem is we trust the wrong things therefore we should have none of it" will fix the perception. If I'm not mistaken, the point of the term is that you're not just punting to the firewall to protect your network: eggshells are not sufficient to protect eggs. Thus the proposal isn't "zero shell eggs", it's closer to "all shell no egg". I don't have a good alternative to it, but maybe something like "Continuous Skepticism", "Always Verify", "Pervasive Vigilance", or "Verify Everything" might be terms that evolve in the right direction. I don't think any of these are winners, but at least none of these take a fairly universally positive term (like trust) and negate it without further explanation. "Zero trust" really feels more like just an eye-popping bullet point in a consultant's slide deck that gets thrown in to make sure the client hasn't totally nodded off by the 10th slide...
- BrianOnHN 4y ago
  > I don't have a good alternative to it, but maybe something like I thought "trust" was working out just fine... What happened? When did we lose the ability to trust? Maybe it would be easier to try to find new way to build trust? Rather than replacing it altogether?
  - PaulHoule 4y ago
    One defining trait of 2022 is the breakdown of trust. (The other is that people insist that "this time is different" and that history doesn't have anything to teach us about the current time.) If you look at /new/ on HN you will see there are people who have nothing better to do than second-guess every decision the government or any other organization made about the coronavirus. Blockheads think you can't trust banks, central banks, or anybody except the person who wants you to buy the latest shitcoin.
    - decremental 4y ago
g8oz 4y ago
I like to think of 'Zero Trust' in terms of OSI layers. Application layer (L7) authentication is used to authorize the session layer (L5).
- amerine 4y ago
  This is exactly my mental model as well!!! believe it’s the right one too.
deleted 4y ago
[deleted]
glintik 4y ago
AI(Artificial Intelligence) is real poor choice of words, because of there is no intelligence at all, just math..
- charcircuit 4y ago
  Which is why it's called artificial
gz5 4y ago
'Zero trust' as a term was popularized over a decade ago by John Kindervag, and has roots older than that. Kindervag focused on the fact that we shouldn't trust LAN/WAN devices just because they were (apparently) on the LAN/WAN. We are well beyond that era - devices, users, apps and data are now massively distributed. In this new era, the question is can we avoid 'trusting' all networks. Of course, you need to trust something, so that paradigm would suggest that the app is the new edge, and only enable identified, authenticated, authorized ('trusted') app sessions to make ephemeral network connections. In that model, all inbound firewall ports are closed (not even dynamic port opening), so that unauthorized sessions can't even scan/probe.
- sascha_sl 4y ago
  Still have plenty of services with network trust everywhere I've worked, particularly in the oldest and slowest moving parts of an organization, but now I'm on VPN instead of LAN. I can still ping AD and SAP and whatever else one could find if you could run nmap on your work network. It's not really about trusting more or less outside networks, it's about exposing your network very selectively (e.g. single services behind authenticating proxies), preferably with a corporate login and some form of device attestation.
G3rn0ti 4y ago
Biggest problem with current "Zero Trust" implementations is they imply a full surveillance of employees' Internet traffic including man-in-the-middling their encrypted SSL requests. My company just deployed "ZScaler" -- a product marketed as a "zero trust" VPN solution but in actuality is an Orwellian surveillance tool. This will give "zero trust" a nice negative connotation very soon.
- helloooooooo 4y ago
  A lot of the time, SSL MITM proxies are used as a mechanism to detect malicious content within a corporate content. I have seen, deployed across millions of machines, prevent phishing documents from being detonated thousands of times.
- gatkinso 4y ago
  more like - 'zero trust' in the sense you cannot trust it
- AaronFriel 4y ago
  Single point of failure devices for decryption of traffic (MitM) is not in line with the original definition of "zero trust", and VPNs certainly aren't either. Zero trust arose out of this exact sort of scenario following the Snowden leaks and the NSA document showing "SSL added and removed here". End to end encryption and removing MitM middleboxes was the answer to SSL intercepting proxies. This is a VPN/SSL interception product attempting to remain relevant by advertising as something it isn't.
- zemnmez 4y ago
  i’m not really sure what you mean. most of these products are indeed reverse-proxies, but reverse proxies do not sit in front of the whole internet, just corporate services
- zmmmmm 4y ago
  ZScaler has coopted the term Zero Trust for marketing purposes. Their SSL interception tool is branded as part of their Zero Trust but is antithetical to the principles of zero trust ... in fact, IMHO anybody who deploys it is further away from achieving Zero Trust than before they started - instead of users authenticating using individually secured transactions to every TLS endpoint they connect to, it is all centralized in ZScaler which is ubiquitously trusted across the organisation. This is a centralizing of the trust model that is the opposite of the intent of Zero Trust. I hope ZScaler gets shamed into modifying or removing some of this branding (or alternatively sued when one of their customers gets attacked or fails an audit after believing it ...)
cratermoon 4y ago
I first heard the term a few years ago, but because I work in that space it didn't bother me. When I talk about it to network ops folks I like to say "perimeterless", which is a fair description of what they care most about: no more firewalls, DMZ, or "internal" vs "external". The device-centric authentication and authorization part, I don't really have a good simple term. When it works well, I call it "better user experience" because to the people accessing, there's a lot less for them to deal with, and fewer passwords to remember or VPN status to worry about. The lack of a VPN requirement is nice. The experience from my last job where we had a VPN was that everything worked pretty well for employees with company-issued laptops, but when a division hired contractors or brought in a third party, they weren't issued laptops, so they couldn't access anything on the VPN, leading to continuous support issues and work for the netops folks. For my part I really like it because it addresses one aspect of security often neglected (even more so than security in general): internal malicious actors. Disgruntled employees, workers that expeditious bypass security because their boss has to have it NOW, executives and senior leadership that throw their weight around and get special access to bypass security, or simple human error. Also, all the un-encrypted internal traffic. In this case, "zero trust" applies, because where companies used to trust their employees not to screw around with company assets, hard experience has demonstrated that even absent malice, people do stupid things and it costs real money.
notwedtm 4y ago
If I didn’t have Zero Trust, I wouldn’t have no trust at all.
lamontcg 4y ago
"Serverless Computing", "Agentless", and "Immutable Infrastructure" are all badly named.
zmmmmm 4y ago
I have experienced first hand the reaction of people who feel "so you don't trust us any more"? What are we not allowed to do now? when first exposed to this term. Part of the missing puzzle pieces here are ambiguity about the word "trust". People generally think it is a good thing to have trust. So why do we want zero of it? How can that possibly be a good thing? I think something that emphasises the increase in trustworthiness of the overall system due to this would be ideal. Such as "continuous trust verification (CTV)" might be good. It does not help that certain companies (looking at you ZScaler) have abused this term for marketing purposes. They are actively harming not just their own customers but the entire security industry through their branding of products completely unrelated to it as zero trust. A lot of people in decision making roles now believe Zero Trust(tm) means in fact, some things that are the complete opposite of what it actually means.
pugworthy 4y ago
Bad product name anecdote... I used to work for Rogue Wave Software, who had a product called "Software Parts Manager" which was shortened to SPM, which was used to build code across a number of flavors of Unix, compilers, etc. The developers internally didn't seem to like it much. They called it SPAM instead of SPM. One day, I as the person managing the online commerce system, see there is an upgrade of one of the products. I scan the README file, and whoever wrote it internally constantly referenced "SPAM" in terms of how to use it. Anyway to this day, I am a stickler for making teams use the real name, and not the slang name. And if a team ever creates a derogatory name for a product, I see it as a huge red flag that the product itself has issues. But conversely if the slang name is a good one, it's worth considering making that the official or openly fun/positive unofficial name.
- BeefWellington 4y ago
  The past few years I've watched several clients rebrand their internal "CyberSecurity Awareness Month" to "Cyber Awareness Month" because of the stuff that had come out around Apple's photo scanning plans and the constant use of CSAM in those contexts.
_8j50 4y ago
We are doing this at $work, everyone says "zero trust" but means something different, high level goals set but hard to translate those to implementation. Someone argued with me that trusting a byod mobile phone for a 2fa app that phones home with checkmarks is zero trust because of the check alone, never mind a user's crappy android that isn't corporate managed/monitored is being used for both first and second factor auth. The fact that they do a lot of auth all over the place yet all that depends on the security of a random user's random personal phone being trusted does not prevent it from being called "the zero-trust way".
charlieyu1 4y ago
I’d rather be told that it is zero trust security than another fancy name that everyone knows it is bullshit
fatbird 4y ago
“Always Active Security”
jaginfosec 4y ago
The term “Zero Trust” is now a mainstream industry trend, for better or for worse. The positive aspect of this is that - especially for those of us in the information security industry - there’s a name for this security philosophy, and shift toward approaching security architectures and policy models form a holistic perspective, breaking down traditional silos and barriers. Really “Zero Trust” is about zero inherent or implicit trust. Zero Trust is about carefully building a foundation of trust (based on sound cryptographic validation), and growing that trust to ultimately permit an appropriate level of access at the right time. It could perhaps have been called “earned trust” or “adaptive trust” or “zero implicit trust,” and these would have suited the movement better, but “Zero Trust” has more sizzle, and it stuck. The term is now very broadly used - in fact, being the core part of the May 2021 White House executive order issued by President Biden. So we need to embrace it. However, for non-security people, I agree that the term can be off-putting or potentially insulting. I’ve seen enterprises deliberately term their Zero Trust initiatives as things such as “Modern Workplace Security”, or “Digital Transformation”. That’s fine - security leaders can and should adapt things to best suit the culture and context of their organizations. (If you’re interested in more, see my book and website on this subject at https://zerotrustsecurity.guide/ https://zerotrustsecurity.guide/ )

153 points by politelemon 4y ago

mt42or 4y ago

The author give implementation details names which are also not good naming as not reflecting the global idea.

mjw1007 4y ago
I think "Boundaryless Security" is decent. The first big step that systems people are calling "Zero Trust" have in common is that they don't trust devices based on the (physical or virtual) network they're connecting from. There are all kinds of other things that are still trusted, so "Zero" isn't terribly helpful.
- fomine3 4y ago
  This. Zero is for device/network but still there are other trusts.

gravitate 4y ago

Zero Trust is really just defense in depth[0]. All the things it implements are DiD solutions that have existed way before the term Zero Trust emerged. [0] https://www.forcepoint.com/cyber-edu/defense-depth https://www.forcepoint.com/cyber-edu/defense-depth

pid-1 4y ago
I also like the term "Onion Approach to Security"
jameshart 4y ago
Defense in depth, combined with abandoning the pretense that certain things that were regarded as security perimeters (like ‘having an IP address on a specific subnet’) we’re not really defenses in the first place.
- bee_rider 4y ago
  As someone not working in security -- nobody working in security actually believed in that kind of stuff, right? Even my dumb self knows that the network is fundamentally full of evil nodes.
  - jameshart 4y ago
    .... wish I could tell you 'no'. It's not so much that servers would be left wide open to be hit by anything that plugged into the LAN (although, sure... some of that, too), but more that there was no need seen for things like endpoint firewalls on user desktop machines plugged in to the LAN, because they were 'behind the firewall'. And honestly even today we still see that thinking in datacenter ops and even virtual cloud ops. I've seen people say 'I don't need to worry about those mongo credential compromises because I'm running mongo on a secure VPC'.
  - fulafel 4y ago
    A surprisingly large share of people "working in security" are actually just checking boxes, and are very risk averse so resist all change, especially taking out any boxes.

ozim 4y ago

'Zero Trust' is not for end users. For end users you have magic of single sign on - they use login to their work laptop and seamlessly navigate to whatever they need for their work without ANY login screens. 'Zero Trust' is for back-end services where you assume you need encryption at transit and you always need some authorization to check if someone or something has access to other stuff.

tgsovlerkhgsel 4y ago
This. Zero Trust will be a pain for service owners, admins etc., but for the end user, it should be pretty smooth. There may be bugs/errors initially, but there should not be any permanently added friction. Quite the opposite, Zero Trust can mean that the user can now access services that previously needed a VPN from anywhere, without caring what network they are one.
- jameshart 4y ago
  Honestly one of the hardest things about zero trust is getting end users who aren’t used to it to stop trying to solve problems by turning on the VPN. (We are almost completely zero trust, but obviously there are still a few legacy systems you need to connect to a VPN to access) I don’t do deskside support, but I do have to help nontechnical people interact with apps and services occasionally, and often their first troubleshooting step is ‘make sure the VPN is on’, whereas mine tends to be ‘let’s eliminate a potential source of network craziness and make sure the VPN is definitely off’ So do tend to think that the important messaging for end users is that zero trust is about eliminating something - making things simpler. Maybe ‘networkless’ would be a better word…
rocqua 4y ago
That is not the idea currently being pushed. The zero trust idea is 'just because they are on the right subnet doesn't mean you can trust them'. So you add things like healthyness checks (is this device up to date), anomaly detection, and use those to dynamically determine how much authentication challenge you give a user. For this to work, the key is really good and easy single sign on with second factor also made easy. That way you can do more trusted authentication (a SSO token backed by Microsoft login is harder to phish than just a password. More importantly, it really lowers the authentication burden on your users.

qzw 4y ago

I think part of the issue with Zero Trust (ZT) is that it's been applied too broadly in too many contexts. For example, a number of cloud services advertise as ZT, but they probably would actually prefer the nomenclature Zero Knowledge. But of course zero knowledge is being namesquatted (ha!) by an actual cryptography concept, so people who know the difference rightly objected to companies co-opting it. Now a bunch non-cloud offering also want to get on the ZT bandwagon, which just further dilutes and muddies the meaning of the term. Since there's no actual standard defining ZT, it becomes just about as meaningful a descriptor as Best Practices and Military-Grade Encryption.

mattacular 4y ago

Why should the average end user care or know what the internal security model and practices are referred to as? How would they even discover that a given app or brand is trying to enforce zero trust without reading their engineering blog or fine print or something like that? Such motivated person would certainly not be confused by the nomenclature. Many things are named sub-optimally in technology, this seems like a strange one to write a post on.

ergocoder 4y ago
Because the terms will inevitably communicate to the users one way of the other. It confuses even engineers who don't focus on security.

tenebrisalietum 4y ago

Well if you say what zero trust really is ... - We treat the internal network the same as external networks, like your home network. Our systems don't care whether you are at home or at work - you'll have to verify and authenticate the same no matter what. then workers will be asking "Oh, so why don't I just work from home..."

indymike 4y ago
This is probably one of the best descriptions.

hedora 4y ago

Zero Trust is a fine phrase, but it greatly over claims. (Unless I'm missing something, and it eliminates trust requirements for third party SSO services, software supply chains, infrastructure operators, and other common attack vectors).

foobiekr 4y ago
It doesn't eliminate the trust requirement for any of those at all. It's easier to talk about zero trust by identifying the thing it is not. For example, ZT is not "it is sufficient to be inside X" where X is on a host, in a container or not, on a subnet (we are less than ten years way from having to argue with people about "why are we using encryption on our internal connections?"), or some other context, and so on.
- hedora 4y ago
  So, (precisely speaking) it is increasing the set of network endpoints that are trusted from a LAN to the entire internet.
  - NavinF 4y ago
    The opposite: increasing the set of network endpoints that are untrusted from the internet to both the internet and the LAN.
    - inyourtenement 4y ago
      I get this, but I don’t get why that means we should do away with VPNs, etc. Isn’t “in my private network” an additional piece of information that can be used to help authenticate a client?
      - BeefWellington 4y ago
        VPNs aren't necessarily "done away with" in the ZT model, in fact in many circumstances they would still be encouraged.

NovemberWhiskey 4y ago

"Zero trust" is fine as a name; it's basically a reminder to be careful of where you place implicit trust in your security model. Self-reflection showed that typical corporate network models had an increasingly unjustified degree of trust in the integrity of their internal networks and endpoints attached to those networks; so that tends to be referent that people identify.

indymike 4y ago
I think zero trust describes the philosophy more than the implementation. Design the network so that we treat every device like it is not to be trusted.

donutshop 4y ago

The buzz around it is a bit annoying but the concept certainly is great. Never trust by default, always verify.

0xCMP 4y ago

Reading the comments here you'd think this article was complaining about what zero trust is or how it is bad. Instead it is about how we explain Zero Trust to others and the very real interpretation of "zero trust for (you)" by end users hearing about this be policy. A realistic interpretation given the way machines and etc are locked down. It doesn't seem like a bad idea to me to come up with a better name to avoid friction with those unfamiliar with the concept. Even as it is on HN people seem to jump to conclusions based on the name so imagine non technical users hearing about this.

Cas6767 4y ago

Trust and you'll be trusted said the liar to the fool.

wmf 4y ago

I wonder what user speed bumps people have seen around zero trust. When IBM started adopting it, employees rejoiced that they could access email and Slack without the VPN.

theptip 4y ago

I suppose the thesis that it’s a bad name is borne out by the fact that many technical people misunderstand it; it’s a contraction of “zero trust networking” and is a fine description of the technical approach: don’t trust anyone by virtue of their network location. (Trust is negotiated at the application layer.) #NoVPN or Zero Perimeter could be better slogans. On the other hand, the only people I have seen confused are technical people that (incorrectly) think they have identified an inconsistency; non-technical folks seem fine to just map name->feature-set.

otterley 4y ago
+1 for NoVPN. It's short, sweet, and quickly conveys the benefit. It may also remind people of the frustrations they often face using VPN software, which is often flaky and has a poor UI, so eliminating it could be met with feelings of relief. Nevertheless, it's always a little unsettling whenever some Internet rando confidently posits that a phrase conveys a certain meaning or emotional reaction to people without any evidence whatsoever. I mean, come on, do a little market research. Do your homework. (The same goes for me!)
- vasco 4y ago
  Makes no sense to do market research for this. You throw a new naming out there and see if it sticks. If it sticks, done, if not, no market research needed.
  - l33t2328 4y ago
    I don’t really have an opinion on this but isn’t “seeing if it sticks” just other words for market research?
    - phonepostingsux 4y ago
      The "fuck it, do it in prod" of market research.
  - otterley 4y ago

jeremygaither 4y ago

Mutually Assured Trust was the first thing that popped into my mind when reading the article. The premise of explaining things to end users and the difficulty of naming things also reminds me of the Kerberos paper [Designing an Authentication System: a Dialogue in Four Scenes](https://web.mit.edu/kerberos/dialogue.html https://web.mit.edu/kerberos/dialogue.html). Zero Trust reminds me of Kerberos, reborn into a web-first world.

archi42 4y ago
But it's not mTLS? ;)

bunnie 4y ago

I have to agree that "zero trust" is terrible marketing (alongside "trustless computing" or variations of that). Generally, we think of "trust" as a positive term, and having zero of it seems bad. That's at least the brain-stem reaction I have to this term, and I think no amount of "but but but you see the problem is we trust the wrong things therefore we should have none of it" will fix the perception. If I'm not mistaken, the point of the term is that you're not just punting to the firewall to protect your network: eggshells are not sufficient to protect eggs. Thus the proposal isn't "zero shell eggs", it's closer to "all shell no egg". I don't have a good alternative to it, but maybe something like "Continuous Skepticism", "Always Verify", "Pervasive Vigilance", or "Verify Everything" might be terms that evolve in the right direction. I don't think any of these are winners, but at least none of these take a fairly universally positive term (like trust) and negate it without further explanation. "Zero trust" really feels more like just an eye-popping bullet point in a consultant's slide deck that gets thrown in to make sure the client hasn't totally nodded off by the 10th slide...

BrianOnHN 4y ago
> I don't have a good alternative to it, but maybe something like I thought "trust" was working out just fine... What happened? When did we lose the ability to trust? Maybe it would be easier to try to find new way to build trust? Rather than replacing it altogether?
- PaulHoule 4y ago
  One defining trait of 2022 is the breakdown of trust. (The other is that people insist that "this time is different" and that history doesn't have anything to teach us about the current time.) If you look at /new/ on HN you will see there are people who have nothing better to do than second-guess every decision the government or any other organization made about the coronavirus. Blockheads think you can't trust banks, central banks, or anybody except the person who wants you to buy the latest shitcoin.
  - decremental 4y ago

g8oz 4y ago

I like to think of 'Zero Trust' in terms of OSI layers. Application layer (L7) authentication is used to authorize the session layer (L5).

amerine 4y ago
This is exactly my mental model as well!!! believe it’s the right one too.

deleted 4y ago

[deleted]

glintik 4y ago

AI(Artificial Intelligence) is real poor choice of words, because of there is no intelligence at all, just math..

charcircuit 4y ago
Which is why it's called artificial

gz5 4y ago

'Zero trust' as a term was popularized over a decade ago by John Kindervag, and has roots older than that. Kindervag focused on the fact that we shouldn't trust LAN/WAN devices just because they were (apparently) on the LAN/WAN. We are well beyond that era - devices, users, apps and data are now massively distributed. In this new era, the question is can we avoid 'trusting' all networks. Of course, you need to trust something, so that paradigm would suggest that the app is the new edge, and only enable identified, authenticated, authorized ('trusted') app sessions to make ephemeral network connections. In that model, all inbound firewall ports are closed (not even dynamic port opening), so that unauthorized sessions can't even scan/probe.

sascha_sl 4y ago
Still have plenty of services with network trust everywhere I've worked, particularly in the oldest and slowest moving parts of an organization, but now I'm on VPN instead of LAN. I can still ping AD and SAP and whatever else one could find if you could run nmap on your work network. It's not really about trusting more or less outside networks, it's about exposing your network very selectively (e.g. single services behind authenticating proxies), preferably with a corporate login and some form of device attestation.

G3rn0ti 4y ago

Biggest problem with current "Zero Trust" implementations is they imply a full surveillance of employees' Internet traffic including man-in-the-middling their encrypted SSL requests. My company just deployed "ZScaler" -- a product marketed as a "zero trust" VPN solution but in actuality is an Orwellian surveillance tool. This will give "zero trust" a nice negative connotation very soon.

helloooooooo 4y ago
A lot of the time, SSL MITM proxies are used as a mechanism to detect malicious content within a corporate content. I have seen, deployed across millions of machines, prevent phishing documents from being detonated thousands of times.
gatkinso 4y ago
more like - 'zero trust' in the sense you cannot trust it
AaronFriel 4y ago
Single point of failure devices for decryption of traffic (MitM) is not in line with the original definition of "zero trust", and VPNs certainly aren't either. Zero trust arose out of this exact sort of scenario following the Snowden leaks and the NSA document showing "SSL added and removed here". End to end encryption and removing MitM middleboxes was the answer to SSL intercepting proxies. This is a VPN/SSL interception product attempting to remain relevant by advertising as something it isn't.
zemnmez 4y ago
i’m not really sure what you mean. most of these products are indeed reverse-proxies, but reverse proxies do not sit in front of the whole internet, just corporate services
zmmmmm 4y ago
ZScaler has coopted the term Zero Trust for marketing purposes. Their SSL interception tool is branded as part of their Zero Trust but is antithetical to the principles of zero trust ... in fact, IMHO anybody who deploys it is further away from achieving Zero Trust than before they started - instead of users authenticating using individually secured transactions to every TLS endpoint they connect to, it is all centralized in ZScaler which is ubiquitously trusted across the organisation. This is a centralizing of the trust model that is the opposite of the intent of Zero Trust. I hope ZScaler gets shamed into modifying or removing some of this branding (or alternatively sued when one of their customers gets attacked or fails an audit after believing it ...)

cratermoon 4y ago

I first heard the term a few years ago, but because I work in that space it didn't bother me. When I talk about it to network ops folks I like to say "perimeterless", which is a fair description of what they care most about: no more firewalls, DMZ, or "internal" vs "external". The device-centric authentication and authorization part, I don't really have a good simple term. When it works well, I call it "better user experience" because to the people accessing, there's a lot less for them to deal with, and fewer passwords to remember or VPN status to worry about. The lack of a VPN requirement is nice. The experience from my last job where we had a VPN was that everything worked pretty well for employees with company-issued laptops, but when a division hired contractors or brought in a third party, they weren't issued laptops, so they couldn't access anything on the VPN, leading to continuous support issues and work for the netops folks. For my part I really like it because it addresses one aspect of security often neglected (even more so than security in general): internal malicious actors. Disgruntled employees, workers that expeditious bypass security because their boss has to have it NOW, executives and senior leadership that throw their weight around and get special access to bypass security, or simple human error. Also, all the un-encrypted internal traffic. In this case, "zero trust" applies, because where companies used to trust their employees not to screw around with company assets, hard experience has demonstrated that even absent malice, people do stupid things and it costs real money.

notwedtm 4y ago

If I didn’t have Zero Trust, I wouldn’t have no trust at all.

lamontcg 4y ago

"Serverless Computing", "Agentless", and "Immutable Infrastructure" are all badly named.

zmmmmm 4y ago

I have experienced first hand the reaction of people who feel "so you don't trust us any more"? What are we not allowed to do now? when first exposed to this term. Part of the missing puzzle pieces here are ambiguity about the word "trust". People generally think it is a good thing to have trust. So why do we want zero of it? How can that possibly be a good thing? I think something that emphasises the increase in trustworthiness of the overall system due to this would be ideal. Such as "continuous trust verification (CTV)" might be good. It does not help that certain companies (looking at you ZScaler) have abused this term for marketing purposes. They are actively harming not just their own customers but the entire security industry through their branding of products completely unrelated to it as zero trust. A lot of people in decision making roles now believe Zero Trust(tm) means in fact, some things that are the complete opposite of what it actually means.

pugworthy 4y ago

Bad product name anecdote... I used to work for Rogue Wave Software, who had a product called "Software Parts Manager" which was shortened to SPM, which was used to build code across a number of flavors of Unix, compilers, etc. The developers internally didn't seem to like it much. They called it SPAM instead of SPM. One day, I as the person managing the online commerce system, see there is an upgrade of one of the products. I scan the README file, and whoever wrote it internally constantly referenced "SPAM" in terms of how to use it. Anyway to this day, I am a stickler for making teams use the real name, and not the slang name. And if a team ever creates a derogatory name for a product, I see it as a huge red flag that the product itself has issues. But conversely if the slang name is a good one, it's worth considering making that the official or openly fun/positive unofficial name.

BeefWellington 4y ago
The past few years I've watched several clients rebrand their internal "CyberSecurity Awareness Month" to "Cyber Awareness Month" because of the stuff that had come out around Apple's photo scanning plans and the constant use of CSAM in those contexts.

_8j50 4y ago

We are doing this at $work, everyone says "zero trust" but means something different, high level goals set but hard to translate those to implementation. Someone argued with me that trusting a byod mobile phone for a 2fa app that phones home with checkmarks is zero trust because of the check alone, never mind a user's crappy android that isn't corporate managed/monitored is being used for both first and second factor auth. The fact that they do a lot of auth all over the place yet all that depends on the security of a random user's random personal phone being trusted does not prevent it from being called "the zero-trust way".

charlieyu1 4y ago

I’d rather be told that it is zero trust security than another fancy name that everyone knows it is bullshit

fatbird 4y ago

“Always Active Security”

jaginfosec 4y ago

The term “Zero Trust” is now a mainstream industry trend, for better or for worse. The positive aspect of this is that - especially for those of us in the information security industry - there’s a name for this security philosophy, and shift toward approaching security architectures and policy models form a holistic perspective, breaking down traditional silos and barriers. Really “Zero Trust” is about zero inherent or implicit trust. Zero Trust is about carefully building a foundation of trust (based on sound cryptographic validation), and growing that trust to ultimately permit an appropriate level of access at the right time. It could perhaps have been called “earned trust” or “adaptive trust” or “zero implicit trust,” and these would have suited the movement better, but “Zero Trust” has more sizzle, and it stuck. The term is now very broadly used - in fact, being the core part of the May 2021 White House executive order issued by President Biden. So we need to embrace it. However, for non-security people, I agree that the term can be off-putting or potentially insulting. I’ve seen enterprises deliberately term their Zero Trust initiatives as things such as “Modern Workplace Security”, or “Digital Transformation”. That’s fine - security leaders can and should adapt things to best suit the culture and context of their organizations. (If you’re interested in more, see my book and website on this subject at https://zerotrustsecurity.guide/ https://zerotrustsecurity.guide/ )