4 ms·
'Zero Trust' is not for end users. For end users you have magic of single sign on - they use login to their work laptop and seamlessly navigate to whatever the
by ozim 4y ago
'Zero Trust' is not for end users.
For end users you have magic of single sign on - they use login to their work laptop and seamlessly navigate to whatever they need for their work without ANY login screens.
'Zero Trust' is for back-end services where you assume you need encryption at transit and you always need some authorization to check if someone or something has access to other stuff.
- tgsovlerkhgsel 4y agoThis. Zero Trust will be a pain for service owners, admins etc., but for the end user, it should be pretty smooth. There may be bugs/errors initially, but there should not be any permanently added friction. Quite the opposite, Zero Trust can mean that the user can now access services that previously needed a VPN from anywhere, without caring what network they are one.
- jameshart 4y agoHonestly one of the hardest things about zero trust is getting end users who aren’t used to it to stop trying to solve problems by turning on the VPN. (We are almost completely zero trust, but obviously there are still a few legacy systems you need to connect to a VPN to access) I don’t do deskside support, but I do have to help nontechnical people interact with apps and services occasionally, and often their first troubleshooting step is ‘make sure the VPN is on’, whereas mine tends to be ‘let’s eliminate a potential source of network craziness and make sure the VPN is definitely off’ So do tend to think that the important messaging for end users is that zero trust is about eliminating something - making things simpler. Maybe ‘networkless’ would be a better word…
- rocqua 4y agoThat is not the idea currently being pushed. The zero trust idea is 'just because they are on the right subnet doesn't mean you can trust them'. So you add things like healthyness checks (is this device up to date), anomaly detection, and use those to dynamically determine how much authentication challenge you give a user. For this to work, the key is really good and easy single sign on with second factor also made easy. That way you can do more trusted authentication (a SSO token backed by Microsoft login is harder to phish than just a password. More importantly, it really lowers the authentication burden on your users.
- hamandcheese 4y agoData point: Parents definition of zero-trust largely matched mine and doesn’t seem particularly incompatible with yours.
- rocqua 4y agoZeeo trust, as I understand it, is all about authenticating user devices, rather than fixed appliances. It is much less something that happens between appliances (though appliances authenticating themselves to clients does count). I think that is incompatible with what parent said.
- jameshart 4y agoRight. From an end user perspective, zero trust manifests as ‘single sign-on’. Which is easy enough to grasp.
- ozim 4y agoAdd to that it will be marketing tool for B2B market - "we support SSO and Zero Trust", your users will seamlessly login to our solution and after they login we check at each step if they have access to the resources they want to access.
- indymike 4y agoZero Trust is as simple as setting up your network so there are no arbitrary services added to the network that are discoverable or visible that are not known in advance, vetted and trusted. For end users it looks like a wifi hotspot where you cannot see other machines connected to the hotspot, and they cannot see you. Most modern services work fine in this environment, but older less secure, let's host a server on my desktop type software will not work. It also means getting rid of a lot of shared services where Bob in sales can click on an attachment and bitlocker all the contents of shared drives. Zero Trust unlocks a couple very desirable things: simpler LANs with less stuff to break, it's harder for trojans to spread, and better access control. Zero Trust is also really hard to do in places where you have a huge, managed LAN and a bunch of thick client software that relies on direct network connections, or direct connections to database servers and the like.
- jameshart 4y agoThis is a really odd description of zero trust. For end users, zero trust looks like ‘not needing to check the VPN icon is green before you launch the payroll app’. The concept of ‘being on the network’ goes away. Which is good, because that was a major source of confusion for end users.
- indymike 4y agoI love how the industry takes a word like "devops" and redefines it until meaningless. I think that has happened to Zero Trust as well.
- jameshart 4y agoBut.. your description doesn’t match up with what I think the original definition of zero trust means? You said it was about preventing unknown services turning up on a network, which almost feels like the opposite of zero trust to me. Zero trust is about not caring if unknown services are on your network, because merely ‘being on the network’ doesn’t grant you access or trust.
- theptip 4y agoReading the original BeyondCorp paper, I think Zero Trust was from the beginning construed as an end-user-facing replacement for VPNs. Sure, you can use it for backend services too, but it definitely doesn’t exclude end-users.
- Josteniok 4y agoI work for a really large organization that has received praise for what it is doing with zero trust but to us lowly users the implementation has really meant the total death of single sign on. We sign on constantly to everything now all the time.