3 ms·
'Zero trust' as a term was popularized over a decade ago by John Kindervag, and has roots older than that. Kindervag focused on the fact that we shouldn't trus
by gz5 4y ago
'Zero trust' as a term was popularized over a decade ago by John Kindervag, and has roots older than that. Kindervag focused on the fact that we shouldn't trust LAN/WAN devices just because they were (apparently) on the LAN/WAN.
We are well beyond that era - devices, users, apps and data are now massively distributed. In this new era, the question is can we avoid 'trusting' all networks.
Of course, you need to trust something, so that paradigm would suggest that the app is the new edge, and only enable identified, authenticated, authorized ('trusted') app sessions to make ephemeral network connections. In that model, all inbound firewall ports are closed (not even dynamic port opening), so that unauthorized sessions can't even scan/probe.
- sascha_sl 4y agoStill have plenty of services with network trust everywhere I've worked, particularly in the oldest and slowest moving parts of an organization, but now I'm on VPN instead of LAN. I can still ping AD and SAP and whatever else one could find if you could run nmap on your work network. It's not really about trusting more or less outside networks, it's about exposing your network very selectively (e.g. single services behind authenticating proxies), preferably with a corporate login and some form of device attestation.