4 ms·
zero trust at its core means authentication and authorization at each service, for each request. at a high level it means not trusting a connection from another
by matthewaveryusa 4y ago
zero trust at its core means authentication and authorization at each service, for each request. at a high level it means not trusting a connection from another service in the same network just because it’s on the same network. rooting trust to tpms is orthogonal but certainly the right way to root trust.
The space where I think zero trust is the most interesting are vpns like tailscale/wireguard/microsegmentation that flip the status quo around and say the network is the identity/authoritzed group
- pclmulqdq 4y agoWait, but I thought everyone was doing that anyway prior to the "zero trust" thing. The difference was who you trusted to hold user (and concern-specific) keys - before zero trust, it was your server, and afterward, it's the user. Authentication and authorization for internal services is kind of basic.
- PeterisP 4y ago> I thought everyone was doing that anyway prior to the "zero trust" thing. Nope, lots and lots of organizations who have a zillion of internal services which they know to be insecure but are kept that way because they "are accessible only on the protected network".