3 ms·
I didn’t understand the marketing term “zero trust” and I still don’t. In practice, I get it - a network zone shouldn’t require a lower authn/z bar on the impl
by shermantanktop 2y ago
I didn’t understand the marketing term “zero trust” and I still don’t.
In practice, I get it - a network zone shouldn’t require a lower authn/z bar on the implicit assumption that admission to that zone must have required a higher bar.
But all these systems are built on trust, and if it isn’t based on network zoning, it’s based on something else. Maybe that other thing is better, maybe not. But it exists and it needs to be understood.
An actual zero trust system is the proverbial unpowered computer in a bunker.
- ngneer 2y agoWith you there. The marketing term makes Zero Sense to me.
- wmf 2y agoThe something else is specifically user/service identity. Not machine identity, not IP address. It is somewhat silly to have a buzzword that means "no, actually authenticate users" but here we are.
- athorax 2y agoIt means there is zero trust of a device/service/user on your network until they have been fully authenticated. It is about having zero trust in something just because it is inside your network perimeter.
- shermantanktop 2y agoMaybe it should be called "zero trust of a device/service/user on your network until they have been fully authenticated." But that wouldn't sell high-dollar consulting services.
- acdha 2y agoYeah, it’s not a great name. Twenty years ago we called it “end to end authentication” and I think that’s better because it focuses on the most important aspect, but it probably doesn’t sound as cool for marketing purposes. I also like how that makes it easier to understand how variation is normal: for example, authentication comes in various flavors and that’s okay whereas some of that zero trust vendors will try to claim that something is or isn’t ZT based on feature gaps in their competitors’ and it’s just so tedious to play that game.