3 ms·

Every zero trust architecture ends up trusting an unbounded set of machines. Like most marketing terms, it’s probably easier to assume it does the inverse of w

by hedora 2y ago

Every zero trust architecture ends up trusting an unbounded set of machines. Like most marketing terms, it’s probably easier to assume it does the inverse of what it claims. My mental model: With 1 trust (the default) any trusted machine with credentials is provided access and therefore gets one unit of access. With 2-trust, we’d need at least units of trust, so two machines. Equivalently, each credential-bearing machine is half trusted (think ssh bastion hosts or 2FA / mobikeys for 2 trust). This generalizes to 1/N, so for zero trust, we place 1/0 = infinite units of trust in every machine that has a credential. In other words, if we provision any one machine for access, we necessarily provision an unbounded number of other machines for the same level of access. As snarky as this math is, I’ve yet to see a more accurate formulation of what zero trust architectures actually provide. YMmV.

choeger 2y ago
I think your model is absolutely right. But there's a catch: Zero Trust (TM) is about not giving any machine any particular kind of access. So it's an infinite amount of machines with zero access. The point of Zero Trust (TM) is to authenticate and authorize the human being behind the machine, not the machine itself. (Clearly, that doesn't work for all kinds of automated access and it comes with a lot of question in terms of implementation details (E.g., do we trust the 2FA device?) but that's the gist.)
EthanHeilman 2y ago
In my view the eventual goal of security is to reduce all excess trust to zero. Excess trust is all trust which is not fundamental to thing you are trying to do. If you want a feature that let's Alice update policy, you need to trust Alice to update policy. I believe that a system without any excess trust is worth building that's why I founded BastionZero and why I joined Cloudflare to work on this. Getting there is a long walk through the woods on a moonless night. > With 2-trust, we’d need at least units of trust, so two machines. Equivalently, each credential-bearing machine is half trusted (think ssh bastion hosts or 2FA / mobikeys for 2 trust). You might be interested in OpenPubkey[0, 1] which was developed at BastionZero. It has 1/2 trust for OpenIDConnect and can be used for SSH. > As snarky as this math is, I’ve yet to see a more accurate formulation of what zero trust architectures actually provide. I prefer the term epsilon-trust to reflect the nature of security and trust reduction as an iterative process. The trust in a system approaches but never fully reaches zero. [0]: OpenPubkey: Augmenting OpenID Connect with User held Signing Keys https://eprint.iacr.org/2023/296 https://eprint.iacr.org/2023/296 [1]: https://github.com/openpubkey/openpubkey/ https://github.com/openpubkey/openpubkey/
glitchc 2y ago
That's not the intention of zero-trust. As others have said, it's about authenticating the user and associated privilege, not the machine itself. Simply put, zero trust means machines on the intranet must undergo a user-centric authentication and authorization step prior to accessing any resource. Additionally, once authenticated, a distinct secure channel can be established between the specific endpoint and the resource that cannot be observed or manipulated by others on the same network.

by hedora 2y ago

choeger 2y ago

I think your model is absolutely right. But there's a catch: Zero Trust (TM) is about not giving any machine any particular kind of access. So it's an infinite amount of machines with zero access. The point of Zero Trust (TM) is to authenticate and authorize the human being behind the machine, not the machine itself. (Clearly, that doesn't work for all kinds of automated access and it comes with a lot of question in terms of implementation details (E.g., do we trust the 2FA device?) but that's the gist.)

EthanHeilman 2y ago

In my view the eventual goal of security is to reduce all excess trust to zero. Excess trust is all trust which is not fundamental to thing you are trying to do. If you want a feature that let's Alice update policy, you need to trust Alice to update policy. I believe that a system without any excess trust is worth building that's why I founded BastionZero and why I joined Cloudflare to work on this. Getting there is a long walk through the woods on a moonless night. > With 2-trust, we’d need at least units of trust, so two machines. Equivalently, each credential-bearing machine is half trusted (think ssh bastion hosts or 2FA / mobikeys for 2 trust). You might be interested in OpenPubkey[0, 1] which was developed at BastionZero. It has 1/2 trust for OpenIDConnect and can be used for SSH. > As snarky as this math is, I’ve yet to see a more accurate formulation of what zero trust architectures actually provide. I prefer the term epsilon-trust to reflect the nature of security and trust reduction as an iterative process. The trust in a system approaches but never fully reaches zero. [0]: OpenPubkey: Augmenting OpenID Connect with User held Signing Keys https://eprint.iacr.org/2023/296 https://eprint.iacr.org/2023/296 [1]: https://github.com/openpubkey/openpubkey/ https://github.com/openpubkey/openpubkey/

glitchc 2y ago

That's not the intention of zero-trust. As others have said, it's about authenticating the user and associated privilege, not the machine itself. Simply put, zero trust means machines on the intranet must undergo a user-centric authentication and authorization step prior to accessing any resource. Additionally, once authenticated, a distinct secure channel can be established between the specific endpoint and the resource that cannot be observed or manipulated by others on the same network.