Hacker News Reader

Comment by senectus1 | Hacker News Reader

I know of an org that recently required that the term "Zero Trust" is not used when talking about their security architecture. Because, i kid you not, It makes it sound like they dont trust their staff.

View on HN

When you could be talking to people not familiar with IT security and the threat models it has to handle, it absolutely makes sense to avoid terms that could give a false impression to those people.

It also obscures the actual trust relationships in the architecture as deployed. A lot of Okta's clients may be structured to have zero trust in their networking infrastructure -- but as they've delegated identity management to Okta, they have total trust in Okta itself. (If a hostile third party takes contol of Okta, that party can then act as anyone -- and therefore, with any role -- they like.)

Zero trust, it’s not that you don’t trust your staff —- it’s that you don’t need to.

Zero trust essentially means you don't have internal trusted networks, so everything works as if it was on the internet, and is protected and authenticated appropriately.

It has nothing to do with whether you trust your staff or not.

In fact, you should not trust your staff from a security perspective, insider attacks are a valid threat. This is true regardless of whether you use a zero trust architecture or not.

> insider attacks are a valid threat.

Especially if their machine's compromised.

Technically, that isn't an insider attack. It's an external threat actor who is using the access provided by the compromised machine of the (presumably innocent) insider. Still a valid threat, just not an insider threat.

It means “trust, but verify”.

Unfortunately, the term "zero trust" has been used by some to promote their insider threat tool/service. I've seen a lot of sales pitches from vendors that include slides about how their tool prevents the next Snowden.

If you go back to the original sources of the zero trust concept stress that it should only apply to machines. Processes really don't have the concept of "trust" that people do (gain/lose trust, trusted to a degree, etc.). So we should build systems with that in mind.

I worked at a start up that was reading all these zero trust blogs or what have you. They outright told us they didn't trust us. We weren't allowed to talk to one another unless we had permission, etc. Was bizarre, but mostly a mechanism so our boss could say whatever they wanted to the CEO and no one knew anything of what was really happening.

I’ve worked at companies with similar attitudes, but they dealt with insanely sensitive information.

There strict firewalls about who could talk to who. We were given lists of things we could talk about socially (the weather, etc).

But the effect was more of an information clean room, rather than a dictatorship. There were always numerous ways to report wrongdoing.

That sounds incredibly dysfunctional. Even if they thought zero trust means not trusting your staff (it doesn't), behaving like that will not help security, and will almost certainly undermine it.

Turn over was very high. It was very dysfunctional for everyone except the two bosses at the top before the ceo. They controlled and manipulated all the information.

Zero trust is indeed not a good way to define it, rather a marketing pitch.

Ultimately you'd have to trust someone even that reduced to one, do you even trust yourself?

It's infeasible to implement something that's absolutely based on trust none. The so called "Zero trust" is merely escalated restriction but still "as need basis".

It sucks that some companies start their product creation process by imagining a dystopian panopticon with their client in control.

What do they use instead of saying "zero trust"?

This is probably not what they say, but the unambiguous expansion of the term would be “Don’t put employee computers on internal networks and don’t rely on network topology for authentication.”

Probably something like "limited access" or "authenticated users". Could also include micro segmentation.

The basics are pretty straight forward, but every vendor has stretched to include their key capabilities which makes the idea murky.

BeyondCorp, NoVPN, EndToEndSec, something like that

Reply on news.ycombinator.com