'Zero trust’ security is a poor choice of words

I suppose the thesis that it’s a bad name is borne out by the fact that many technical people misunderstand it; it’s a contraction of “zero trust networking” and is a fine description of the technical approach: don’t trust anyone by virtue of their network location. (Trust is negotiated at the application layer.)

#NoVPN or Zero Perimeter could be better slogans.

On the other hand, the only people I have seen confused are technical people that (incorrectly) think they have identified an inconsistency; non-technical folks seem fine to just map name->feature-set.

I have to agree that "zero trust" is terrible marketing (alongside "trustless computing" or variations of that). Generally, we think of "trust" as a positive term, and having zero of it seems bad. That's at least the brain-stem reaction I have to this term, and I think no amount of "but but but you see the problem is we trust the wrong things therefore we should have none of it" will fix the perception.

If I'm not mistaken, the point of the term is that you're not just punting to the firewall to protect your network: eggshells are not sufficient to protect eggs. Thus the proposal isn't "zero shell eggs", it's closer to "all shell no egg".

I don't have a good alternative to it, but maybe something like "Continuous Skepticism", "Always Verify", "Pervasive Vigilance", or "Verify Everything" might be terms that evolve in the right direction. I don't think any of these are winners, but at least none of these take a fairly universally positive term (like trust) and negate it without further explanation.

"Zero trust" really feels more like just an eye-popping bullet point in a consultant's slide deck that gets thrown in to make sure the client hasn't totally nodded off by the 10th slide...

Why should the average end user care or know what the internal security model and practices are referred to as? How would they even discover that a given app or brand is trying to enforce zero trust without reading their engineering blog or fine print or something like that? Such motivated person would certainly not be confused by the nomenclature. Many things are named sub-optimally in technology, this seems like a strange one to write a post on.

'Zero Trust' is not for end users.

For end users you have magic of single sign on - they use login to their work laptop and seamlessly navigate to whatever they need for their work without ANY login screens.

'Zero Trust' is for back-end services where you assume you need encryption at transit and you always need some authorization to check if someone or something has access to other stuff.

Zero Trust is really just defense in depth[0]. All the things it implements are DiD solutions that have existed way before the term Zero Trust emerged.

[0] https://www.forcepoint.com/cyber-edu/defense-depth

I think part of the issue with Zero Trust (ZT) is that it's been applied too broadly in too many contexts. For example, a number of cloud services advertise as ZT, but they probably would actually prefer the nomenclature Zero Knowledge. But of course zero knowledge is being namesquatted (ha!) by an actual cryptography concept, so people who know the difference rightly objected to companies co-opting it. Now a bunch non-cloud offering also want to get on the ZT bandwagon, which just further dilutes and muddies the meaning of the term. Since there's no actual standard defining ZT, it becomes just about as meaningful a descriptor as Best Practices and Military-Grade Encryption.

Well if you say what zero trust really is ...

- We treat the internal network the same as external networks, like your home network. Our systems don't care whether you are at home or at work - you'll have to verify and authenticate the same no matter what.

then workers will be asking "Oh, so why don't I just work from home..."

Reading the comments here you'd think this article was complaining about what zero trust is or how it is bad. Instead it is about how we explain Zero Trust to others and the very real interpretation of "zero trust for (you)" by end users hearing about this be policy.

A realistic interpretation given the way machines and etc are locked down. It doesn't seem like a bad idea to me to come up with a better name to avoid friction with those unfamiliar with the concept. Even as it is on HN people seem to jump to conclusions based on the name so imagine non technical users hearing about this.

Biggest problem with current "Zero Trust" implementations is they imply a full surveillance of employees' Internet traffic including man-in-the-middling their encrypted SSL requests. My company just deployed "ZScaler" -- a product marketed as a "zero trust" VPN solution but in actuality is an Orwellian surveillance tool. This will give "zero trust" a nice negative connotation very soon.

I wonder what user speed bumps people have seen around zero trust. When IBM started adopting it, employees rejoiced that they could access email and Slack without the VPN.

"Serverless Computing", "Agentless", and "Immutable Infrastructure" are all badly named.

I first heard the term a few years ago, but because I work in that space it didn't bother me. When I talk about it to network ops folks I like to say "perimeterless", which is a fair description of what they care most about: no more firewalls, DMZ, or "internal" vs "external".

The device-centric authentication and authorization part, I don't really have a good simple term. When it works well, I call it "better user experience" because to the people accessing, there's a lot less for them to deal with, and fewer passwords to remember or VPN status to worry about.

The lack of a VPN requirement is nice. The experience from my last job where we had a VPN was that everything worked pretty well for employees with company-issued laptops, but when a division hired contractors or brought in a third party, they weren't issued laptops, so they couldn't access anything on the VPN, leading to continuous support issues and work for the netops folks.

For my part I really like it because it addresses one aspect of security often neglected (even more so than security in general): internal malicious actors. Disgruntled employees, workers that expeditious bypass security because their boss has to have it NOW, executives and senior leadership that throw their weight around and get special access to bypass security, or simple human error. Also, all the un-encrypted internal traffic. In this case, "zero trust" applies, because where companies used to trust their employees not to screw around with company assets, hard experience has demonstrated that even absent malice, people do stupid things and it costs real money.

"Zero trust" is fine as a name; it's basically a reminder to be careful of where you place implicit trust in your security model. Self-reflection showed that typical corporate network models had an increasingly unjustified degree of trust in the integrity of their internal networks and endpoints attached to those networks; so that tends to be referent that people identify.

I have experienced first hand the reaction of people who feel "so you don't trust us any more"? What are we not allowed to do now? when first exposed to this term.

Part of the missing puzzle pieces here are ambiguity about the word "trust". People generally think it is a good thing to have trust. So why do we want zero of it? How can that possibly be a good thing?

I think something that emphasises the increase in trustworthiness of the overall system due to this would be ideal. Such as "continuous trust verification (CTV)" might be good.

It does not help that certain companies (looking at you ZScaler) have abused this term for marketing purposes. They are actively harming not just their own customers but the entire security industry through their branding of products completely unrelated to it as zero trust. A lot of people in decision making roles now believe Zero Trust(tm) means in fact, some things that are the complete opposite of what it actually means.

Bad product name anecdote...

I used to work for Rogue Wave Software, who had a product called "Software Parts Manager" which was shortened to SPM, which was used to build code across a number of flavors of Unix, compilers, etc.

The developers internally didn't seem to like it much. They called it SPAM instead of SPM. One day, I as the person managing the online commerce system, see there is an upgrade of one of the products. I scan the README file, and whoever wrote it internally constantly referenced "SPAM" in terms of how to use it.

Anyway to this day, I am a stickler for making teams use the real name, and not the slang name. And if a team ever creates a derogatory name for a product, I see it as a huge red flag that the product itself has issues. But conversely if the slang name is a good one, it's worth considering making that the official or openly fun/positive unofficial name.

The author give implementation details names which are also not good naming as not reflecting the global idea.

'Zero trust' as a term was popularized over a decade ago by John Kindervag, and has roots older than that. Kindervag focused on the fact that we shouldn't trust LAN/WAN devices just because they were (apparently) on the LAN/WAN.

We are well beyond that era - devices, users, apps and data are now massively distributed. In this new era, the question is can we avoid 'trusting' all networks.

Of course, you need to trust something, so that paradigm would suggest that the app is the new edge, and only enable identified, authenticated, authorized ('trusted') app sessions to make ephemeral network connections. In that model, all inbound firewall ports are closed (not even dynamic port opening), so that unauthorized sessions can't even scan/probe.

We are doing this at $work, everyone says "zero trust" but means something different, high level goals set but hard to translate those to implementation.

Someone argued with me that trusting a byod mobile phone for a 2fa app that phones home with checkmarks is zero trust because of the check alone, never mind a user's crappy android that isn't corporate managed/monitored is being used for both first and second factor auth. The fact that they do a lot of auth all over the place yet all that depends on the security of a random user's random personal phone being trusted does not prevent it from being called "the zero-trust way".

Mutually Assured Trust was the first thing that popped into my mind when reading the article. The premise of explaining things to end users and the difficulty of naming things also reminds me of the Kerberos paper [Designing an Authentication System: a Dialogue in Four Scenes](https://web.mit.edu/kerberos/dialogue.html). Zero Trust reminds me of Kerberos, reborn into a web-first world.

Trust and you'll be trusted said the liar to the fool.

I like to think of 'Zero Trust' in terms of OSI layers. Application layer (L7) authentication is used to authorize the session layer (L5).

The buzz around it is a bit annoying but the concept certainly is great.

Never trust by default, always verify.

Zero Trust is a fine phrase, but it greatly over claims. (Unless I'm missing something, and it eliminates trust requirements for third party SSO services, software supply chains, infrastructure operators, and other common attack vectors).

I’d rather be told that it is zero trust security than another fancy name that everyone knows it is bullshit

The term “Zero Trust” is now a mainstream industry trend, for better or for worse.

The positive aspect of this is that - especially for those of us in the information security industry - there’s a name for this security philosophy, and shift toward approaching security architectures and policy models form a holistic perspective, breaking down traditional silos and barriers.

Really “Zero Trust” is about zero inherent or implicit trust. Zero Trust is about carefully building a foundation of trust (based on sound cryptographic validation), and growing that trust to ultimately permit an appropriate level of access at the right time. It could perhaps have been called “earned trust” or “adaptive trust” or “zero implicit trust,” and these would have suited the movement better, but “Zero Trust” has more sizzle, and it stuck.

The term is now very broadly used - in fact, being the core part of the May 2021 White House executive order issued by President Biden. So we need to embrace it.

However, for non-security people, I agree that the term can be off-putting or potentially insulting. I’ve seen enterprises deliberately term their Zero Trust initiatives as things such as “Modern Workplace Security”, or “Digital Transformation”. That’s fine - security leaders can and should adapt things to best suit the culture and context of their organizations.

(If you’re interested in more, see my book and website on this subject at https://zerotrustsecurity.guide/ )

If I didn’t have Zero Trust, I wouldn’t have no trust at all.

“Always Active Security”

AI(Artificial Intelligence) is real poor choice of words, because of there is no intelligence at all, just math..