[HN Gopher] 'Zero Trust' security is a poor choice of words
___________________________________________________________________
'Zero Trust' security is a poor choice of words
Author : politelemon
Score : 110 points
Date : 2022-07-16 13:22 UTC (9 hours ago)
(HTM) web link (code.mendhak.com)
(TXT) w3m dump (code.mendhak.com)
| NovemberWhiskey wrote:
| "Zero trust" is fine as a name; it's basically a reminder to be
| careful of where you place implicit trust in your security model.
| Self-reflection showed that typical corporate network models had
| an increasingly unjustified degree of trust in the integrity of
| their internal networks and endpoints attached to those networks;
| so that tends to be referent that people identify.
| indymike wrote:
| I think zero trust describes the philosophy more than the
| implementation. Design the network so that we treat every
| device like it is not to be trusted.
| donutshop wrote:
| The buzz around it is a bit annoying but the concept certainly is
| great.
|
| Never trust by default, always verify.
| gz5 wrote:
| 'Zero trust' as a term was popularized over a decade ago by John
| Kindervag, and has roots older than that. Kindervag focused on
| the fact that we shouldn't trust LAN/WAN devices just because
| they were (apparently) on the LAN/WAN.
|
| We are well beyond that era - devices, users, apps and data are
| now massively distributed. In this new era, the question is can
| we avoid 'trusting' _all_ networks.
|
| Of course, you need to trust something, so that paradigm would
| suggest that the app is the new edge, and only enable identified,
| authenticated, authorized ('trusted') app sessions to make
| ephemeral network connections. In that model, all inbound
| firewall ports are closed (not even dynamic port opening), so
| that unauthorized sessions can't even scan/probe.
| sascha_sl wrote:
| Still have plenty of services with network trust everywhere
| I've worked, particularly in the oldest and slowest moving
| parts of an organization, but now I'm on VPN instead of LAN. I
| can still ping AD and SAP and whatever else one could find if
| you could run nmap on your work network.
|
| It's not really about trusting more or less outside networks,
| it's about exposing your network very selectively (e.g. single
| services behind authenticating proxies), preferably with a
| corporate login _and_ some form of device attestation.
| qzw wrote:
| I think part of the issue with Zero Trust (ZT) is that it's been
| applied too broadly in too many contexts. For example, a number
| of cloud services advertise as ZT, but they probably would
| actually prefer the nomenclature Zero Knowledge. But of course
| zero knowledge is being namesquatted (ha!) by an actual
| cryptography concept, so people who know the difference rightly
| objected to companies co-opting it. Now a bunch non-cloud
| offering also want to get on the ZT bandwagon, which just further
| dilutes and muddies the meaning of the term. Since there's no
| actual standard defining ZT, it becomes just about as meaningful
| a descriptor as Best Practices and Military-Grade Encryption.
| jeremygaither wrote:
| Mutually Assured Trust was the first thing that popped into my
| mind when reading the article. The premise of explaining things
| to end users and the difficulty of naming things also reminds me
| of the Kerberos paper [Designing an Authentication System: a
| Dialogue in Four
| Scenes](https://web.mit.edu/kerberos/dialogue.html). Zero Trust
| reminds me of Kerberos, reborn into a web-first world.
| [deleted]
| mattacular wrote:
| Why should the average end user care or know what the internal
| security model and practices are referred to as? How would they
| even discover that a given app or brand is trying to enforce zero
| trust without reading their engineering blog or fine print or
| something like that? Such motivated person would certainly not be
| confused by the nomenclature. Many things are named sub-optimally
| in technology, this seems like a strange one to write a post on.
| 0xCMP wrote:
| Reading the comments here you'd think this article was
| complaining about what zero trust is or how it is bad. Instead it
| is about how we explain Zero Trust to others and the very real
| interpretation of "zero trust for (you)" by end users hearing
| about this be policy.
|
| A realistic interpretation given the way machines and etc are
| locked down. It doesn't seem like a bad idea to me to come up
| with a better name to avoid friction with those unfamiliar with
| the concept. Even as it is on HN people seem to jump to
| conclusions based on the name so imagine non technical users
| hearing about this.
| gravitate wrote:
| Zero Trust is really just defense in depth[0]. All the things it
| implements are DiD solutions that have existed way before the
| term Zero Trust emerged.
|
| [0] https://www.forcepoint.com/cyber-edu/defense-depth
| pid-1 wrote:
| I also like the term "Onion Approach to Security"
| jameshart wrote:
| Defense in depth, combined with abandoning the pretense that
| certain things that _were_ regarded as security perimeters
| (like 'having an IP address on a specific subnet') we're not
| really defenses in the first place.
| tenebrisalietum wrote:
| Well if you say what zero trust really is ...
|
| - We treat the internal network the same as external networks,
| like your home network. Our systems don't care whether you are at
| home or at work - you'll have to verify and authenticate the same
| no matter what.
|
| then workers will be asking "Oh, so why don't I just work from
| home..."
| indymike wrote:
| This is probably one of the best descriptions.
| G3rn0ti wrote:
| Biggest problem with current "Zero Trust" implementations is they
| imply a full surveillance of employees' Internet traffic
| including man-in-the-middling their encrypted SSL requests. My
| company just deployed "ZScaler" -- a product marketed as a "zero
| trust" VPN solution but in actuality is an Orwellian surveillance
| tool. This will give "zero trust" a nice negative connotation
| very soon.
| zemnmez wrote:
| i'm not really sure what you mean. most of these products are
| indeed reverse-proxies, but reverse proxies do not sit in front
| of the whole internet, just corporate services
| gatkinso wrote:
| more like - 'zero trust' in the sense you cannot trust it
| helloooooooo wrote:
| A lot of the time, SSL MITM proxies are used as a mechanism to
| detect malicious content within a corporate content. I have
| seen, deployed across millions of machines, prevent phishing
| documents from being detonated thousands of times.
| AaronFriel wrote:
| Single point of failure devices for decryption of traffic
| (MitM) is not in line with the original definition of "zero
| trust", and VPNs certainly aren't either.
|
| Zero trust arose out of this exact sort of scenario following
| the Snowden leaks and the NSA document showing "SSL added and
| removed here". End to end encryption and removing MitM
| middleboxes was the _answer_ to SSL intercepting proxies.
|
| This is a VPN/SSL interception product attempting to remain
| relevant by advertising as something it isn't.
| mt42or wrote:
| The author give implementation details names which are also not
| good naming as not reflecting the global idea.
| mjw1007 wrote:
| I think "Boundaryless Security" is decent.
|
| The first big step that systems people are calling "Zero Trust"
| have in common is that they don't trust devices based on the
| (physical or virtual) network they're connecting from.
|
| There are all kinds of other things that are still trusted, so
| "Zero" isn't terribly helpful.
| fomine3 wrote:
| This. Zero is for device/network but still there are other
| trusts.
| wmf wrote:
| I wonder what user speed bumps people have seen around zero
| trust. When IBM started adopting it, employees _rejoiced_ that
| they could access email and Slack without the VPN.
| bunnie wrote:
| I have to agree that "zero trust" is terrible marketing
| (alongside "trustless computing" or variations of that).
| Generally, we think of "trust" as a positive term, and having
| zero of it seems bad. That's at least the brain-stem reaction I
| have to this term, and I think no amount of "but but but you see
| the problem is we trust the wrong things therefore we should have
| none of it" will fix the perception.
|
| If I'm not mistaken, the point of the term is that you're not
| just punting to the firewall to protect your network: eggshells
| are not sufficient to protect eggs. Thus the proposal isn't "zero
| shell eggs", it's closer to "all shell no egg".
|
| I don't have a good alternative to it, but maybe something like
| "Continuous Skepticism", "Always Verify", "Pervasive Vigilance",
| or "Verify Everything" might be terms that evolve in the right
| direction. I don't think any of these are winners, but at least
| none of these take a fairly universally positive term (like
| trust) and negate it without further explanation.
|
| "Zero trust" really feels more like just an eye-popping bullet
| point in a consultant's slide deck that gets thrown in to make
| sure the client hasn't totally nodded off by the 10th slide...
| eslaught wrote:
| "No trust required"
|
| I think that's what's intended by "zero trust". It's not that
| trust is bad, it's that it's not _necessary_ when you architect
| the system in a certain way.
| OJFord wrote:
| Absolutely correct, and I think everyone/most here including
| GP know that, it's just that 'zero trust' doesn't obviously
| sound like that.
|
| Paraphrasing you slightly, it's missing a word: 'zero trust
| [required]'.
| BrianOnHN wrote:
| > I don't have a good alternative to it, but maybe something
| like
|
| I thought "trust" was working out just fine...
|
| What happened? When did we lose the ability to trust?
|
| Maybe it would be easier to try to find new way to build trust?
| Rather than replacing it altogether?
| PaulHoule wrote:
| One defining trait of 2022 is the breakdown of trust. (The
| other is that people insist that "this time is different" and
| that history doesn't have anything to teach us about the
| current time.)
|
| If you look at /new/ on HN you will see there are people who
| have nothing better to do than second-guess every decision
| the government or any other organization made about the
| coronavirus.
|
| Blockheads think you can't trust banks, central banks, or
| anybody except the person who wants you to buy the latest
| shitcoin.
| decremental wrote:
| This really isn't the right story for diving into this line
| of discussion.
| PaulHoule wrote:
| Yes, except that when marketing is involved the first
| order of emotional response is that you put the words in
| the blender and treat them as a "bag of words"
| independent of order or contextual meaning. That's just
| how people respond in the first 0.2 s, and since people
| receive one or two orders of magnitude of marketing
| communications than they can process that first 0.2s is
| critical as to if they will see any more of it.
| Cas6767 wrote:
| Trust and you'll be trusted said the liar to the fool.
| ozim wrote:
| 'Zero Trust' is not for end users.
|
| For end users you have magic of single sign on - they use login
| to their work laptop and seamlessly navigate to whatever they
| need for their work without ANY login screens.
|
| 'Zero Trust' is for back-end services where you assume you need
| encryption at transit and you always need some authorization to
| check if someone or something has access to other stuff.
| tgsovlerkhgsel wrote:
| This. Zero Trust will be a pain for service owners, admins
| etc., but for the end user, it should be pretty smooth. There
| may be bugs/errors initially, but there should not be any
| permanently added friction.
|
| Quite the opposite, Zero Trust can mean that the user can now
| access services that previously needed a VPN from anywhere,
| without caring what network they are one.
| jameshart wrote:
| Honestly one of the hardest things about zero trust is
| getting end users who aren't used to it to _stop trying to
| solve problems by turning on the VPN_.
|
| (We are almost completely zero trust, but obviously there are
| still a few legacy systems you need to connect to a VPN to
| access)
|
| I don't do deskside support, but I do have to help
| nontechnical people interact with apps and services
| occasionally, and often their first troubleshooting step is
| 'make sure the VPN is on', whereas mine tends to be 'let's
| eliminate a potential source of network craziness and make
| sure the VPN is definitely _off_ '
|
| So do tend to think that the important messaging for end
| users is that zero trust is about eliminating something -
| making things simpler.
|
| Maybe 'networkless' would be a better word...
| theptip wrote:
| Reading the original BeyondCorp paper, I think Zero Trust was
| from the beginning construed as an end-user-facing replacement
| for VPNs. Sure, you can use it for backend services too, but it
| definitely doesn't exclude end-users.
| indymike wrote:
| Zero Trust is as simple as setting up your network so there are
| no arbitrary services added to the network that are
| discoverable or visible that are not known in advance, vetted
| and trusted. For end users it looks like a wifi hotspot where
| you cannot see other machines connected to the hotspot, and
| they cannot see you. Most modern services work fine in this
| environment, but older less secure, let's host a server on my
| desktop type software will not work. It also means getting rid
| of a lot of shared services where Bob in sales can click on an
| attachment and bitlocker all the contents of shared drives.
|
| Zero Trust unlocks a couple very desirable things: simpler LANs
| with less stuff to break, it's harder for trojans to spread,
| and better access control. Zero Trust is also really hard to do
| in places where you have a huge, managed LAN and a bunch of
| thick client software that relies on direct network
| connections, or direct connections to database servers and the
| like.
| jameshart wrote:
| This is a really odd description of zero trust.
|
| For end users, zero trust looks like 'not needing to check
| the VPN icon is green before you launch the payroll app'.
|
| The concept of 'being on the network' goes away. Which is
| good, because that was a major source of confusion for end
| users.
| indymike wrote:
| I love how the industry takes a word like "devops" and
| redefines it until meaningless. I think that has happened
| to Zero Trust as well.
| jameshart wrote:
| But.. your description doesn't match up with what I think
| the original definition of zero trust means?
|
| You said it was about preventing unknown services turning
| up on a network, which almost feels like the opposite of
| zero trust to me.
|
| Zero trust is about not _caring_ if unknown services are
| on your network, because merely 'being on the network'
| doesn't grant you access or trust.
| onionisafruit wrote:
| To put it more succinctly, in the zero-trust mindset it
| isn't ever _your_ network.
|
| It's a network you happen to be connected to. Your only
| trust the network at the physical layer that it won't
| destroy your hardware. Beyond that you don't trust
| anything you receive over the network that you can't
| independently verify.
| Josteniok wrote:
| I work for a really large organization that has received praise
| for what it is doing with zero trust but to us lowly users the
| implementation has really meant the total death of single sign
| on. We sign on constantly to everything now all the time.
| rocqua wrote:
| That is not the idea currently being pushed.
|
| The zero trust idea is 'just because they are on the right
| subnet doesn't mean you can trust them'. So you add things like
| healthyness checks (is this device up to date), anomaly
| detection, and use those to dynamically determine how much
| authentication challenge you give a user.
|
| For this to work, the key is really good and easy single sign
| on with second factor also made easy. That way you can do more
| trusted authentication (a SSO token backed by Microsoft login
| is harder to phish than just a password. More importantly, it
| really lowers the authentication burden on your users.
| hamandcheese wrote:
| Data point: Parents definition of zero-trust largely matched
| mine and doesn't seem particularly incompatible with yours.
| rocqua wrote:
| Zeeo trust, as I understand it, is all about authenticating
| user devices, rather than fixed appliances. It is much less
| something that happens between appliances (though
| appliances authenticating themselves to clients does
| count).
|
| I think that is incompatible with what parent said.
| jameshart wrote:
| Right. From an end user perspective, zero trust manifests as
| 'single sign-on'. Which is easy enough to grasp.
| ozim wrote:
| Add to that it will be marketing tool for B2B market - "we
| support SSO and Zero Trust", your users will seamlessly login
| to our solution and after they login we check at each step if
| they have access to the resources they want to access.
| g8oz wrote:
| I like to think of 'Zero Trust' in terms of OSI layers.
| Application layer (L7) authentication is used to authorize the
| session layer (L5).
| amerine wrote:
| This is exactly my mental model as well!!! believe it's the
| right one too.
| theptip wrote:
| I suppose the thesis that it's a bad name is borne out by the
| fact that many technical people misunderstand it; it's a
| contraction of "zero trust networking" and is a fine description
| of the technical approach: don't trust anyone by virtue of their
| network location. (Trust is negotiated at the application layer.)
|
| #NoVPN or Zero Perimeter could be better slogans.
|
| On the other hand, the only people I have seen confused are
| technical people that (incorrectly) think they have identified an
| inconsistency; non-technical folks seem fine to just map
| name->feature-set.
| powerhour wrote:
| We could take cues from the food world: Better Than VPN, I
| can't believe it's not VPN!
|
| I'm not really convinced the name is a real problem. We use a
| lot of terms that aren't obvious and it works just fine. For
| example, http. First you have to learn that means Hypertext
| Transfer Protocol, then you have to learn what Hypertext means,
| and then you have to learn that it's used for a lot more than
| Hypertext these days.
| cmeacham98 wrote:
| The problem isn't that it's not obvious, but that it's
| actively counterintuitive.
|
| If a car company was called 'GJKN', and that stood for some
| obscure acronym, you'd just memorize that. But you'd probably
| be a lot more confused by the car company 'NoWheels' when
| their car still has wheels, just in different places.
| herghost wrote:
| Agreed - I've seen the same result in my current company. The
| only real objection raised is from a technical pedant who
| argues that we're trusting identity and so we shouldn't call in
| _Zero_ Trust. He's almost deliberately missing the point
| though.
|
| Our users, on the other hand, are not making any real noise
| about it because from their point of view it's the natural
| extension of SSO (from the point of view of that being the only
| bit that they will interact with in any meaningful way) and
| that was something that reduced friction for them too.
|
| We've not suffered from the name really, to be honest.
| staticassertion wrote:
| You can have ZTN with a VPN and you can have a perimeter with
| ZTN. What you can't have is trust based on network position. So
| I think Zero Trust is fine.
|
| It's a marketing term ultimately and any practitioner should be
| able to understand what it means. If they don't it's kinda on
| them.
| otterley wrote:
| +1 for NoVPN. It's short, sweet, and quickly conveys the
| benefit. It may also remind people of the frustrations they
| often face using VPN software, which is often flaky and has a
| poor UI, so eliminating it could be met with feelings of
| relief.
|
| Nevertheless, it's always a little unsettling whenever some
| Internet rando confidently posits that a phrase conveys a
| certain meaning or emotional reaction to people _without any
| evidence whatsoever._ I mean, come on, do a little market
| research. Do your homework. (The same goes for me!)
| vasco wrote:
| Makes no sense to do market research for this. You throw a
| new naming out there and see if it sticks. If it sticks,
| done, if not, no market research needed.
| l33t2328 wrote:
| I don't really have an opinion on this but isn't "seeing if
| it sticks" just other words for market research?
| goalieca wrote:
| I disagree with novpn because having a vpn or private network
| is a useful layer in the overall defence.
| feanaro wrote:
| It's a bad term in the sense that it's not self-explanatory.
| Hearing just the term itself is likely to give you the wrong
| idea about what it means.
|
| Learning a name -> feature mapping isn't a problem in itself,
| but the fact that you have to do it before you get an
| approximately correct idea regarding what it's about is an
| unnecessary inefficiency.
| atoav wrote:
| Without going to much into it I thought _Zero Trust_ is some
| new funky cryptographic way of eliminating the need for trust
| in some interaction between parties.
|
| Turns out it is just a different phrase for the existing
| concept of defense in depth.
| lucideer wrote:
| Zero trust isn't the same as defence in depth.
|
| Certainly one could define defence in depth as a component of
| zero trust I guess (very vaguely) but they represent
| different perspectives.
|
| Defence in depth is a technologically focused approach:
| implementing redundant checks at multiple architectural
| layers of a stack.
|
| Zero trust is about the high-level approach to perimeters and
| ACLs, including not only tech & stack architecting, but
| organisational messaging / policy / culture.
| hedora wrote:
| Zero Trust is a fine phrase, but it greatly over claims. (Unless
| I'm missing something, and it eliminates trust requirements for
| third party SSO services, software supply chains, infrastructure
| operators, and other common attack vectors).
| foobiekr wrote:
| It doesn't eliminate the trust requirement for any of those at
| all.
|
| It's easier to talk about zero trust by identifying the thing
| it is not. For example, ZT is not "it is sufficient to be
| inside X" where X is on a host, in a container or not, on a
| subnet (we are less than ten years way from having to argue
| with people about "why are we using encryption on our internal
| connections?"), or some other context, and so on.
| hedora wrote:
| So, (precisely speaking) it is increasing the set of network
| endpoints that are trusted from a LAN to the entire internet.
| NavinF wrote:
| The opposite: increasing the set of network endpoints that
| are untrusted from the internet to both the internet and
| the LAN.
| hxtk wrote:
| The way that Google handles it, at least based on their
| publications about BeyondCorp is that endpoints are
| authenticated cryptographically by TLS certificates backed
| by their TPM chips.
|
| When someone tries to connect to a service, instead of
| having a firewall verify their device is trusted by
| checking the IP address is within a trusted range, the
| device is authenticated by the Access Proxy using mutual
| TLS.
|
| Authorization decisions incorporate both device and user
| privileges. A machine that isn't registered as being
| physically bolted to the floor inside a physical security
| domain won't be able to access certain highly restricted
| resources. A machine that isn't registered as being up to
| date on security patches will also have privileges
| restricted. A machine which does not present a client
| certificate or presents a client certificate that is no
| longer trusted will only be able to access services
| intended for the public.
|
| Instead of treating the subnet as a de facto database of
| trusted machines, there's an actual database of trusted
| machines that is incorporated into authorization decisions
| at access time.
| glintik wrote:
| AI(Artificial Intelligence) is real poor choice of words, because
| of there is no intelligence at all, just math..
| cratermoon wrote:
| I first heard the term a few years ago, but because I work in
| that space it didn't bother me. When I talk about it to network
| ops folks I like to say "perimeterless", which is a fair
| description of what they care most about: no more firewalls, DMZ,
| or "internal" vs "external".
|
| The device-centric authentication and authorization part, I don't
| really have a good simple term. When it works well, I call it
| "better user experience" because to the people accessing, there's
| a lot less for them to deal with, and fewer passwords to remember
| or VPN status to worry about.
|
| The lack of a VPN requirement is nice. The experience from my
| last job where we had a VPN was that everything worked pretty
| well for employees with company-issued laptops, but when a
| division hired contractors or brought in a third party, they
| weren't issued laptops, so they couldn't access anything on the
| VPN, leading to continuous support issues and work for the netops
| folks.
|
| For my part I really like it because it addresses one aspect of
| security often neglected (even more so than security in general):
| internal malicious actors. Disgruntled employees, workers that
| expeditious bypass security because their boss has to have it
| NOW, executives and senior leadership that throw their weight
| around and get special access to bypass security, or simple human
| error. Also, all the un-encrypted internal traffic. In this case,
| "zero trust" applies, because where companies used to trust their
| employees not to screw around with company assets, hard
| experience has demonstrated that even absent malice, people do
| stupid things and it costs real money.
___________________________________________________________________
(page generated 2022-07-16 23:00 UTC)