[HN Gopher] 'Zero Trust' security is a poor choice of words
       ___________________________________________________________________
        
       'Zero Trust' security is a poor choice of words
        
       Author : politelemon
       Score  : 110 points
       Date   : 2022-07-16 13:22 UTC (9 hours ago)
        
 (HTM) web link (code.mendhak.com)
 (TXT) w3m dump (code.mendhak.com)
        
       | NovemberWhiskey wrote:
       | "Zero trust" is fine as a name; it's basically a reminder to be
       | careful of where you place implicit trust in your security model.
       | Self-reflection showed that typical corporate network models had
       | an increasingly unjustified degree of trust in the integrity of
       | their internal networks and endpoints attached to those networks;
       | so that tends to be referent that people identify.
        
         | indymike wrote:
         | I think zero trust describes the philosophy more than the
         | implementation. Design the network so that we treat every
         | device like it is not to be trusted.
        
       | donutshop wrote:
       | The buzz around it is a bit annoying but the concept certainly is
       | great.
       | 
       | Never trust by default, always verify.
        
       | gz5 wrote:
       | 'Zero trust' as a term was popularized over a decade ago by John
       | Kindervag, and has roots older than that. Kindervag focused on
       | the fact that we shouldn't trust LAN/WAN devices just because
       | they were (apparently) on the LAN/WAN.
       | 
       | We are well beyond that era - devices, users, apps and data are
       | now massively distributed. In this new era, the question is can
       | we avoid 'trusting' _all_ networks.
       | 
       | Of course, you need to trust something, so that paradigm would
       | suggest that the app is the new edge, and only enable identified,
       | authenticated, authorized ('trusted') app sessions to make
       | ephemeral network connections. In that model, all inbound
       | firewall ports are closed (not even dynamic port opening), so
       | that unauthorized sessions can't even scan/probe.
        
         | sascha_sl wrote:
         | Still have plenty of services with network trust everywhere
         | I've worked, particularly in the oldest and slowest moving
         | parts of an organization, but now I'm on VPN instead of LAN. I
         | can still ping AD and SAP and whatever else one could find if
         | you could run nmap on your work network.
         | 
         | It's not really about trusting more or less outside networks,
         | it's about exposing your network very selectively (e.g. single
         | services behind authenticating proxies), preferably with a
         | corporate login _and_ some form of device attestation.
        
       | qzw wrote:
       | I think part of the issue with Zero Trust (ZT) is that it's been
       | applied too broadly in too many contexts. For example, a number
       | of cloud services advertise as ZT, but they probably would
       | actually prefer the nomenclature Zero Knowledge. But of course
       | zero knowledge is being namesquatted (ha!) by an actual
       | cryptography concept, so people who know the difference rightly
       | objected to companies co-opting it. Now a bunch non-cloud
       | offering also want to get on the ZT bandwagon, which just further
       | dilutes and muddies the meaning of the term. Since there's no
       | actual standard defining ZT, it becomes just about as meaningful
       | a descriptor as Best Practices and Military-Grade Encryption.
        
       | jeremygaither wrote:
       | Mutually Assured Trust was the first thing that popped into my
       | mind when reading the article. The premise of explaining things
       | to end users and the difficulty of naming things also reminds me
       | of the Kerberos paper [Designing an Authentication System: a
       | Dialogue in Four
       | Scenes](https://web.mit.edu/kerberos/dialogue.html). Zero Trust
       | reminds me of Kerberos, reborn into a web-first world.
        
       | [deleted]
        
       | mattacular wrote:
       | Why should the average end user care or know what the internal
       | security model and practices are referred to as? How would they
       | even discover that a given app or brand is trying to enforce zero
       | trust without reading their engineering blog or fine print or
       | something like that? Such motivated person would certainly not be
       | confused by the nomenclature. Many things are named sub-optimally
       | in technology, this seems like a strange one to write a post on.
        
       | 0xCMP wrote:
       | Reading the comments here you'd think this article was
       | complaining about what zero trust is or how it is bad. Instead it
       | is about how we explain Zero Trust to others and the very real
       | interpretation of "zero trust for (you)" by end users hearing
       | about this be policy.
       | 
       | A realistic interpretation given the way machines and etc are
       | locked down. It doesn't seem like a bad idea to me to come up
       | with a better name to avoid friction with those unfamiliar with
       | the concept. Even as it is on HN people seem to jump to
       | conclusions based on the name so imagine non technical users
       | hearing about this.
        
       | gravitate wrote:
       | Zero Trust is really just defense in depth[0]. All the things it
       | implements are DiD solutions that have existed way before the
       | term Zero Trust emerged.
       | 
       | [0] https://www.forcepoint.com/cyber-edu/defense-depth
        
         | pid-1 wrote:
         | I also like the term "Onion Approach to Security"
        
         | jameshart wrote:
         | Defense in depth, combined with abandoning the pretense that
         | certain things that _were_ regarded as security perimeters
         | (like 'having an IP address on a specific subnet') we're not
         | really defenses in the first place.
        
       | tenebrisalietum wrote:
       | Well if you say what zero trust really is ...
       | 
       | - We treat the internal network the same as external networks,
       | like your home network. Our systems don't care whether you are at
       | home or at work - you'll have to verify and authenticate the same
       | no matter what.
       | 
       | then workers will be asking "Oh, so why don't I just work from
       | home..."
        
         | indymike wrote:
         | This is probably one of the best descriptions.
        
       | G3rn0ti wrote:
       | Biggest problem with current "Zero Trust" implementations is they
       | imply a full surveillance of employees' Internet traffic
       | including man-in-the-middling their encrypted SSL requests. My
       | company just deployed "ZScaler" -- a product marketed as a "zero
       | trust" VPN solution but in actuality is an Orwellian surveillance
       | tool. This will give "zero trust" a nice negative connotation
       | very soon.
        
         | zemnmez wrote:
         | i'm not really sure what you mean. most of these products are
         | indeed reverse-proxies, but reverse proxies do not sit in front
         | of the whole internet, just corporate services
        
         | gatkinso wrote:
         | more like - 'zero trust' in the sense you cannot trust it
        
         | helloooooooo wrote:
         | A lot of the time, SSL MITM proxies are used as a mechanism to
         | detect malicious content within a corporate content. I have
         | seen, deployed across millions of machines, prevent phishing
         | documents from being detonated thousands of times.
        
         | AaronFriel wrote:
         | Single point of failure devices for decryption of traffic
         | (MitM) is not in line with the original definition of "zero
         | trust", and VPNs certainly aren't either.
         | 
         | Zero trust arose out of this exact sort of scenario following
         | the Snowden leaks and the NSA document showing "SSL added and
         | removed here". End to end encryption and removing MitM
         | middleboxes was the _answer_ to SSL intercepting proxies.
         | 
         | This is a VPN/SSL interception product attempting to remain
         | relevant by advertising as something it isn't.
        
       | mt42or wrote:
       | The author give implementation details names which are also not
       | good naming as not reflecting the global idea.
        
         | mjw1007 wrote:
         | I think "Boundaryless Security" is decent.
         | 
         | The first big step that systems people are calling "Zero Trust"
         | have in common is that they don't trust devices based on the
         | (physical or virtual) network they're connecting from.
         | 
         | There are all kinds of other things that are still trusted, so
         | "Zero" isn't terribly helpful.
        
           | fomine3 wrote:
           | This. Zero is for device/network but still there are other
           | trusts.
        
       | wmf wrote:
       | I wonder what user speed bumps people have seen around zero
       | trust. When IBM started adopting it, employees _rejoiced_ that
       | they could access email and Slack without the VPN.
        
       | bunnie wrote:
       | I have to agree that "zero trust" is terrible marketing
       | (alongside "trustless computing" or variations of that).
       | Generally, we think of "trust" as a positive term, and having
       | zero of it seems bad. That's at least the brain-stem reaction I
       | have to this term, and I think no amount of "but but but you see
       | the problem is we trust the wrong things therefore we should have
       | none of it" will fix the perception.
       | 
       | If I'm not mistaken, the point of the term is that you're not
       | just punting to the firewall to protect your network: eggshells
       | are not sufficient to protect eggs. Thus the proposal isn't "zero
       | shell eggs", it's closer to "all shell no egg".
       | 
       | I don't have a good alternative to it, but maybe something like
       | "Continuous Skepticism", "Always Verify", "Pervasive Vigilance",
       | or "Verify Everything" might be terms that evolve in the right
       | direction. I don't think any of these are winners, but at least
       | none of these take a fairly universally positive term (like
       | trust) and negate it without further explanation.
       | 
       | "Zero trust" really feels more like just an eye-popping bullet
       | point in a consultant's slide deck that gets thrown in to make
       | sure the client hasn't totally nodded off by the 10th slide...
        
         | eslaught wrote:
         | "No trust required"
         | 
         | I think that's what's intended by "zero trust". It's not that
         | trust is bad, it's that it's not _necessary_ when you architect
         | the system in a certain way.
        
           | OJFord wrote:
           | Absolutely correct, and I think everyone/most here including
           | GP know that, it's just that 'zero trust' doesn't obviously
           | sound like that.
           | 
           | Paraphrasing you slightly, it's missing a word: 'zero trust
           | [required]'.
        
         | BrianOnHN wrote:
         | > I don't have a good alternative to it, but maybe something
         | like
         | 
         | I thought "trust" was working out just fine...
         | 
         | What happened? When did we lose the ability to trust?
         | 
         | Maybe it would be easier to try to find new way to build trust?
         | Rather than replacing it altogether?
        
           | PaulHoule wrote:
           | One defining trait of 2022 is the breakdown of trust. (The
           | other is that people insist that "this time is different" and
           | that history doesn't have anything to teach us about the
           | current time.)
           | 
           | If you look at /new/ on HN you will see there are people who
           | have nothing better to do than second-guess every decision
           | the government or any other organization made about the
           | coronavirus.
           | 
           | Blockheads think you can't trust banks, central banks, or
           | anybody except the person who wants you to buy the latest
           | shitcoin.
        
             | decremental wrote:
             | This really isn't the right story for diving into this line
             | of discussion.
        
               | PaulHoule wrote:
               | Yes, except that when marketing is involved the first
               | order of emotional response is that you put the words in
               | the blender and treat them as a "bag of words"
               | independent of order or contextual meaning. That's just
               | how people respond in the first 0.2 s, and since people
               | receive one or two orders of magnitude of marketing
               | communications than they can process that first 0.2s is
               | critical as to if they will see any more of it.
        
       | Cas6767 wrote:
       | Trust and you'll be trusted said the liar to the fool.
        
       | ozim wrote:
       | 'Zero Trust' is not for end users.
       | 
       | For end users you have magic of single sign on - they use login
       | to their work laptop and seamlessly navigate to whatever they
       | need for their work without ANY login screens.
       | 
       | 'Zero Trust' is for back-end services where you assume you need
       | encryption at transit and you always need some authorization to
       | check if someone or something has access to other stuff.
        
         | tgsovlerkhgsel wrote:
         | This. Zero Trust will be a pain for service owners, admins
         | etc., but for the end user, it should be pretty smooth. There
         | may be bugs/errors initially, but there should not be any
         | permanently added friction.
         | 
         | Quite the opposite, Zero Trust can mean that the user can now
         | access services that previously needed a VPN from anywhere,
         | without caring what network they are one.
        
           | jameshart wrote:
           | Honestly one of the hardest things about zero trust is
           | getting end users who aren't used to it to _stop trying to
           | solve problems by turning on the VPN_.
           | 
           | (We are almost completely zero trust, but obviously there are
           | still a few legacy systems you need to connect to a VPN to
           | access)
           | 
           | I don't do deskside support, but I do have to help
           | nontechnical people interact with apps and services
           | occasionally, and often their first troubleshooting step is
           | 'make sure the VPN is on', whereas mine tends to be 'let's
           | eliminate a potential source of network craziness and make
           | sure the VPN is definitely _off_ '
           | 
           | So do tend to think that the important messaging for end
           | users is that zero trust is about eliminating something -
           | making things simpler.
           | 
           | Maybe 'networkless' would be a better word...
        
         | theptip wrote:
         | Reading the original BeyondCorp paper, I think Zero Trust was
         | from the beginning construed as an end-user-facing replacement
         | for VPNs. Sure, you can use it for backend services too, but it
         | definitely doesn't exclude end-users.
        
         | indymike wrote:
         | Zero Trust is as simple as setting up your network so there are
         | no arbitrary services added to the network that are
         | discoverable or visible that are not known in advance, vetted
         | and trusted. For end users it looks like a wifi hotspot where
         | you cannot see other machines connected to the hotspot, and
         | they cannot see you. Most modern services work fine in this
         | environment, but older less secure, let's host a server on my
         | desktop type software will not work. It also means getting rid
         | of a lot of shared services where Bob in sales can click on an
         | attachment and bitlocker all the contents of shared drives.
         | 
         | Zero Trust unlocks a couple very desirable things: simpler LANs
         | with less stuff to break, it's harder for trojans to spread,
         | and better access control. Zero Trust is also really hard to do
         | in places where you have a huge, managed LAN and a bunch of
         | thick client software that relies on direct network
         | connections, or direct connections to database servers and the
         | like.
        
           | jameshart wrote:
           | This is a really odd description of zero trust.
           | 
           | For end users, zero trust looks like 'not needing to check
           | the VPN icon is green before you launch the payroll app'.
           | 
           | The concept of 'being on the network' goes away. Which is
           | good, because that was a major source of confusion for end
           | users.
        
             | indymike wrote:
             | I love how the industry takes a word like "devops" and
             | redefines it until meaningless. I think that has happened
             | to Zero Trust as well.
        
               | jameshart wrote:
               | But.. your description doesn't match up with what I think
               | the original definition of zero trust means?
               | 
               | You said it was about preventing unknown services turning
               | up on a network, which almost feels like the opposite of
               | zero trust to me.
               | 
               | Zero trust is about not _caring_ if unknown services are
               | on your network, because merely 'being on the network'
               | doesn't grant you access or trust.
        
               | onionisafruit wrote:
               | To put it more succinctly, in the zero-trust mindset it
               | isn't ever _your_ network.
               | 
               | It's a network you happen to be connected to. Your only
               | trust the network at the physical layer that it won't
               | destroy your hardware. Beyond that you don't trust
               | anything you receive over the network that you can't
               | independently verify.
        
         | Josteniok wrote:
         | I work for a really large organization that has received praise
         | for what it is doing with zero trust but to us lowly users the
         | implementation has really meant the total death of single sign
         | on. We sign on constantly to everything now all the time.
        
         | rocqua wrote:
         | That is not the idea currently being pushed.
         | 
         | The zero trust idea is 'just because they are on the right
         | subnet doesn't mean you can trust them'. So you add things like
         | healthyness checks (is this device up to date), anomaly
         | detection, and use those to dynamically determine how much
         | authentication challenge you give a user.
         | 
         | For this to work, the key is really good and easy single sign
         | on with second factor also made easy. That way you can do more
         | trusted authentication (a SSO token backed by Microsoft login
         | is harder to phish than just a password. More importantly, it
         | really lowers the authentication burden on your users.
        
           | hamandcheese wrote:
           | Data point: Parents definition of zero-trust largely matched
           | mine and doesn't seem particularly incompatible with yours.
        
             | rocqua wrote:
             | Zeeo trust, as I understand it, is all about authenticating
             | user devices, rather than fixed appliances. It is much less
             | something that happens between appliances (though
             | appliances authenticating themselves to clients does
             | count).
             | 
             | I think that is incompatible with what parent said.
        
         | jameshart wrote:
         | Right. From an end user perspective, zero trust manifests as
         | 'single sign-on'. Which is easy enough to grasp.
        
           | ozim wrote:
           | Add to that it will be marketing tool for B2B market - "we
           | support SSO and Zero Trust", your users will seamlessly login
           | to our solution and after they login we check at each step if
           | they have access to the resources they want to access.
        
       | g8oz wrote:
       | I like to think of 'Zero Trust' in terms of OSI layers.
       | Application layer (L7) authentication is used to authorize the
       | session layer (L5).
        
         | amerine wrote:
         | This is exactly my mental model as well!!! believe it's the
         | right one too.
        
       | theptip wrote:
       | I suppose the thesis that it's a bad name is borne out by the
       | fact that many technical people misunderstand it; it's a
       | contraction of "zero trust networking" and is a fine description
       | of the technical approach: don't trust anyone by virtue of their
       | network location. (Trust is negotiated at the application layer.)
       | 
       | #NoVPN or Zero Perimeter could be better slogans.
       | 
       | On the other hand, the only people I have seen confused are
       | technical people that (incorrectly) think they have identified an
       | inconsistency; non-technical folks seem fine to just map
       | name->feature-set.
        
         | powerhour wrote:
         | We could take cues from the food world: Better Than VPN, I
         | can't believe it's not VPN!
         | 
         | I'm not really convinced the name is a real problem. We use a
         | lot of terms that aren't obvious and it works just fine. For
         | example, http. First you have to learn that means Hypertext
         | Transfer Protocol, then you have to learn what Hypertext means,
         | and then you have to learn that it's used for a lot more than
         | Hypertext these days.
        
           | cmeacham98 wrote:
           | The problem isn't that it's not obvious, but that it's
           | actively counterintuitive.
           | 
           | If a car company was called 'GJKN', and that stood for some
           | obscure acronym, you'd just memorize that. But you'd probably
           | be a lot more confused by the car company 'NoWheels' when
           | their car still has wheels, just in different places.
        
         | herghost wrote:
         | Agreed - I've seen the same result in my current company. The
         | only real objection raised is from a technical pedant who
         | argues that we're trusting identity and so we shouldn't call in
         | _Zero_ Trust. He's almost deliberately missing the point
         | though.
         | 
         | Our users, on the other hand, are not making any real noise
         | about it because from their point of view it's the natural
         | extension of SSO (from the point of view of that being the only
         | bit that they will interact with in any meaningful way) and
         | that was something that reduced friction for them too.
         | 
         | We've not suffered from the name really, to be honest.
        
         | staticassertion wrote:
         | You can have ZTN with a VPN and you can have a perimeter with
         | ZTN. What you can't have is trust based on network position. So
         | I think Zero Trust is fine.
         | 
         | It's a marketing term ultimately and any practitioner should be
         | able to understand what it means. If they don't it's kinda on
         | them.
        
         | otterley wrote:
         | +1 for NoVPN. It's short, sweet, and quickly conveys the
         | benefit. It may also remind people of the frustrations they
         | often face using VPN software, which is often flaky and has a
         | poor UI, so eliminating it could be met with feelings of
         | relief.
         | 
         | Nevertheless, it's always a little unsettling whenever some
         | Internet rando confidently posits that a phrase conveys a
         | certain meaning or emotional reaction to people _without any
         | evidence whatsoever._ I mean, come on, do a little market
         | research. Do your homework. (The same goes for me!)
        
           | vasco wrote:
           | Makes no sense to do market research for this. You throw a
           | new naming out there and see if it sticks. If it sticks,
           | done, if not, no market research needed.
        
             | l33t2328 wrote:
             | I don't really have an opinion on this but isn't "seeing if
             | it sticks" just other words for market research?
        
           | goalieca wrote:
           | I disagree with novpn because having a vpn or private network
           | is a useful layer in the overall defence.
        
         | feanaro wrote:
         | It's a bad term in the sense that it's not self-explanatory.
         | Hearing just the term itself is likely to give you the wrong
         | idea about what it means.
         | 
         | Learning a name -> feature mapping isn't a problem in itself,
         | but the fact that you have to do it before you get an
         | approximately correct idea regarding what it's about is an
         | unnecessary inefficiency.
        
         | atoav wrote:
         | Without going to much into it I thought _Zero Trust_ is some
         | new funky cryptographic way of eliminating the need for trust
         | in some interaction between parties.
         | 
         | Turns out it is just a different phrase for the existing
         | concept of defense in depth.
        
           | lucideer wrote:
           | Zero trust isn't the same as defence in depth.
           | 
           | Certainly one could define defence in depth as a component of
           | zero trust I guess (very vaguely) but they represent
           | different perspectives.
           | 
           | Defence in depth is a technologically focused approach:
           | implementing redundant checks at multiple architectural
           | layers of a stack.
           | 
           | Zero trust is about the high-level approach to perimeters and
           | ACLs, including not only tech & stack architecting, but
           | organisational messaging / policy / culture.
        
       | hedora wrote:
       | Zero Trust is a fine phrase, but it greatly over claims. (Unless
       | I'm missing something, and it eliminates trust requirements for
       | third party SSO services, software supply chains, infrastructure
       | operators, and other common attack vectors).
        
         | foobiekr wrote:
         | It doesn't eliminate the trust requirement for any of those at
         | all.
         | 
         | It's easier to talk about zero trust by identifying the thing
         | it is not. For example, ZT is not "it is sufficient to be
         | inside X" where X is on a host, in a container or not, on a
         | subnet (we are less than ten years way from having to argue
         | with people about "why are we using encryption on our internal
         | connections?"), or some other context, and so on.
        
           | hedora wrote:
           | So, (precisely speaking) it is increasing the set of network
           | endpoints that are trusted from a LAN to the entire internet.
        
             | NavinF wrote:
             | The opposite: increasing the set of network endpoints that
             | are untrusted from the internet to both the internet and
             | the LAN.
        
             | hxtk wrote:
             | The way that Google handles it, at least based on their
             | publications about BeyondCorp is that endpoints are
             | authenticated cryptographically by TLS certificates backed
             | by their TPM chips.
             | 
             | When someone tries to connect to a service, instead of
             | having a firewall verify their device is trusted by
             | checking the IP address is within a trusted range, the
             | device is authenticated by the Access Proxy using mutual
             | TLS.
             | 
             | Authorization decisions incorporate both device and user
             | privileges. A machine that isn't registered as being
             | physically bolted to the floor inside a physical security
             | domain won't be able to access certain highly restricted
             | resources. A machine that isn't registered as being up to
             | date on security patches will also have privileges
             | restricted. A machine which does not present a client
             | certificate or presents a client certificate that is no
             | longer trusted will only be able to access services
             | intended for the public.
             | 
             | Instead of treating the subnet as a de facto database of
             | trusted machines, there's an actual database of trusted
             | machines that is incorporated into authorization decisions
             | at access time.
        
       | glintik wrote:
       | AI(Artificial Intelligence) is real poor choice of words, because
       | of there is no intelligence at all, just math..
        
       | cratermoon wrote:
       | I first heard the term a few years ago, but because I work in
       | that space it didn't bother me. When I talk about it to network
       | ops folks I like to say "perimeterless", which is a fair
       | description of what they care most about: no more firewalls, DMZ,
       | or "internal" vs "external".
       | 
       | The device-centric authentication and authorization part, I don't
       | really have a good simple term. When it works well, I call it
       | "better user experience" because to the people accessing, there's
       | a lot less for them to deal with, and fewer passwords to remember
       | or VPN status to worry about.
       | 
       | The lack of a VPN requirement is nice. The experience from my
       | last job where we had a VPN was that everything worked pretty
       | well for employees with company-issued laptops, but when a
       | division hired contractors or brought in a third party, they
       | weren't issued laptops, so they couldn't access anything on the
       | VPN, leading to continuous support issues and work for the netops
       | folks.
       | 
       | For my part I really like it because it addresses one aspect of
       | security often neglected (even more so than security in general):
       | internal malicious actors. Disgruntled employees, workers that
       | expeditious bypass security because their boss has to have it
       | NOW, executives and senior leadership that throw their weight
       | around and get special access to bypass security, or simple human
       | error. Also, all the un-encrypted internal traffic. In this case,
       | "zero trust" applies, because where companies used to trust their
       | employees not to screw around with company assets, hard
       | experience has demonstrated that even absent malice, people do
       | stupid things and it costs real money.
        
       ___________________________________________________________________
       (page generated 2022-07-16 23:00 UTC)