Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Zero Trust is as simple as setting up your network so there are no arbitrary services added to the network that are discoverable or visible that are not known in advance, vetted and trusted. For end users it looks like a wifi hotspot where you cannot see other machines connected to the hotspot, and they cannot see you. Most modern services work fine in this environment, but older less secure, let's host a server on my desktop type software will not work. It also means getting rid of a lot of shared services where Bob in sales can click on an attachment and bitlocker all the contents of shared drives.

Zero Trust unlocks a couple very desirable things: simpler LANs with less stuff to break, it's harder for trojans to spread, and better access control. Zero Trust is also really hard to do in places where you have a huge, managed LAN and a bunch of thick client software that relies on direct network connections, or direct connections to database servers and the like.



This is a really odd description of zero trust.

For end users, zero trust looks like ‘not needing to check the VPN icon is green before you launch the payroll app’.

The concept of ‘being on the network’ goes away. Which is good, because that was a major source of confusion for end users.


I love how the industry takes a word like "devops" and redefines it until meaningless. I think that has happened to Zero Trust as well.


But.. your description doesn’t match up with what I think the original definition of zero trust means?

You said it was about preventing unknown services turning up on a network, which almost feels like the opposite of zero trust to me.

Zero trust is about not caring if unknown services are on your network, because merely ‘being on the network’ doesn’t grant you access or trust.


To put it more succinctly, in the zero-trust mindset it isn't ever _your_ network.

It's a network you happen to be connected to. Your only trust the network at the physical layer that it won't destroy your hardware. Beyond that you don't trust anything you receive over the network that you can't independently verify.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: