Skip to content
 
If you can read this, either the style sheet didn't load or you have an older browser that doesn't support style sheets. Try clearing your browser cache and refreshing the page.

(MIT)   Subby thought Zero Trust meant not trusting the wine in front of you OR the wine in front of the man in black, but apparently it doesn't and this article dizzied his intellect   (news.mit.edu) divider line
    More: Interesting, Security, zero-trust architecture, study team's first step, MIT Lincoln Laboratory, assistant head of Lincoln Laboratory, Cyber Security, trust security, zero-trust architectures  
•       •       •

489 clicks; posted to STEM » on 18 May 2022 at 4:06 PM (11 weeks ago)   |   Favorite    |   share:  Share on Twitter share via Email Share on Facebook



11 Comments     (+0 »)
View Voting Results: Smartest and Funniest
 
2022-05-18 2:59:23 PM  
Less Than Zero
Youtube QrNDxNYb92U
 
2022-05-18 3:43:59 PM  
When Google decided to implement zero trust, they basically rebuilt their business from the ground up to support all the changes required. It's a fantastic model, the only one I'd want to use if I was starting from scratch, but is untenable for most businesses at this point in time.

That said, you can and absolutely should start using zero trust principles wherever you can, just don't expect it to fit everywhere all at once unless you're in a position to rebuild everything. And if you are in that position, please hire me.
 
2022-05-18 4:34:50 PM  

ryebread: When Google decided to implement zero trust, they basically rebuilt their business from the ground up to support all the changes required. It's a fantastic model, the only one I'd want to use if I was starting from scratch, but is untenable for most businesses at this point in time.

That said, you can and absolutely should start using zero trust principles wherever you can, just don't expect it to fit everywhere all at once unless you're in a position to rebuild everything. And if you are in that position, please hire me.


Zero Trust proofs is beyond stupid as a concept. It is the complete opposite of transparency in algorithms and data security.

If you can't or aren't willing to prove rigorously and show transparently how your algorithms work, you don't have trust in your algorithm and you are asking everyone else to just trust you.

I hate Zero Trust as a concept because it's basically the same as proprietary with the added sleaze of "just trust me, despite me not trusting you". The only possible use cases for this I've seen is crypto, which is garbage, but an entirely different discussion.

Admittedly I've only seen a little about it after I googled around trying to figure out what it really was after I saw this.

So long as Zero Trust Architecture has nothing to do with Zero Trust Proofs... I'm willing to look more into it. That article was pretty light on it. It's bigger than SSO? It's different for every company, it's not what we have now... But they don't really provide much more.
 
2022-05-18 5:51:02 PM  

Quantumbunny: So long as Zero Trust Architecture has nothing to do with Zero Trust Proofs... I'm willing to look more into it. That article was pretty light on it. It's bigger than SSO? It's different for every company, it's not what we have now... But they don't really provide much more.


It's different than zero knowledge proofs, which I think is what you're referring to? Zero trust means you stop making assumptions that things should be trusted, and instead, you validate whenever and wherever you can.

A simple example of a zero trust idea is that you don't treat devices as trusted just because they happen to be on your internal network -- you validate it with certificates, etc. Once it passes that check, you don't trust that it needs to talk to everything else on the network, you lock it down fully and only allow limited connections that are explicitly allowed. One it is allowed a connection, you don't assume it is actually a valid end user, you authenticate. Once authenticated, you don't trust they have broad access to the application, you validate permissions (maybe as often as every transaction). Keep stacking up those controls in every place you possibly can, defaulting to an untrusted stance, and that's a zero trust architecture.

At least that's how it is intended, as I understand it. It's as much a marketing term as it is anything at this point. Google put out some good info on their move to it, search up BeyondCorp if you want to find more.
 
2022-05-18 9:25:31 PM  

ryebread: A simple example of a zero trust idea is that you don't treat devices as trusted just because they happen to be on your internal network -- you validate it with certificates, etc. Once it passes that check, you don't trust that it needs to talk to everything else on the network, you lock it down fully and only allow limited connections that are explicitly allowed. One it is allowed a connection, you don't assume it is actually a valid end user, you authenticate. Once authenticated, you don't trust they have broad access to the application, you validate permissions (maybe as often as every transaction). Keep stacking up those controls in every place you possibly can, defaulting to an untrusted stance, and that's a zero trust architecture.


Give me an example of non-zero trust because all those controls seem obvious. I'm not be getting it.
 
2022-05-18 10:22:56 PM  
As soon as I see "paradigm shift" I stop reading.  Always.
 
2022-05-19 3:43:00 AM  

Raoul Eaton: As soon as I see "paradigm shift" I stop reading.  Always.


You'll miss out on all the synergies with that attitude.
 
2022-05-19 5:00:48 AM  

morg: Give me an example of non-zero trust because all those controls seem obvious. I'm not be getting it.


A non zero trust example would be devices on the same subnet communicating freely. Instead of lumping multiple devices together like that into a single security zone, with zero trust each device essentially has its own boundary.

Another example could be session tokens. In a non zero trust model, you'd grant a token when a user authenticates, give it a session lifetime, and call it a day. If the user account is terminated and you don't revoke that token, they could continue having access until the session expired. In zero trust, you'd be checking that the account was valid with every transaction, meaning immediate revocation of access when the account is removed.

The controls can be fairly obvious, and lots of them are implemented to some level by plenty of organizations. It's a matter of degrees. And finding places that do it fully is exceedingly rare.
 
2022-05-19 9:28:56 AM  
But we envision a future state that embraces zero trust, where identity verification is enabled by cloud-based identity that's portable and ubiquitous, and very secure itself."


so everything, everywhere, will need an internet connection?
 
2022-05-19 9:43:01 AM  

ryebread: Another example could be session tokens. In a non zero trust model, you'd grant a token when a user authenticates, give it a session lifetime, and call it a day. If the user account is terminated and you don't revoke that token, they could continue having access until the session expired. In zero trust, you'd be checking that the account was valid with every transaction, meaning immediate revocation of access when the account is removed.


Ok, so it doesn't necessarily mean entering your password every time you try to do anything?

/knows someone whose access to a secure area was revoked... while he was in the secure area.
 
2022-05-19 12:26:45 PM  

dbirchall: Ok, so it doesn't necessarily mean entering your password every time you try to do anything?

/knows someone whose access to a secure area was revoked... while he was in the secure area.


Right, it would mean checking authorizations at every step, not necessarily authentication.

Some places will use dynamic authentication systems that may require you to reauthenticate based on some sort of user behavior analysis or other risk scoring. This could mean making the user reauth when performing highly sensitive actions, actions or combinations of actions that user is authorized to do but rarely does, if they're signing in from a new device or location, etc. Basically anything out of the norm could be viewed as a reason to make the user reauthenticate as an additional security measure. This often gets called out as a part of zero trust as well, but that seems borderline, and an example of using "zero trust" as a marketing term more than anything. It's definitely valuable, I'm just not sold on it being "zero trust".
 
Displayed 11 of 11 comments

View Voting Results: Smartest and Funniest

This thread is closed to new comments.

Continue Farking




On Twitter


  1. Links are submitted by members of the Fark community.

  2. When community members submit a link, they also write a custom headline for the story.

  3. Other Farkers comment on the links. This is the number of comments. Click here to read them.

  4. Click here to submit a link.