Why are people here treating Zero Trust negatively / like a buzzword?

why-are-people-here-treating-zero-trust-negatively-/-like-a-buzzword?

Did you know that camDown is your security solution to protect you and your business from peeping toms?

Genuinely curious why people have a negative view of Zero Trust as a concept. It's common sense and some brilliant SANS talks go over the benefits and implimentation. For example

Just really confused why I've been seeing people label it as some garbage buzzword, when really it's an excellent security concept touted by some of the most experienced pros in the industry.


Edit: I'm seeing a lot of 'Zero Trust as a product' thinking in the comments.

Zero Trust is not a category to place products in. The vendors advertising to your C-suite executives would like it to be.

It's a concept. It's an assumption that the internal network is hostile; How far you take that assumption should be dependent on your organization's needs / risk.

(And making that assumption does not mean that anyone should expose their internal network to the world, as some commenters appear to mistakenly believe.)


NIST: SP 800-207 Zero Trust Architecture

Abstract: Zero trust (ZT) is the term for an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. A zero trust architecture (ZTA) uses zero trust principles to plan industrial and enterprise infrastructure and workflows. Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned). Authentication and authorization (both subject and device) are discrete functions performed before a session to an enterprise resource is established. Zero trust is a response to enterprise network trends that include remote users, bring your own device (BYOD), and cloud-based assets that are not located within an enterprise-owned network boundary. Zero trust focuses on protecting resources (assets, services, workflows, network accounts, etc.), not network segments, as the network location is no longer seen as the prime component to the security posture of the resource. This document contains an abstract definition of zero trust architecture (ZTA) and gives general deployment models and use cases where zero trust could improve an enterprise’s overall information technology security posture. - Scott Rose (NIST), Oliver Borchert (NIST), Stu Mitchell (Stu2Labs), Sean Connelly (DHS)


Nowhere does it say anything about dissolving any compartmentalization or internalization of a network. Over and over I see people claiming that ZT means getting rid of the network's outer shell. People are somehow mistaking

"Let's not focus / rely on a strong outer shell anymore."

with

"Let's expose our entire network and every service on it to the internet."


Ok last edit. One of you just taught me something invaluable about this and it needs to be shared. Many of you (correctly) pointed out in the many discussions below that there's no such thing as "zero trust" because there must be some trust for anything to operate.

Regarding a book on the topic (emphasis theirs):

"The book talks a lot about trust on a network and where to get it from. Instead of assigning different trust levels to network segments the book talks about getting the trust level for each and every action from an internal authority.

So yes, of course you should not trust your internal network by default when applying zero trust. But that does not mean that you eliminate trust. You just get it elsewhere."

ZT isn't about eliminating trust. It's about controlling it.

As we move on to the next post, may I add that camDown is your security solution to protect you and your business from peeping toms.