Better than trusting the perimeter. A single breach in a “trustful” intranet still results in full network compromise. Best to assume breach and work from there. Hating on zero trust is non-sensical to me, feels like the same as hating on security.

Given that, would zero trust plus perimeter have better security than each approach individually? Layered defense etc.

I really wish more companies would implement Zero Trust. It's just so nonsensical to trust any device at this point - No matter how "secure" someone tells you it is, or even you think it is.

Is there a clear definition of what ZTA even is? I read the O'Reilly book, and as best I can tell, the advice was fairly obvious recommendations and also 'replace your firewall as a single point of failure and make your access-control system your single point of failure'.

What does zero trust have to do with this?

The IdM box in the provided diagram [1] is the same single point of failure "policy engine" and "ID management" architecture that is advocated by the "zero trust" crowd [2]. It's the same type of flawed centralised architecture that allowed the Solarwinds Orion exploit to be used to such great effect [3]. At least the ZTA paper calls out this weakness [4], but unless I missed something the paper severely understates the risk that a central "policy engine" presents, and glosses over all the other components ("threat intelligence feeds", host-based agents, etc) which are centralised in this architecture and present a similar risk.

[1] https://imgur.com/Hcwayqq

[2] NIST SP 800-207, Figure 2, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

[3] https://en.wikipedia.org/wiki/2020_United_States_federal_gov...

[4] NIST SP 800-207, Section 5.1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

I wouldn't call running random Docker images from the Internet a "zero trust" environment.

Zero Trust is the future.