> Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN.

This absolutely used to be the primary method of security, and still is in many places, unfortunately. Even at the enterprise level, most companies only started making serious changes maybe 10 years ago, and are still far from completing the journey, and getting a device connected to a wired port will still get you too much access in most enterprises.

I'm a pen tester for a mid-ish sized company. I recently got approval to remove "port security" (802.11x) on a single port within the building. It is amazing the amount of access I now have (using a non-company managed laptop, plugged into this port).

Once a bad guy has equivalent access, they are very deep into our network (and have bypassed multiple layers of controls).

I don't think my company is unique in any way. I would expect this level of access at most companies to be game-over / large problem.

Yes, I don't know where GP worked, but I've seen dozens of companies relying on VPNs alone.

> Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN.

I assure you I've connected to more than one real-world network where the admins absolutely did rely on that.

> Why would you eliminate a split VPN though? Software has bugs, why would you expose the proxy or some app for automated scanners and exploiters on the internet? You can have both! You can have a locked building door and a locked apartment door. Of course relying on the building door is not enough but why would you eliminate it? How could that improve security?

If you put a weakly secured porch on the front of your building, it's easier for someone to take their time breaking into the main lock, and people are more likely to forget to lock the main door.

Most vulnerabilities come from either writing code in C or mixing up authorized and unauthorized users. So it's really important to have a simple and understandable authorization model. Weak security layers do more harm than good, because they make mistakes more likely.

It isn't exactly a straw man because it was often the default implementation. Yes, it was always a good practice to have the computers of the marketing team not have network access ( nor their user accounts LDAP/whatever access) to e.g. production servers, but not everybody deployed it like that, because it's hard, especially in big or acquired companies. There are environments where DHCP is disabled for "security" not to allow an attacker to get an IP in the network. For them obviously an IP is an "in", and they don't trust their defence in depth ( which of course, isn't a given).

In any case, Zero Trust fuses authn and authz and makes it so you no longer need firewall rules for protection. All of that now happens on the same layer, which makes it more accessible, accurate and easy to manage.

As for VPNs, the point is that they're of limited security utility, so they're just an extra hurdle for your own users. Yes, they "hide" your services from the generic internet, but those services should be hardened and protected in case of a breach of your VPN anyways, so the difference is minimal vs the effort and money spent on a VPN.

I feel like i should add a disclaimer that i work at a company who sell products around zero trust, among other things, so opinions my own, held before joining, etc.

If the VPN requires an account to connect to then it seema fair to use it as a kind of single-sign-on.

One of the many problems with that approach is that any service on your machine with network access can now impersonate you, the classic example being malicious JavaScript.