Zero Trust Architecture doesn't solve all problems, but partial ZTA solves fewer

Re:Zero Trust Architecture doesn't solve all problems, but p... by staticassertion on Friday April 01, 2022 @11:37AM (#30879277)

It has nothing to do with a third party. You can do everything yourself if you'd like. Zero Trust just means:

1. Server is authenticated. Client is authenticated.

2. Client has to pass some kind of attestation / meet policy requirements of the service.

3. Actions are auditable.

What would you call it? Zero Trust seems fine to me.

[ Parent | on HN ]

Re:Zero Trust Architecture doesn't solve all problems, but p... by netr0ute on Friday April 01, 2022 @12:07PM (#30879703)

Those three steps are literally AAA and nothing else, so "zero trust" is sounding like yet another marketing buzzword.

[ Parent | on HN ]

Re:Zero Trust Architecture doesn't solve all problems, but p... by staticassertion on Friday April 01, 2022 @12:51PM (#30880367)

I'm oversimplifying. The interesting bits are in (2), which typically takes contextual information into account with regards to policy.

But sure, AAA is an extremely broad term that absolutely could encompass ZT. Just like SOA encompasses Microservices.

[ Parent | on HN ]

Re:Zero Trust Architecture doesn't solve all problems, but p... by unethical_ban on Friday April 01, 2022 @12:23PM (#30879937)

Many, many resources on a traditional internal network do NOT have unified AAA. It's about more than slapping a login page on something, it's about making sure that every gateway to an application or data has a nigh unbreakable access control (think AWS IAM when properly configured).

Almost no large scale business network in the world can say this. And with IOT, it's even harder.

[ Parent | on HN ]