The NSA has issued guidance on adopting zero-trust principles to counter internal network threats. Zero-trust architecture prevents unauthorized access and movement within networks by assuming threats exist and enforcing strict access controls. The approach includes data flow mapping, segmentation, and software-defined networking to minimize breach impacts. No CVEs are associated with this guidance.
That’s not what (the new hype buzzwords) Zero Trust Architecture means. Like at all.
Instead of the crunchy shell network perimeter and gooey center paradigm of enterprise networks of the past 30 years, ZTA is a response to the nebulous and disappearing permitted. It’s supposed to control access to anything anywhere anytime but securely.
The main feature is dynamic attribute-based network access control. Access can be granted or revoked moment to moment based on who you are, where you are, even attributes of your computer like patch level.
Let’s say a patch just came out for your laptop yesterday but it isn’t applied yet. ZTA approach denies you access to sensitive networks, but not to patching infrastructure. Once patched, your access is permitted. Or say you turn off your antivirus mid-download. Access revoked within moments.
Rather than erect silos it sort of makes access more transparent to the end user and so remote vs on site access basically seems the same to them.
Yeah, yeah, I know, NSA bad-- I am wearing the EFF T-shirt that says so right now.
But in addition to wrecking privacy and spying on the innocent (hi, you fuckers, .l…), they also do offer somewhat legit advice now and then.