BeyondCorp is dead, long live BeyondCorp
&gt; <i>The reality is if you say you’re “doing zero trust” to a security professional today, they’ll assume you’re naïve, and haven’t realized what you’re actually signing yourself up for.</i><p>The old-school variant has the same issues, IMO? A previous employer of mine was &quot;everything was on the company wide VPN&quot; i.e., no SSO, half the stuff is insecure.<p>Externally, you could connect to the VPN with a fairly bog standard VPN client. But how was the trust established? Well… it trusted DigiCert&#x27;s CA cert. Meaning anyone who purchased a DigiCert cert &amp; could obtain a privileges position on the network could MitM the VPN connection.<p>Inside the office, the WiFi was connected to the VPN (i.e., VPN client was only required off-site) … and the office WiFi was WPA2-PSK. And of course the PSK a. was not a good PSK and b. did not rotate when employees left the company.<p>Worked for a larger corp. Same idea, internal net was trusted net. STP packets on the ethernet ports, which IIRC my network training probably meant that I could convince a switch on the network that <i>I</i> was a switch, please start routing me traffic.<p>&gt; <i>They’ve tried to use the tools already available in the market themselves</i><p>I&#x27;ve tried to use more old school solutions, like LDAP. LDAP tooling is horridly difficult to set up. I gave <i>up</i> on my first attempt; I think today I know where I went wrong. Things like pfSense &amp; VPN are also incredibly complex, and my understanding on the security community consensus on IPSec is that it is that its complexity guarantees that it is insecure.<p>&gt; <i>The tools that are on the market today aren’t even doing the hard part of zero trust yet.</i><p>But I don&#x27;t disagree with that, too. The tools are definitely not up to snuff. Getting working SSO, even with just a decent MFA experience &amp; then getting a service to authz with it has been considerably complex. &amp; like the author surmises … even if I ignore device security.<p>Now we&#x27;re all remote … yet security would still like to allowlist network access <i>by IP address</i>, meaning one of these days I am creating a common, centralized white pages of employee IP addresses because those are getting numerous. (I have mixed feelings on this. The list is a PITA to maintain. But it does keep random Internet riff-raff from ever hitting an open SSH port… and while yes, people should use keys, all it takes is one mistake. And people <i>make</i> mistakes.)<p>ZT is IMO the right approach; the network is already compromised. Whether that&#x27;s at the Internet or the port on your laptop doesn&#x27;t matter. Yeah, people <i>definitely</i> forget the device bit. (And ought not to.) But the other approaches aren&#x27;t implemented with any more diligence.