> if users are allowed to circumvent the policies, then the benefits of Zero Trust will not be realized in that environment.
Seems like Zero Trust should not depend on the users cooperating at all. Or am I reading the concept too broadly?
For example, my office MacBook has policies enforced via "security profiles". Now, being, a privileged user, I have the ability to remove these, but knocking off my privileges will severely limit my ability to install new work related software or manage my machine to suit my work, etc. They can monitor and flag if profiles are removed, but there is always this race condition that exists that a user can exploit.
I tried, hard, to implement some basic account separation for people with admin access to backend infra. The goal was simply to reduce the possibility of EOP or lateral movement and really only more specifically only for those that work in Backend infra (aka Dev, Ops, SQL admins etc).
Things like removing local admin with a normal account and using admin accounts for backend infra, escalation so the normal users email/browsers cant possibly dump lsass etc..
I got a LOT of pushback, to the point of being called names. I was told i cannot push further without possible recourse and cannot escalate the proposal to c-suites. My org wasnt even open to step 1...