Hacker News Reader

Zerotrust makes perfect sense. It takes the default deny firewall policy and applies it to every host. Entities can only communicate after proving their identities to each other and every single packet is authenticated. When done correctly every host could be completely open to the internet without any security issues.

View on HN

That's one of the ways I like to think about it. When you have zero trust, you can comfortably expose any app to the internet.

If you can't comfortably expose your app to the internet, you probably don't have zero trust.

The problem is, "exposed to the internet" is pretty much how most things are today, in a world where everything is trying to be "smart." There is a pathway to most assets and resources and that's what causes breaches. So all services and resources should be assumed as "exposed" until proven otherwise, therefore all infrastructure (and development) should apply zero trust principles.

Did you read my comment? I agree with that part. That isn't what people are doing.

Reply on news.ycombinator.com