[cdoxsey]

First of all its not a misrepresentation of the memo. The memo states:

> Users should log into applications, rather than networks, and enterprise applications should eventually be able to be used over the public internet.

Second with regards to this statement:

> Opening up your internal network to the internet and rely on every app to do security correctly is a ridiculously bad strategy.

That's precisely what zero trust networking is. Ala Google's BeyondCorp:

> Virtually every company today uses firewalls to enforce perimeter security. However, this security model is problematic because, when that perimeter is breached, an attacker has relatively easy access to a company’s privileged intranet. As companies adopt mobile and cloud technologies, the perimeter is becoming increasingly difficult to enforce. Google is taking a different approach to network security. We are removing the requirement for a privileged intranet and moving our corporate applications to the Internet.

(https://storage.googleapis.com/pub-tools-public-publication-...)

Maybe they're wrong about all this, but it's not anti-advice. It's a legitimate security model being pursued by many different companies.

[tptacek]

Even the BeyondCorp paper doesn't fully buy into this idea. If you're on a coffee shop's wi-fi network, you'll talk directly to Google's Access Proxy. But if you're in the building, you're 802.1x authenticating to their network before getting access.

The problem with VPNs is that enterprises have used them for decades as a crutch, extending their perimeter model out so that instead of a small SPOF, they have a gigantic, ever-changing SPOF. "ZTN-think" pushes this basic idea way past usefulness, to the point where all network controls are somehow suspicious. Which is crazy; BeyondCorp fundamentally relies on network access controls as well as application access controls, like every other modern network design. They're just different controls.

[righttoolforjob]

Zero trust is about not trusting anything, which means neither external nor internal network. Not trusting the internal network does not mean that you should open it up to everyone. You have misunderstood this gravely.

Google doesn't do what you suggest and I'll throw in another large security-aware company as well, known for their privacy-conscious phones. They protect the perimeter as well as the inside. As does any military organization. Stop spreading misinformation.

[onefuncman]

You're missing the point. There is no internal network in this new model.