Episode 385: Evan Gilman and Doug Barth on Zero-Trust Networks

Authentication

Authentication in zero trust networks involves verifying users, devices, and applications to ensure they are who they claim to be. Doug Barth explains that user authentication often uses usernames and passwords, sometimes enhanced with security keys or time-based codes. Device authentication might involve certificates or hardware-based systems like TPM chips. The goal is to positively assert identity across different axes, ensuring security in various contexts 1.

   

Trust Scoring

Trust scoring in zero trust networks assesses the reliability of entities based on their behavior and context. Evan Gilman describes how anomalies, such as logging in from multiple locations in a short time, can negatively impact a trust score. This scoring system extends beyond user access to include device and application interactions, providing a comprehensive security measure 2.