""" Beyond Zero shifts the trust boundary from the application to the action being performed on a piece of data in realtime—and from after-the-fact investigation to in-the-moment evaluation and containment. It augments BeyondCorp’s foundational identity with a “brain” capable of reasoning about the context and intent of a specific request in realtime. """ Doesn't this simply shift the attack vector? Compromising this…
Google already has a system where data and access control are combined as part of shared docs. I think Zanzibar for docs themselves on GDrive. Not sure the name of the system that manages a portion of a document in a shared doc which colocates data and access data. This seems like a next generation of that?
Zero trust is deterministic. AI is non-deterministic Non-deterministic access controls is Terrible idea
I completely agree. I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review . But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one. The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything lo…
Agreed; I don't think we want security controls to devolve into an argument between LLMs. Attacking and defending LLMs operate in an ecosystem, and are (hopefully) limited by constraints. Defending LLMs will be able to rely on and evolve those constraints. Attacking LLMs want to find a way around them.
Zero trust is deterministic. AI is non-deterministic Non-deterministic access controls is Terrible idea
I've been working on an open source ZTNA project/product https://github.com/octelium/octelium for many years and I am actually very open to the idea. Machine learning has already been in use for years when it comes to anomaly detection. Maybe modern LLMs can be used to automate access control, partially or fully at enterprise scale in the future. The idea is to have a policy engine that's controlled by AI that uses a…
Good, realistic take. There's a lot of context that can be drawn on to make better decisions and look for weird.
And then agents come along and some people want their agent to be able to do anything they can do with zero friction. That usually lasts until the first time something goes wrong ;)
I've been working on an open source ZTNA project/product https://github.com/octelium/octelium for many years and I am actually very open to the idea. Machine learning has already been in use for years when it comes to anomaly detection. Maybe modern LLMs can be used to automate access control, partially or fully at enterprise scale in the future. The idea is to have a policy engine that's controlled by AI that uses a…
Good, realistic take. There's a lot of context that can be drawn on to make better decisions and look for weird . And then agents come along and some people want their agent to be able to do anything they can do with zero friction. That usually lasts until the first time something goes wrong ;)
Actually zero trust can be seen as an optimization problem, you almost certainly want to globally deny every single request, even for authenticated users under all circumstances to all resources, unless when "necessary", "necessary" here is the key because it needs to be as dynamic and as fine-grained as possible, context-based and scalable. For small businesses, RBAC and ACL rules can be fine, but for enterprises with thousands or tens of thousands of employees, contractors and now AI agents which need varying permissions to different resources at different times, you would have to define thousands or tens of thousands of rules that might conflict with one another and are hard to maintain. ABAC and policy-as-code can mitigate to a certain extent providing dynamic context-based fine-grained access control. But if you could gather as much information as possible about every user and every session, combine it with some boundary permissions and static rules, and feed it periodically to some reasoning engine that is tasked with dynamically increasing/decreasing permissions for each session based on all such info, you can keep your manual/static access control policies to a minimum and maybe even eliminate JIT in some cases. The real question is whether modern LLMs and transformers are the correct and optimal architecture for this problem in the first place.
""" Beyond Zero shifts the trust boundary from the application to the action being performed on a piece of data in realtime—and from after-the-fact investigation to in-the-moment evaluation and containment. It augments BeyondCorp’s foundational identity with a “brain” capable of reasoning about the context and intent of a specific request in realtime. """ Doesn't this simply shift the attack vector? Compromising this…
Before zero trust, once you logged in, you have access to the entire kingdom of resources/files/APIs etc.
To me, this sounds like zero trust version 2.0. The "brain" challenges agentic AI trying to access resources it normally doesn't access.
Personally, I like the name "Beyond Zero" because it isn't oxymoronic like "Zero Trust".
Zero trust is deterministic. AI is non-deterministic Non-deterministic access controls is Terrible idea
+1000, and the role of non-deterministic security is to compose deterministic security primitives. Deterministic executes fast and you know what it will do. You want to evolve your ground truth, not hope for the best. That said, there is a role for probabilistic elements in the security model...as bait and signal.
I don't think the point here is to fully replace deterministic with non-deterministic-based access control. The point is to combine the traditional manual/coarse-grained deterministic access control with an additional layer of dynamic, fine-grained non-deterministic access control.
If this is interesting to you (as it is to me) but you want to quickly digest it instead of read the paper, Claude + SmallDocs[1] converted it into a slideshow which serves it to you in bitesized ideas: https://smalldocs.org/s/2SH6FHiUK1mcym24Z8E37I#k=2Sk6c_IdKJL... [1] I am the developer behind SmallDocs.
The font is different after downloading from the preview on the web page, but I still like it.
Zero trust is deterministic. AI is non-deterministic Non-deterministic access controls is Terrible idea
I completely agree. I think LLMs may have a role in security posture, specifically flagging/identifying potential threats for human review . But a Zero Trust/Access Controls should be a HARD boundary, not an inconsistent one. The problem we have right now is that there are some legitimately interesting ideas out there for things we could be using LLMs for, but we also have a ton of "I have a hammer, and everything lo…
Who said anything about an LLM doing it? Credit card companies have been using AI quite well for fraud detection for years before LLMs were released to the public.
""" Beyond Zero shifts the trust boundary from the application to the action being performed on a piece of data in realtime—and from after-the-fact investigation to in-the-moment evaluation and containment. It augments BeyondCorp’s foundational identity with a “brain” capable of reasoning about the context and intent of a specific request in realtime. """ Doesn't this simply shift the attack vector? Compromising this…
Before zero trust, once you logged in, you have access to the entire kingdom of resources/files/APIs etc. To me, this sounds like zero trust version 2.0. The "brain" challenges agentic AI trying to access resources it normally doesn't access. Personally, I like the name "Beyond Zero" because it isn't oxymoronic like "Zero Trust".
I have a simple question. When a company gets compromised, how come there are no alarms when TBs of data gets egressed?