Zero Trust - Dope or Nope

Sami Laiho opens by arguing that zero trust is a poorly named idea and is easier to sell by focusing on what it gives users than on distrust. He frames it around three principles: verify explicitly, use least privilege, and assume breach. He stresses incremental adoption, since chasing a perfect deployment can leave an organisation with no protection at all.

The middle of the talk covers practical controls. He argues for MFA on internal networks as well as external ones, notes that a Windows PIN tied to the TPM counts as a factor, and recommends requiring MFA for RDP. He describes removing local admin rights as the most useful step, citing lower service desk ticket volumes and fewer reimaging jobs in customer examples, and points to privileged access management tools as a way to elevate specific applications. He also covers network micro-segmentation with IPsec and identity-based firewall rules.

To close, he demonstrates a home network built on the same ideas, with a privileged workstation as the only path to internal systems and an approval flow for elevation. The live portion ran long and did not fully succeed. His takeaway is that the goal is to slow attackers down enough to detect and respond, not to stop them outright.