The NSA has issued guidance on adopting zero-trust principles to counter internal network threats. Zero-trust architecture prevents unauthorized access and movement within networks by assuming threats exist and enforcing strict access controls. The approach includes data flow mapping, segmentation, and software-defined networking to minimize breach impacts. No CVEs are associated with this guidance.
Really depends on the implementation. Deploying an immature level of zero trust is definitely more headache than benefit for end users. It boils down to the design and implementation. Haphazardly isolating networks without proper access authentication/authorization processes/technologies will definitely be hell.
Given how dependent we are with third-party companies, libraries, and cloud-based services, it is impossible to be in a zero-trust state that is anywhere near comfortable. The whole world is in a “move fast and break shit” mentality that is killing our privacy and security.
We need more standards, and we need them now. Everybody keeps inventing their own shit and hoarding it for themselves, which we are forced to use, and we just have to put up with the potential for data breaches and hacker intrusions.