Chapter 10 · 2010–2014

Delete the moat

'Never trust, always verify.' The heresy that the inside was never safe — proven when Google got breached through its own trusted network and tore the walls down on purpose.

Every chapter on the “managing the access” branch has leaned on one inherited assumption: that there’s a trusted inside worth defending. Chapter 6’s VPN existed to put you inside. Chapter 9’s directory organized the inside. This chapter is where the industry looks hard at the inside and concludes it was a lie the whole time.

The heresy got its name in 2010. John Kindervag, an analyst at Forrester, wrote up a model he called Zero Trust, and its slogan is the whole idea: never trust, always verify. Stop treating network location as a proxy for trustworthiness. A request from inside the building gets checked exactly as hard as a request from a coffee shop in another country, because “inside” tells you nothing an attacker can’t fake. There is no chewy trusted center to protect — every access decision is made fresh, on evidence, every time. It was a direct repudiation of chapter 6’s castle, and for a few years it was mostly a provocative slide in vendor decks.

Then Google made it real, because Google got burned. In a sophisticated 2009 intrusion, attackers reached inside Google’s own trusted corporate network — the classic castle failure from chapter 6, the moat crossed once and then free movement within. Google’s response, published in 2014 as BeyondCorp, was radical enough to sound reckless: get rid of the trusted internal network entirely. No VPN. No privileged “we’re inside now” state. Every single request — from an engineer at a desk in Mountain View or a laptop in a hotel, no difference — is authorized individually, based on who the user is (proven with the phishing-resistant keys of chapter 8) and what device they’re on (is it managed, patched, healthy?), evaluated per request. Walk the contrast below: the moat model trusts a location; the zero-trust model trusts a verified identity and nothing else.

Sit with what that does to this site’s argument, because it’s the payoff of the whole “managing the access” branch. When you delete the perimeter, identity becomes the perimeter. There is no wall left to hide behind, no inside to be trusted in — there is only, for every request, the question “is this really you, on a trusted device, allowed to do this specific thing?” Access management stops being about where you are and becomes entirely about who you are and what you’re doing right now — which is chapter 5’s risk-in-the-moment principle, scaled to the entire enterprise and enforced on every click. The governance didn’t just wrap the secret. It replaced the wall.

A pandemic finished the argument that a Google whitepaper started. When the world went remote in 2020, the castle-and-moat model wasn’t just flawed, it was unusable — there was no building to be inside of. Zero trust went from thought leadership to federal mandate in a few years. Every “zero trust” product pitch you’ve been subjected to since is downstream of a 2009 breach and a 2014 paper.

But look closely at what a zero-trust check actually verifies, because the password never fully leaves the frame. “Is this really you” bottoms out in the credentials of chapter 8 — which relocated the password to a PIN and a recovery flow, not away. And “allowed to do this specific thing” is chapter 5’s privileged-access governance, running on secrets in a vault. Zero trust is the most complete expression of the thesis this site can offer: security is entirely the management of identity and access now, the wall dissolved into pure governance — and yet, follow any verification down far enough and there’s still a secret at the bottom, held by a human, governed well or badly.

The branch has one move left, and it’s the strangest. Everything so far has been about proving people. But most of what logs in today isn’t people at all — it’s software talking to software, machines authenticating to machines, millions of times a second. Chapter 11 is where identity stops being human, and the room divider’s last descendants don’t involve a person at all.