[tw04]

A VPN? Yes, by definition. Zero trust requires that every connection is authenticated and users are only granted access to the app they request. They never “connect to the network” - something brokers that connection to the app in question.

VPN puts a user on the network and allows a bad actor to move laterally through the network.

[raesene9]

It doesn't have to. There's nothing to stop you using a VPN as an initial filter to reduce the number of people who have access to a network and then properly authenticating and authorizing all access to services after that.

In fact, I'd say is a good defence-in-depth approach, which comes at the cost of increased complexity.

[nicce]

It also prevents the whole world for scanning your outdated public interfaces. Before they can do that, they need to bypass VPN.

If there are tens of different services, is it more likely that one of them has vulnerablity than both VPN and service has? And vulnerability in VPN alone does not matter if your internal network is build like it is facing public world. You might be able to patch it before vulnerability in other services is found.

[tw04]

I’m not saying you can’t have your own definition.

But I am saying that a VPN isn’t zero trust, by the agreed upon industry definition. There’s no way to make a VPN zero trust, and zero trust was created specifically to replace legacy VPNs.