Trust Analysis

“Trust, but verify”.

I could make this a 3 words blogpost. This here is a motto I try to remind myself of, when thinking about a wide range of domains, this is far from being limited to cybersecurity. That skill I’ve not learned from cybersecurity, but my time in university in History classes. But I need to define trust before I develop this motto further.

What is Trust ?

For ease of introduction, I’ll be quoting Cambridge’s Definition of Trust :

to believe that someone is good and honest and will not harm you, or that something is safe and reliable

In this definition, several parts are interesting. It implies either :

• Honesty, goodwill and good intention
• Safety and reliability

This gives me a good basis to start, as this definition has the advantage of being applicable to both people and objects.

From the theory to the real world

This was the theory. Getting on in the real world will see this definition having some ramifications that are not expected from the initial wording. This definition is voluntarily wide and accepts a range of situations in which the meaning and spirit of “trust” is a different colour.

The first one, usually what’s implied when thinking about trust is the “Mutual trust”. This form of trust usually bonds between two people, two companies, two groups, around mutual interest and mutual benefits. This relationship, at the evaluation time “T” will be a win-win relationship. It will be based on honesty, goodwill, good intention. In the framework, it’ll be the safe and reliable situation, the safe friend, the reliable partner.

Then, those forms will usually be either of the following :

• Axiomatic
• Transitive
• Mutual
• Conditional
• Temporal
• Imposed

I get to the “simple” form of trust after these. Why ? Because I wanted to have the axiomatic first, as this one has the least conditions implied, and transitive made sense right after.

Another criterium to analyse is the directionality of trust. It can be directional or bidirectional, which has different implications.

And those will be based on a definition which is included within the initial one, but sufficiently specific that it seems to be a different concept.

Axiomatic

Starting with the “axiomatic”, this one derives from the mathematic concept of an “axiom”. This one is tricky, as an axiom is in mathematics something that is accepted as a fact and trusted to be true, but is unprovable. An axiom is a set of foundational rules that governs the system. As much as 1+1=2 is a provable result, it relies on the idea that commutation in addition exists, and that the function successor(N+1) = successor(N)+1. Within the natural numbers, 0 is a natural number is an axiom itself as well, for any x, x=x reflective, for any x, y, x=y, then y=x symmetry, for any x, y, z, x=y and y=z implies x=z is transitivity, and for any a, b, if a is natural and a=b, then b is natural. Based on these, it is possible to demonstrate that 1+1=2, removing any will make the demonstration invalid. Without diving too much into the details, see the Peano Demonstration, or the much denser Principia Mathematica. This form of trust is foundational within all fields, and none can exist without some form of axioms. Identifying these axiomatic trust points is extremely important to identify the source of assumptions. For a reference into why these are important, see Fast16 to get an idea of what happens when assumptions are shaken and the rules are modified. Staying with the previous example of 1+1, let’s switch the axioms from Peano’s to Boolean algebra. Now, 1+1=1, per the axioms. It goes without saying that, mostly everything built on top of this foundation will collapse.

Taking the initial definition into consideration, this one is the closer one to being exact, but it lacks one item which isn’t part of that definition. It is unprovable trust, and is thus a specific subset. Also, directionality doesn’t really have meaning as axioms lack agency. The axiom is reflective on itself, and can only be trusted. It is possible to verify that the axiom is still the initial axiom, as an example by verifying that 1+1 still adds to 2.

To bridge it into IT, some systems such as TPM or HSM are assumed to be reliable, safe, and hold the correct information. In the event that the validation from a TPM fails, the entire system fails.

Transitive

Then, we have transitive. Appropriately placed after the axiomatic, this lets me plug in the idea of transitivity straight away with moderate changes :

If Alice trusts Bob, and Bob trusts Carole, then Alice trusts Carole.

The idea between transitive trust is that the intermediates acts as a trust propagator. Them trusting both parties make ground for those parties to trust each other. This has the effect of creating chains of trust. What’s common in the cybersecurity field is PKI architecture, with root certificate being the “root of trust”, and trusting this one implying trust of the certificates it has “validated”. This allows to distribute trust preemptively and is what enables TLS. It is however a weaker form of trust, as it is subject to attacks throughout the entire trust chain. If any of the links were to become untrusted, it could invalidate the entire chain.

Taking the definition into account here, this definition has a weaker point in the intentions of the parties implied in the transitivity. Having a trusted party provides a minimal amount of safety and reliability, but unless the relationship lasts and then becomes a different form of “simple trust”, that one is weaker on the intention side. It needs verification over time, from both parties. I could say that verification is pending.

Here, directionality is extremely important, also. If the relations are all bidirectional, the transitive trust is bidirectional. If any of the trust forms is directional, it becomes directional. If the trust only point to one of the party, trust becomes hard to set up, as it starts from a non-trust transitivity. It is important to observe.

Mutual, or Relational

The “mutual” form of trust is actually a good example, as this is the one I can observe the most between people, along with the transitive one. It goes through simple things, simple parameters, such as having a common interest, a hobby, liking a music band. Professionnally, these can develop over time, through the same channels, between people. It is rare to see these between entities, unless there are people connected together by mutual interest. These can be observed with companies by getting curious with the Keiretsu concept. These are companies that will be part of a larger conglomerate, but are doing so for mutual interest. The smaller company provides diversification of operations and provides more stability to the group by doing so, and the larger group provides structure and stability to the individual companies by being able to absorb losses due to difficult commercial situations. These companies end up being bound by mutual interest, and unless either acts with hostility and actively tries to undo the bond, this one lasts.

Taking the definition into account, this relationship has already some form of specific condition baked in. Often, a minimal amount of time needs to have elapsed, and both parties involved will have then verified through a number of actions that their partners is trustworthy, implicitly or explicitly. This form of trust usually has been verified. Also, this one can be either directional or bidirectional. It will change a bit the frame of analysis, but not drastically.

Conditional

Conditional trust gets into the weak forms of trust. In these forms of trust, the parties trust each other in the execution of a specific task, or under some specific condition. This could mean that, for instance, a plumber is trusted by a construction company as a plumber, but they would be untrusted as an electrician. Although this seems trivial and unrequired to explicit, this allows to make the condition itself explicit.

A conditional trust has a scope of applicability, wide of narrow, and criteria of annulment.

Taking the definition into account, again, this type of trust is limited in the scope of applicability. It is thus a smaller subset than the definition, intersecting others. Verification is not required to fit this definition. This form of trust is usually directional, with the contractor and contractee trusting each other to honor their terms in the contract, the contract becoming a virtual third-party in the relationship.

Temporal

The temporal trust is a simple one. The trust relationship exists for a definite amount of time, and once the conditions for the trust relationship to organically dissolve, it is terminated. A simple case of this is the contractors. They’re hired for a finite amount of time, 3 months as an example, and once the contract reach the termination date, it is either renewed, or terminated.

Using this definition, that form adds a clause of termination. This doesn’t prevent the form of trust to evolve, though. These relationships can be directional as well.

Imposed

Imposed trust is a directional form of trust which is considered to be accepted by default. Opposite to the axiomatic trust, it is usually bound to a force, size, cultural lever and is usually linked to social fabric. A pretty good example of such as trust is the trust into the nation from its citizens. While a citizen of a nation will sacrifice some freedoms, they will gain some benefits from the state, which can be stability, healthcare, subsidies in culture, … This form of trust is usually not a trust one can break, however it can erode over time and disappear.

Linking to information technology, such a form of trust would be the Operating Systems providers, such as Microsoft or Apple. While alternative exist, to most people they will be the de-facto system, and they will trust Microsoft or Apple not to go against their interests. Leaving the ecosystems would prove tedious at best, and even though Linux exists as an alternative, it is still not possible to perform every operation one would perform with the same ease. To illustrate my point, I’m a hobbyist photographer and I use Capture One for photo editing and tethering. DarkTable and other tools exist, but they don’t allow me to realistically do what I want to. I’m locked under either Windows or MacOS for that reason, and the situation feeds on itself.

For an example closer to IT, think of VMware’s acquisition by Broadcom.

This form of trust, if deriving the definition, becomes a bit different. Instead of trusting in the goodwill, the parties involved hope that the trust in the other party will hold true over time. This one can only be unidirectional, as it implies some lever of action that imposes the trust.

Something that can be observed is that information flows and their observability are usually asymmetric in these situations. While one has the means to get a thorough grasp on the situation of the other, it is much more difficult for the other party. To illustrate, imagine how difficult it would be to a social network such as Meta to get a general picture and describe someone, compared to that person getting even a grasp on the complexity of that company.

Information and Epistemic Trust

For that reason, even if it is unfeasible for an individual to get all the information on their “target”, it is important to be able to tag the information with some trust level. Getting some information litteracy allows one to ever so slightly change the strength ratio with the Imposed trusts and empowers themselves a bit more.

Here, I could blindly trust the information. Or I can build a framework to analyse the trust in the information. The better way is to follow the workflow a journalist would follow when investigating a tip or information they receive. These are equally important to any Cyber Threat Intelligence analysts. Crowdstrike has a nice definition to Cyber Threat Intelligence, and it has an interesting overlap with Analytic Journalism. The risk, is the analysis is not performed appropriately, is having insufficient or even incorrect information. Depending on what I am discussing, and the context in which I am doing it, I could end up spreading misinformation, or destroying a hard-earned reputation. So, this is very important to do properly.

During analysis, it is very important to note that the information and its metadata are usually of equal importance, but this is not a rule, that’s only a starting point. Getting a good view of both said information and the metadata allows to tell a simple story here.

What are metadatas that are necessary to get a good grasp here ? I want to get the 6W :

• Who
• What
• Why
• When
• Where
• How

Those are not necessarily applicable to information. Sometimes, the when doesn’t matter. Sometime the where is nonsensical.

Getting to this point will take some time, usually require a bit of digging. But then, it is feasible to criticise the source of information, and the information itself. It is necessary to give an appropriate tag of trust to that information. During this process, if I am looking into geopolitics, for instance, I usually like to observe the professional past of the person reporting said information piece, where it was acquired, how it was acquired, if feasible. To get an example on how I use the 6W here, it would go similar to the following.

Using Analytic Journalism as an example for tagging : Adding as a metada, history of edition https://en.wikipedia.org/w/index.php?title=Analytic_journalism&action=history

• Who : The Wikipedia Foundation as a front, several contributors, named or anonymous.
• What : An article describing Analytic Journalism and how it aligns with diffent genres and methodologies
• Why : Wikipedia Foundation provides a free and open encyclopedia, available online. Its purpose is not to act as an only authoritative source, but as a starting point to base deeper research, as stated here : https://en.wikipedia.org/wiki/Wikipedia:Purpose
• When : Version is from 1st of June 2025
• Where : Wikipedia, direct
• How : Direct search, information publicly available

This allows to tag and criticise the information itself. It’s from the Wikipedia Foundation, with multiple contributors. If I were to provide a better view of the information and attempt to search for biases, I would be well inclined to verify which parts have been written by whom, and criticise these specifically. I could also trust Wikipedia’s Moderation and work at detecting articles defacements. This article skims on analytic journalism, and provides some references guiding how to dig deeper. This is done in the scope of Wikipedia purpose statement, which is to be considered a claim. Wikipedia has, over the years shown good faith, so this has a positive side. This is due to their overall good faith. The date of publication of the information is here important, as if it were modified, it would invalidate the analysis above. The other two tags have nothing of relevance to add here.

And now, deriving from the information gathered through the process, I consider the trust in this article, in Wikipedia, as both temporal and conditional. It is temporal as it is linked to that specific version and an immutable history, and will be invalidated by new edits or if a news were to arise that their history wasn’t immutable. It is also conditioned to the good faith that Wikipedia shows, through their moderation and verification mechanisms, which act as some sort of trust anchors. I could be exhaustive and evaluate these as well, or I could trust them as proven mechanisms up to now. I’ll choose the latter here. There is no exclusivity relationship between conditional and temporal, making it a good fit.

This process seems tedious, but it is very important to master as a cybersecurity professional, and even more when leaning into CTI or GRC. What becomes more important there is less technical and more empirical. The skill here isn’t just reading source and materials. It’s mapping the information to the incentive and the infrastructure behind them. Information doesn’t always flow through networks, but also through contracts, policies, funding models, historical precedents. It flows through legal frameworks. Those are the cconduits. It almost never flows through neutral conduits, they’re some form of expression. It is important to identify what’s the content of the pipe as much as the content of the information, to make sure that the combination doesn’t generate toxic information starting from seamingly innocent information.

The purpose of such a process, not necessarily this one, is to assert trust. This is the process of verifying, and naming explicitly which kind of trust should be considered specifically. The example only skims on information flows here, but such a process can be applied to relationships, and identify it.

It is important to realise this. While the process described here discusses information, this applies when we map trust to infrastructure as well. Trust needs to be considered as dynamic, adaptable, evolving, rather than a static entity.

In IT & Cybersecurity

ISO and NIST 800-207

NIST 800-207 is a good resource to read on what exactly is Zero Trust, isolated from the lens of marketing. I’ll get back on marketing a bit later. If the context put in by marketing is removed, it is a manual for trust scoping.

The concepts associated are, simply put :

• Defense in depth.
• Adequate scoping of trusts.
• Application of the least privilege principle, on the systems and networks.
• Monitoring and validation.

This is rather simplistic, but diving deeper in this technical document is not a necessity. It is built around the idea of evaluating, documenting, scoping and monitoring trust. Paradoxically, Zero Trust has trust at the very center of the scene, by proposing a framework in which trust is never implied but always explicit. In a way, this is elegant of simplicity. Identify which kind of trust is present, identify which direction is the trust formed in, and the basis is already pretty strong as a skeleton to have a good analysis.

Over time, trust will mutate, it will shift. The mutual relationship between two CEOs that guaranteed the goodwill between two companies will vanish with one of them, a cybersecurity company will have an incident they won’t disclose in time and create a situation that destroys their reputation, a group of agents with agency will be uncovered active in some open-source community. This will have trust shift, mutate, hybridise with itself. This is why after having evaluated the trust, which will be the boundary, the risk needs to be evaluated. That’s what ISO 27001 is for. It evaluates what happens when a boundary is crossed, or when the boundary itself changes.

ISO 27001 is often seen not as a framework and a starting point but as the objective for compliance. ISO 27001 is nothing more than a suggestion of how to perform the analysis, and a list of possibilities on how to address risks. This framework has a very positive advantage in a structure that keeps it flexible. Instead of becoming a checkbox for the day an auditor comes, it becomes a way to measure drift over time, and is the verification of trust. It is the answer to “I know trusting this party may come with some risks, am I adequately working to mitigate the risk in case of an unexpected event ?”. Compliance is the badge one can proudly display on their website. Resilience is following the processes, being swift, agile, and adapt it through the needs and quirks of an environment.

Zero Trust

Trust in information becomes the foundation. There’s something I want to express again, out and loud, the concept of “Zero Trust” introduced by marketers and some companies doesn’t exist and is a chimera. While the initial concept, coined by Stephen Paul Marsh in 1994 was more akin to “Do not blindly trust, verify everything” and thus introduced the idea of segmenting trust into different trust zones with levels, it has been denatured over time by marketing and its attempts at eliminating trust altogether.

Zero Trust, as it stands doesn’t fail because of technical reasons, but foundational ones. Zero Trust has been built as if it’s name was the objective, but it ended up getting a venture into eliminating trust. It ignores the fact that the systems are built on axioms, and some trust are imposed upon the system itself. You cannot remove either of them from the picture. Transitive trust is an absolute requirement in a world of commerce, and third-party will have some level of trust associated. Denying that is the original failure.

Security without trust becomes a hybrid of paranoia and psychosis and over time, and, borrowing the term from the cyberpunk genre, becomes some form cyberpsychosis. It only results in dissociation, isolation. One loses grasp on reality and the lack of trust ends up eroding other aspects of their lives. This becomes a deep form of burnout. Not trusting anything or anyone only leads to pain. If anyone were to remove any form of trust from their systems, they would end up building a psychotic system instead, as they also would have to solve a problem analog to the “Chicken or the egg”. A system built on infinite verification and tangled chains of validations stops becoming a system and becomes a liability instead. Think also of axiomatic trust, removed from the picture, means that the base layers of information systems are not trusted either. Mathematics cannot be built on no axioms. Also, if you don’t trust the axiom, you cannot verify anything within the stack. You’ve invalidated your entire architecture and infrastructure.

Zero Trust should always imply to verify what’s reasonable to doubt. Verification doesn’t imply not trusting, it only implies verification. Don’t listen to the marketing, or those companies attempting to sell a “Zero Trust solution”.

Think about it, really. What’s even the point of having a perimeter if you don’t trust anything? What’s the point of having authentication methods, as these are not trusted? What’s the point of certificates? What’s the point of DNS? NTP? Windows? Networking? Linux? x86_64? TPM? HSM? Silicon? None of these matter at this point.

After that, what you end up with is a cybersecurity theater, with professionals only writing compliance reports. Policies pile up on top of each other in a sprawling and uncontrolled way. Unscoped trust. Unscoped policies. Unscoped processes. From unscoped trust, chaos scopes. Trust erodes, sanity slowly goes away. What only persists is the act, the actors playing the roles that a script wants them to.

The end result is ironically predictable, as none of these processes have improved the security stance of the company attempting to follow them. It’s now weakened, made slow, unable to react fast enough when it matters. Not trusting has built a gargantuan architecture that cannot swiftly react in an incident response, and the curtains are now on fire. Policies exist, but no real procedure. The system lost its way into attempting to make everything comply, and stopped attempting to verify simple things, and write procedures, playbooks. A manifesto, in this situation, doesn’t help except when attempting to reaffirm belief. What helps is having a clear direction and a clear view. You cannot ask a puppet to dance and sing if it isn’t part of the script.

Don’t listen to the song from the bottom of the sea, and stay critical of similar ideas. If I were to mention the most hurtful marketing idea from cybersecurity, I think their idea of Zero Trust is a good candidate to top the list. They’ve seen a paradox and made up an answer that doesn’t respect the spirit. You can’t built a system which doesn’t trust anything, you can only choose poorly.

Closing thought on trust

Trust is a fragile concept, and can be destroyed in a matter of seconds or a few words. Sometimes, telling as much as “We need to talk”, or making a professional mistake can entirely break the bond that took years to form prior to that event. Identifying the form of trust is an important skill, when working in cybersecurity, and information technology. If you don’t identify your trust scopes, you miss one very important part of your risk analysis. Not because these trust are misplaced, but you’ve not identified its importance.

I’ve also voluntarily neglected to have one parameter of the definition above vary. I’m leaving it as a thought experiment here, but you, the reader. Who would you trust between :

• Someone whose intentions you’re unsure?
• Someone whose intensions you’re sure are dishonest? Would you rather trust dishonesty, or a possibility of honesty? This is more of a philosophical question, but when discussing sovereingty, this is one of those questions which arise quickly. What’s your risk tolerance, are you greedy, or do you avert your eyes in the view of uncertainty? Do you research the other party to ascertain their agenda?

Cybersecurity tends to consider trust as a vulnerability, it is not. The vulnerability and potential angles of attack are identified through the identification of the many forms of trust that exist through an architecture, mapping its topology. Trust is not the problem and has never been. Trust is a dynamic concept, that allows to draw the different perimeters that need to be dealt with. The real problem is keeping it in an implicit, unverified state.

While trust defines the perimeter, if it is not documented, scoped, continuously verified and monitored over time, if will drift, erode, decay, or be subverted. Risk is the measure of this drift.

The conclusion is pretty simple. I didn’t, but I could have made this blogpost a 3 words one.

Trust, but verify.