Device identity for zero trust: what practitioners are missing

TL;DR: The NSA’s new Zero Trust Implementation Guidelines expose a structural gap, according to Smallstep: many enterprises still cannot prove device identity with hardware-bound credentials, because portable secrets, shared passwords, and SCEP-based enrolment can be copied or replayed. Continuous verification fails when the device credential is not actually tied to the device.

Editorial analysis by NHI Mgmt Group, based on content published by Smallstep: “Your organization cannot meet the new NSA Zero Trust Implementation Guidelines. Here's how to do it.”.

By the numbers:

• The NSA’s Zero Trust Implementation Guidelines organize 77 activities across 64 capabilities.

Key questions

Q: What breaks when device trust relies on portable credentials instead of hardware-backed identity?

A: Device trust breaks at the point where the same credential can be copied, exported, or replayed on another machine.

Q: Why do weak device identity signals undermine zero trust implementations?

A: Weak signals such as MAC addresses, enrolment profiles, and shared challenge passwords create trust decisions that are easy to replay or spoof.

Q: How should teams decide whether a device certificate model is actually zero trust ready?

A: A device certificate model is ready only if the private key is generated inside secure hardware, cannot be exported, and is issued after attestation from the specific device.

Practitioner guidance

• Audit device trust assumptions Identify every access flow that treats MDM enrolment, MAC address recognition, or a shared challenge password as proof of device identity.
• Move issuance to hardware-bound keys Require device certificates to be issued only after attestation from TPM, Secure Enclave, or hardware-backed keystores.
• Tie revocation to the physical device Make decommissioning and compromise response revoke the device certificate, not just the user session.

Bottom line: Device trust fails when organisations rely on portable credentials or management signals instead of cryptographic proof of hardware identity.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →