Implicit trust and frictionless access¶
Network reachability confirms what can be touched, but it does not indicate how a target will react when contacted. Two hosts sitting on the same network segment may be equally reachable, yet one yields a login prompt while the other accepts a Kerberos ticket without questioning its origin. Mapping which systems grant frictionless access is critical before committing operational effort.
An implicit trust relationship states that one system honours another for a specific purpose under defined conditions. Transitive trust introduces major operational surprises: delegated authority frequently extends far beyond the original architectural design, and the third transitive hop is usually the one no security team has evaluated.
Categories of trust relationships¶
Implicit trust edges across an enterprise generally fall into several distinct families:
An Active Directory domain honours tickets signed by its own authority, as well as domains and forests connected by explicit trust relationships. Configured once, these trusts persist indefinitely unless manually removed, meaning a domain trust established during a 2011 corporate merger often remains active long after the original stakeholders have departed.
A client system honours any digital certificate chaining back to a trusted root authority in its store, turning certificate hierarchies into standalone trust graphs. A certificate template permitting the requester to supply an arbitrary subject name grants access across every system that trusts the issuing hierarchy, which is typically the entire enterprise.
A cloud service provider honours identity assertions signed by its designated identity provider. Federated authentication effectively converts one organisation’s identity challenges into two, leaving access dependent on an external entity whose security posture is not being directly assessed.
Services configured for Kerberos delegation can request tickets for users they never directly authenticated. Unconstrained delegation extends access as far as the target user can reach, constrained delegation restricts access to specifically named services, and resource-based delegation places the trust decision with the target resource rather than the requesting service. These delegation paths represent critical trust relationships that rarely appear on standard network diagrams.
Where a trust relationship allows one principal to act on behalf of another, it also creates a transition on the identity graph, meaning the two are to be evaluated together.
Mapping trust and operational conditions¶
Much of a trust graph can be mapped without generating suspicious activity. Directory services outline their groups, delegation flags, and forest trusts to any authenticated account. Digital certificates state their issuer details in plain text, while federation metadata is published at standard public endpoints by protocol design. Industrial controllers using IEC 104 or Siemens S7 protocols accept read commands from whatever host reaches them over the network, demonstrating that they simply honour the physical wire.
Trust relationships often depend on transient operational conditions, such as an active maintenance window or an unexpired user session. A trust relationship valid only on Tuesday represents a very different asset than one honoured continuously, and relying on the former without noting its timeframe leads to unexpected operational failures.
Evaluating a trust graph is primarily an exercise in calculating operational cost. An edge honoured without challenge is nearly free: presenting a valid ticket, token, or certificate prompts the target system to perform its design function without raising an alarm. Crossing an edge that requires technical exploitation introduces cost and increases detection risk.
Trust relationships also decay over time. Rotated keys, revoked intermediate certificates, and audited trust revocations degrade the graph regardless of whether anyone actively monitors it. Attempting to use a stale trust relationship based on outdated assumptions is a costly mistake, as operations are usually already underway before the breakdown is discovered.
The mechanics of navigating these trust relationships are detailed in what honours what, while initial reachability across internet and internal scales is mapped in Rootways and Patches.