Zero Trust, applied to wine

Play the film · 3:01

This note is written in the first person by the curator.

Six honest serving-men

Rudyard Kipling wrote the simplest manual for investigation I know. It is four lines long, and it closes a children’s story published in 1902:

I keep six honest serving-men
(They taught me all I knew);
Their names are What and Why and When
And How and Where and Who.

It is not a security standard. It is older than that, and better: the instinct before the framework. Do not accept the surface. Ask the questions that make a story answerable — what is it, why is it here, when did it move, how did it get there, where has it been, who touched it — and do not stop until each has an answer that someone other than the storyteller can check.

For twenty years, that was my work, in a field that has its own names for the six questions. I worked in cybersecurity, and specifically on firewalls — the systems that decide what may pass between two networks, and on what terms. The discipline grew up in four steps, and I grew up with it. First we secured the channel: who could talk to whom, on which port, over which protocol — the perimeter, and little more. Then we learned to look inside the traffic rather than at its envelope, because a permitted channel carrying the wrong content is still an attack. Then we inverted the default: instead of blocking what we knew to be bad, we allowed only what we knew to be right, and closed everything else. And finally we learned that the same data, from the same identity, can be legitimate at nine in the morning and a breach at three, so the decision moved from the packet to its context — who, from where, with what, behaving how. That is the road that ends in zero trust, and it is the road this note walks with a bottle in hand.

Along it, the job never changed: making sure that every piece of data arrives intact, from the right source, and that five things about it can be proved rather than assumed. Who started the communication — and that it is always the same identity; the discipline calls this authentication. What that identity is allowed to reach — and that its permissions never quietly grow; authorisation. How it behaves — because an identity that is genuine and authorised but suddenly acts differently is the oldest sign of compromise there is, and the correct response is not curiosity but a closed door. That nothing was altered on the way — integrity. And that whoever started it is always the same, and is written into the log under their own name, so that the act can never later be denied — non-repudiation. Everything else in the field rests on those five, and none of them has anything to do with whether the data is credible. Credible data is the easiest thing in the world to falsify or to tamper with. The entire discipline rests on what someone who was not present can verify: that the data is intact, and that it is the data the sender sent. It lives in what can be verified by someone who was not in the room.

Its rule is short enough to fit on a lock: trust without evidence is not trust. It is hope.

Then I started collecting wine, and found a market that runs on hope with excellent manners. A bottle arrives with a story. The story is told by a merchant, a catalogue, a friend at dinner, a label. The story is often true. But a market in which the story is often true is exactly the market in which a false story does the most damage — because nobody wants to check, because checking feels rude, because the last ten stories were fine.

The six questions are not rude. They are the beginning of respect.

The chewy centre

Security people have a name for a world that trusts too easily. They call it the perimeter. The old model was simple: outside was dangerous, inside was safe, and once something had crossed the line — a password, a machine, a person, a bottle — the system behaved as if it belonged.

In 2010, John Kindervag of Forrester published a paper with an unserious title and a serious argument: No More Chewy Centers. Enterprise security, he argued, had been built like a sweet — a hard shell around a soft inside. Get past the shell, with one stolen password or one infected laptop, and the system had already decided you belonged. His answer was a model in which there is no trusted inside. Nothing is believed because of where it is. Every request, from anyone, from anywhere, is verified as if it were the first. He called it zero trust. In 2020 the United States standards body, NIST, made it a formal architecture, and its definition is worth keeping in view because it also describes the oldest weakness of the wine trade: no implicit trust is granted on the basis of physical or network location.

Read that with a bottle in mind. The wine trade has always granted trust by location. Inside the perimeter — the right auction house, the right dinner, the right cellar, the right accent — the bottle is believed. The counterfeiter’s work is not merely to imitate glass, paper and cork; it is to get inside that perimeter, and then never to leave it. Field Note N.º 019 followed one such case from the public record: a man who stayed inside the perimeter for eight years and sold, by the prosecution’s own count, more than twenty million dollars of bottles that were stories. The bottles did not move through glass and cork. They moved through reputation.

That was the breach. And belief is not authentication; reputation is not a log.

A label is an identity claim

In security, a username is not a person. It is a claim to be a person. Anyone can type one. What separates a claim from an identity is authentication: something the claimant can present, checked against a source the claimant does not control.

A label is a username. It claims a producer, a vineyard, a year. The claim may be true, and most of the time it is. But the label cannot authenticate itself, and neither can the cork, the capsule, the wax or the glass: they are also objects made by someone, altered by someone, copied by someone, believed by someone. When the trade says a bottle “looks right”, it may only be saying that the username is well spelled.

Authentication has to come from outside the bottle. In April 2008 it came from a domaine’s own records. Domaine Ponsot had not begun estate bottling until 1934 and had not made Clos Saint-Denis until 1982; a 1929 could not exist, and neither could Clos Saint-Denis from the 1940s, 1950s or 1960s. Those facts lived somewhere the seller did not control. They were the identity provider. Everything else in that saleroom — the catalogue, the estimate, the confidence in the room — was the chewy centre.

Provenance is authentication. Custody is the log.

A bottle is a message. It is sent from an estate to a table, sometimes across forty years and a dozen pairs of hands, and everything my old discipline asks of a message it should ask of a bottle. The label is the claimed sender; provenance is its authentication — proof that the claim is true, and that it has been the same claim at every step. Custody is its authorisation and its integrity: who was allowed to hold it and move it, under what conditions, and proof that nothing was altered on the way — no refill, no relabel, no unrecorded summer in a garage. The log is its non-repudiation: the record no one in the chain can later deny, because each entry was written by someone who could be asked.

And then there is behaviour, which the wine trade almost never checks and my discipline never stops checking. A genuine identity with the right permissions that begins to act out of character is blocked first and questioned later. A bottle has a character too: a fill that agrees with its age, a format the domaine actually made, a capsule of its era, a route through channels that make sense for what it is. A magnum from a house that never bottled magnums, a 1929 from an estate that began bottling in 1934, a rare Burgundy that surfaces repeatedly through the same discreet friend — these are behavioural anomalies, and the correct response is the one the discipline gives: quarantine, not benefit of the doubt.

The four steps of my old trade apply in the same order. Secure the channel: a bottle moves warehouse to warehouse, under bond, and never through a door that keeps no record. Look inside: the object is read against its own history — fill, capsule, label, glass — not against the story that accompanies it. Invert the default: a cellar does not block the bottles it knows to be wrong; it admits only the bottles whose record it can verify, and everything else waits outside. And judge the context: the same bottle, from the same seller, can be right in one channel and an anomaly in another.

Security architectures that took Kindervag seriously stopped asking one question — where are you? — and started asking Kipling’s. Google’s engineers, describing their own migration in 2014, put it plainly: access depends on what is known about the user and the device, not on the network the request arrives from. Applied to a bottle: who holds it now, and can that be shown rather than said? What exactly is being claimed? When did it move? Where has it been since it left the estate, and does each step exist as a document, or only as a sentence? How was it kept? And why should the record be believed — who controlled it?

The first of these is provenance. The chain of movements is custody. The state of the object against its own history is condition. They are not three words for the same thing. A bottle can have strong provenance and broken custody: it left a great cellar, then spent four years somewhere nobody wrote down. The label survived that. The log did not.

Security’s insight is that the log is not paperwork around the asset. The log is part of the asset. A record that cannot be quietly rewritten is what separates custody from storytelling — and the steps that do not exist in it are not gaps in the paperwork. They are the finding.

That is why this archive is kept the way it is: every bottle a record, every movement an entry, every claim with its source. A rare bottle without custody is just a story. It is not a slogan. It is the definition of the thing being kept.

Assume breach

There is one more zero-trust principle the wine trade rarely says aloud at dinner. Assume breach. Not that a breach might happen: that it has happened, somewhere in the system, and the job is to limit what it can reach.

The wine market already has its version of that fact, on the record. In December 2015 the United States Marshals destroyed more than five hundred bottles from the Kurniawan cellar classified as counterfeit or unsellable, after putting 4,711 others, deemed authentic, up for auction for the victims. Years later, as Field Note N.º 019 records, a court declaration reportedly placed hundreds more bottles owned by Kurniawan in Christie’s custody, in London and Geneva — and the public record does not allow anyone to say whether they are genuine, counterfeit or mixed. That is the point. Fakes are in the system. The honest position is not to hope you never meet one; it is to build the cellar so that meeting one costs as little as possible.

That is what the discipline calls segmentation: each bottle its own record, so that one bad bottle cannot contaminate the credibility of the rest. Least privilege: no movement without an entry, no entry without a source. Verification at the door, not at the table: the checks happen when the bottle changes hands, because after that the only test left may be opening it. And exit integrity: a bottle can live twenty years in professional custody and lose part of its record in the final movement. The last transfer matters as much as the first, which is why release, when it happens, should preserve custody rather than interrupt it.

Custody to custody. Record to record. Bottle last.

What this changes for a collector

The poem gives the questions. Zero trust gives the discipline. Wine gives the object.

Before a serious bottle, ask the six. What is being claimed, exactly — producer, cuvée, vintage, format? Why should the record be believed — who controlled the evidence? When did the bottle move, and how many times? How was it kept between each move? Where does the record begin, and where does it break? Who holds it now, and can that be shown?

Then decide, with the four habits the discipline uses. Treat the label as a claim, not a fact. Ask for the log, not the anecdote. Prefer the shortest chain: the best provenance is often the least interesting story. And verify at the door, because the moment of transfer is the moment that writes the next owner into the bottle’s history.

Never trust the label. Verify the chain.

Read next: The bottle as an attack surface — the same system, from the attacker’s chair.

Sources & further reading

1. Kipling, R., “The Elephant’s Child”, Just So Stories (1902). The verse “I keep six honest serving-men” closes the story. Public domain.
2. Kindervag, J. and Balaouras, S., No More Chewy Centers: Introducing the Zero Trust Model of Information Security, Forrester Research, 2010.
3. Rose, S., Borchert, O., Mitchell, S. and Connelly, S., Zero Trust Architecture, NIST Special Publication 800-207, August 2020. doi.org/10.6028/NIST.SP.800-207
4. Ward, R. and Beyer, B., “BeyondCorp: A New Approach to Enterprise Security”, ;login: (USENIX), vol. 39, no. 6, December 2014, pp. 6–11.
5. The Jericho Forum, Commandments, version 1.2, 2007. The earlier case for “de-perimeterisation” on which zero trust builds.
6. U.S. Attorney’s Office, S.D.N.Y. — charging release, 8 March 2012. Domaine Ponsot: estate bottling from 1934; Clos Saint-Denis first made in 1982. justice.gov/archive/usao/nys/pressreleases/March12/kurniawanrudycharges.html
7. U.S. Attorney’s Office, S.D.N.Y. — sentencing release, 7 August 2014; Government’s Sentencing Memorandum, ECF No. 122, 12 May 2014. The prosecution’s estimate of some $20.7 million in counterfeit wine sold, as reported by Wine Spectator and Wine-Searcher (2014).
8. U.S. Marshals Service — press release of 7 December 2015 and official photographs of 10 December 2015, Creedmoor, Texas. 4,711 bottles deemed authentic offered at auction; more than 500 counterfeit or unsellable destroyed.
9. Field Note N.º 019, The bottles still in the vault. The full record of the case, including the 2020 declaration and the limits of the public record.

On method

Kipling provides the frame: six honest questions. Forrester, NIST, USENIX and the Jericho Forum provide the security architecture; authentication, authorisation, behavioural verification, integrity and non-repudiation are used here in their technical sense; the four-step account of how firewalls evolved — channel, content, default deny, context — is the author’s own summary of his field. The claims about Rudy Kurniawan and Domaine Ponsot are drawn from the public legal record and from Field Note N.º 019. The analogy is mine. The facts are not.