3 ms·

Such a simple thought: "the network is hostile". Yet when you consider the implications of that statement across the board you see stop-gap after stop-gap to f

Such a simple thought: "the network is hostile". Yet when you consider the implications of that statement across the board you see stop-gap after stop-gap to fill the void. And as Green points out - the state of the state is bleak when it comes to the surveillance state. His closing point is very open ended. But, thinking about this as to how "network security" sells products in today's landscape if Green's suggestion that these new systems would fulfill the goal of not having to worry about the network because the systems are designed with an inherent zero-trust model, how does the landscape of "network security" change? If the data path is immune from protections (firewall, IPS, URL, etc.) then does the endpoint radically change? Do we all end up with a containerized laptop with a front-end NGFW/UTM/security blob with which is locally routed within to my guest operation system of choice? And are the general functions broken out into secure segments so that I can work and play while minimizing risk of a malicious actor exfiltrating corporate data while I browse the questionable reaches of the Internet? Thought provoking, although - as Green states, I don't see many moving the ball quickly (yet?).

bostik 11y ago
One piece of what you wrote highlights a big part of the problem. My apologies for lifting just four words out of your longer sentence, but the point is, I believe, critical: > "network security" sells products Because people desire fire-and-forget solutions. We in the field know that security is not a product, or even (pun intended) a product of products. It's an ongoing process, where a term like "arms race" fails to convey the full meaning or scope. And above all, it's hard. If you want network and communications security at scale, you will need to solve how to deploy a fairly large set of keys. Secure key distribution depends on auditable trust. Bootstrapping trust relationships is HARD. Let's take an easy example. The entire CA industry is built around the premise of seeking rent on trust. And then, to work around the problems that arose from having a CA system in place, we came up with solutions like certificate pinning. Which really boils down to imposing distrust upon the very system that exists because they sell trust. While people want secure solutions, they really want to buy a product. Precisely they want something that "just works", and in effect make the complexities of security someone else's problem.

bostik 11y ago

One piece of what you wrote highlights a big part of the problem. My apologies for lifting just four words out of your longer sentence, but the point is, I believe, critical: > "network security" sells products Because people desire fire-and-forget solutions. We in the field know that security is not a product, or even (pun intended) a product of products. It's an ongoing process, where a term like "arms race" fails to convey the full meaning or scope. And above all, it's hard. If you want network and communications security at scale, you will need to solve how to deploy a fairly large set of keys. Secure key distribution depends on auditable trust. Bootstrapping trust relationships is HARD. Let's take an easy example. The entire CA industry is built around the premise of seeking rent on trust. And then, to work around the problems that arose from having a CA system in place, we came up with solutions like certificate pinning. Which really boils down to imposing distrust upon the very system that exists because they sell trust. While people want secure solutions, they really want to buy a product. Precisely they want something that "just works", and in effect make the complexities of security someone else's problem.