5 ms·
“Security of organisations should be done in layers” and each layer makes breaking into your (whole) organisation harder, but comes with friction for your staff
by andy_ppp 7y ago
“Security of organisations should be done in layers” and each layer makes breaking into your (whole) organisation harder, but comes with friction for your staff.
- kerkeslager 7y agoIt should be noted that your staff are a key attack vector.
- e12e 7y agoNo, I think the new consensus is that all systems are vulnerable (obviously true if all systems have users with access, whom may be compromised) - so not layers: compartments (and need to know;need to access). I believe this is part of eg google/alphabet's new model: no hard wall, soft "inside" (egg model). Just stand alone secure sub-systems with ACL (access control lists) mediating access on a user-by-user, sub-system by sub-system level. No real trust in "location" as proof of authorization (I assume truly, off-grid clean rooms are excepted) - because "everything" needs access to networked resources. Ah, I guess they call it BeyondCorp: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
- andy_ppp 7y agoSure, I used (or the person I’m quoting used) the wrong term, thanks for the clarification. I did mean and he meant compartmentalising :-)
- soulofmischief 7y agoVirtualization, privilege management, etc. are still another layer.
- e12e 7y agoNot a different organizational layer, just a different techincal layer though.
- soulofmischief 7y agoBoth are important in the context of security.