4 ms·
Well, still better then having all internal infrastructure exposed by default. At least there is something that needs to be circumvented. Companies that do Bey
by kerng 7y ago
Well, still better then having all internal infrastructure exposed by default. At least there is something that needs to be circumvented.
Companies that do BeyondCorp dont even have that level of protection. Most blindly follow that, without realizing that security of their internal systems is bad and therefore they should not do BeyondCorp. I have seen companies put their production infra without any fire walling out on the Internet (e.g jumpboxes and bastions) - that's also mind boggling.
Zero Trust is a journey not a solution....
- xyzzy_plugh 7y agoBeyondCorp isn't incompatible with VPN solutions -- if anything they're highly complementary. Why not use both?
- kerng 7y agoExactly my point, Zero Trust is good strategy and mindset. BeyondCorp though is short sighted and seems more like a solution from a company that wants to sell its cloud sooutions, by trying to make VPN evil by suggesting you should not have a network perimeter at all: "Connecting from a particular network must not determine which services you can access." I argue, that a simple source IP check is still one of the most significant and effective defense in depth measures that can be put in place. Not doing it seems like lack of due diligence to me. Its the first level of defense to which more security needs to be added on to.