6 ms·

Zero Trust is incredibly cool, but exceedingly difficult to pull off. I would even say this is true attempting to do this at my house, obviously a very small en

Zero Trust is incredibly cool, but exceedingly difficult to pull off. I would even say this is true attempting to do this at my house, obviously a very small environment. Here are the strategies that have worked for me / companies I have worked with: Doubling down on Google Cloud. Yes they get a lot of grief that is deserved for privacy, but the reality is your infrastructure and data is extremely insecure anywhere in today’s hostile cyberspace. It is the most secure, which might not even be that much, in GCP. There are so many good secure design patterns there that I can barely use AWS in good faith now with a customer even though I owe my whole career, at least the beginning part, to them. Duo Access - Highly recommend. Great all around. Push notifications to user phones and require location within a specific country and with biometric authorization for the push alert. Add device certs for even more security. Okta - don’t recommend at all for one reason. To me this felt like a big thing, and that was when signing up for they made you declare answers to security questions. This is a horrible pattern that NIST has come out against for some time. Whose idea was this?

verdverm 7y ago
Second GCP as the most secure. You might look at their Identity Aware Proxy. You can provide access based on account or group, and not have to expose the services to the internet
- thefreddo 7y ago
  Thanks verdverm. Disclosure - I don’t have much hands on experience with GCP IAP/context aware solution, but I do very well understand how Google modularized the solution for wider consumption. The use case of AirbnB where they are using context aware manager that feeds in logic from AWS λ was particularly interesting. Here is the link https://youtu.be/Sq9gp8KBsY0 https://youtu.be/Sq9gp8KBsY0 The presentation showed the capabilities of IAP. In case of AirbnB they are using custom built logic to make access decisions in IAP. The gist of it is about one feeding in custom logic to trust engine(context aware manager) to make access decisions. I am super impressed by this capability and I give it Google for how they architected. At the some time, I see 50 other companies that offer zero trust comprehensive solutions that in many ways offer what GCP is offering. Btw, author of this thread is asking the same and I just happen to jump on it because I am in a similar situation. Now back to questions on top of my mind - how good are the trust engines components of private access solutions provided by zscaler zpa or Netskope private access or cloudflare private access ? As I read it, trust engine that makes dynamic decisions to elevate or de-elevate privileges based on indentity and context is at the core of zero trust based solution . This is where I am at complete loss. I am just trying to separate marketing buzz from authenticity of solution so that I could get right solution in place. Please share your thoughts. Thanks to rshnotsecure for sharing his views on zscaler. Comments welcome.
thefreddo 7y ago
Any drawbacks(in terms of price, performance, lack of feature, maintenance, user experience) of using duo ? If you have used z scaler private access(Zpa), can you please share your thoughts/experiences?
- rshnotsecure 7y ago
  Zscaler is absolutely horrible. I have never seen an organization with such great design, marketing, and customer service have such an awful product. It’s quite strange. Case in point...look at their hosting records. It looks like some malware laden VPS budget hoster from the late 90’s. Incredibly careless setup. Their products also suffer from enormous lag. Again very strange because you can call in and get immediate and overwhelmingly thorough help...not sure why the products can’t just work though.
  - palmermatt72 7y ago
    Is the lag mostly associated with uneven Geo distribution of ZEN nodes?
luke_skiwalker 7y ago
Call me old fashioned. But, i don't understand what is the big deal about zero trust. Isn't the principle of least privilege was what security was all about for last 20 years? We had VLANs since the dark ages. Then vendors sold us micro-segmentation as the next big thing. Now with zero trust they seem to be saying lets do VPN everywhere and have a firewall between everything. Just for fun, lets use TLS instead of IPSec and it'll solve all our problems. You just need to buy fifty more boxes from us and life will be better. Don't get me wrong. I'm in complete agreement with using identity as the new perimeter. I highly recommend reading Google BeyondCorp papers. They are well written. We moved everything to Okta years ago and we've been very happy with it. But, I'm very unhappy with what security vendors are selling us. They seem to be completely missing the point.
- palmermatt72 7y ago
  We are also using Okta for SSO, and it has definitely made our life easier for enforcing identity based access. But the issue is Okta is only involved at session setup. We want to model our access based on google beyondcorp recommendations. But from your post, looks like you don't think there is anything out there currently, that can help us architect that kind of access model? What do other readers think? Seems too extreme to me.

verdverm 7y ago

Second GCP as the most secure. You might look at their Identity Aware Proxy. You can provide access based on account or group, and not have to expose the services to the internet

thefreddo 7y ago
Thanks verdverm. Disclosure - I don’t have much hands on experience with GCP IAP/context aware solution, but I do very well understand how Google modularized the solution for wider consumption. The use case of AirbnB where they are using context aware manager that feeds in logic from AWS λ was particularly interesting. Here is the link https://youtu.be/Sq9gp8KBsY0 https://youtu.be/Sq9gp8KBsY0 The presentation showed the capabilities of IAP. In case of AirbnB they are using custom built logic to make access decisions in IAP. The gist of it is about one feeding in custom logic to trust engine(context aware manager) to make access decisions. I am super impressed by this capability and I give it Google for how they architected. At the some time, I see 50 other companies that offer zero trust comprehensive solutions that in many ways offer what GCP is offering. Btw, author of this thread is asking the same and I just happen to jump on it because I am in a similar situation. Now back to questions on top of my mind - how good are the trust engines components of private access solutions provided by zscaler zpa or Netskope private access or cloudflare private access ? As I read it, trust engine that makes dynamic decisions to elevate or de-elevate privileges based on indentity and context is at the core of zero trust based solution . This is where I am at complete loss. I am just trying to separate marketing buzz from authenticity of solution so that I could get right solution in place. Please share your thoughts. Thanks to rshnotsecure for sharing his views on zscaler. Comments welcome.

thefreddo 7y ago

Any drawbacks(in terms of price, performance, lack of feature, maintenance, user experience) of using duo ? If you have used z scaler private access(Zpa), can you please share your thoughts/experiences?

rshnotsecure 7y ago
Zscaler is absolutely horrible. I have never seen an organization with such great design, marketing, and customer service have such an awful product. It’s quite strange. Case in point...look at their hosting records. It looks like some malware laden VPS budget hoster from the late 90’s. Incredibly careless setup. Their products also suffer from enormous lag. Again very strange because you can call in and get immediate and overwhelmingly thorough help...not sure why the products can’t just work though.
- palmermatt72 7y ago
  Is the lag mostly associated with uneven Geo distribution of ZEN nodes?

luke_skiwalker 7y ago

Call me old fashioned. But, i don't understand what is the big deal about zero trust. Isn't the principle of least privilege was what security was all about for last 20 years? We had VLANs since the dark ages. Then vendors sold us micro-segmentation as the next big thing. Now with zero trust they seem to be saying lets do VPN everywhere and have a firewall between everything. Just for fun, lets use TLS instead of IPSec and it'll solve all our problems. You just need to buy fifty more boxes from us and life will be better. Don't get me wrong. I'm in complete agreement with using identity as the new perimeter. I highly recommend reading Google BeyondCorp papers. They are well written. We moved everything to Okta years ago and we've been very happy with it. But, I'm very unhappy with what security vendors are selling us. They seem to be completely missing the point.

palmermatt72 7y ago
We are also using Okta for SSO, and it has definitely made our life easier for enforcing identity based access. But the issue is Okta is only involved at session setup. We want to model our access based on google beyondcorp recommendations. But from your post, looks like you don't think there is anything out there currently, that can help us architect that kind of access model? What do other readers think? Seems too extreme to me.