4 ms·

I've never been in an environment that does security this way so I'm curious about it: if they have the proper credentials and permissions, why would it matter

I've never been in an environment that does security this way so I'm curious about it: if they have the proper credentials and permissions, why would it matter where they're sitting? When someone is granted access to a new resource, do you have to move them to a different network segment? What if there's not already a segment with the right combination of resources? Provision a new one on the fly? Or maybe grant more access than needed at the same time? We just have nginx check if you have the required LDAP group for the URL before forwarding into production. Typically one group per tool. What about temporary access? There are tools at my workplace where manager approval gets you access for 24 hours. As I understand it, there's just a cron job purging people every so often at which point nginx will start bouncing you again. Can you do something similar with VLANs? Is that sane?

chiph 7y ago
We're talking about space missions that cost a fraction of a billion dollars at the low end, and people have invested decades into just getting approvals and funding. And then perhaps another ten years just to get the spacecraft where it needs to go. These are nation-level assets. You're going to protect them much more heavily & securely than a corporate website. You can't allow a hostile attacker in for even a fraction of a second, so guest access will be strongly vetted, and networks will be protected by physical isolation.