3 ms·

I see a lot of the topics/questions here paralleled more and more on-prem. A decade ago, we assumed the network running on the hardware we owned was safe and d

I see a lot of the topics/questions here paralleled more and more on-prem. A decade ago, we assumed the network running on the hardware we owned was safe and didn't bother with things like encryption and authentication if the client was inside our walls. This has changed dramatically, marching towards full zero trust. These days all communication is handled over mTLS and enforce policy on every endpoint. We do these things on bare metal, VMs, or containers. It is easier on the higher layers of abstraction though. Personally, I think the most interesting part of cloud security is the greater ability to automate parts of the incident response process.

schoolornot 6y ago
> These days all communication is handled over mTLS I've been hearing of this for the last few years but I doubt any measurable number of companies are doing it in production. I think unless you're using a service mesh it's difficult to deploy, bootstrap, maintain, secure. Every POC I've seen of it using StrongSwan or vCenter hacks or tunneling one protocol in another are fragile at best.
- kerng 6y ago
  Large, well known companies (startups especially) often don't encrypt nor authenticate internal prod traffic - I always wonder how they pass compliance checks. Google with their BeyondCorp stuff really mislead a lot of startup shops and less security savvy organizations, because its easy to get wrong - and they ended up in these situations of having neither a perimeter nor zero trust. If they do "zero trust", zero trust's perimeter is the same size and pool of machines as the their old school network perimeter, meaning pop one machine then freely move around. Check your laptop, if your machine has SSH, SMB or RDP enabled, then you are not doing zero trust and you can easily be compromised in a coffee shop and your organization's zero trust perimeter just fell over.

schoolornot 6y ago

> These days all communication is handled over mTLS I've been hearing of this for the last few years but I doubt any measurable number of companies are doing it in production. I think unless you're using a service mesh it's difficult to deploy, bootstrap, maintain, secure. Every POC I've seen of it using StrongSwan or vCenter hacks or tunneling one protocol in another are fragile at best.

kerng 6y ago
Large, well known companies (startups especially) often don't encrypt nor authenticate internal prod traffic - I always wonder how they pass compliance checks. Google with their BeyondCorp stuff really mislead a lot of startup shops and less security savvy organizations, because its easy to get wrong - and they ended up in these situations of having neither a perimeter nor zero trust. If they do "zero trust", zero trust's perimeter is the same size and pool of machines as the their old school network perimeter, meaning pop one machine then freely move around. Check your laptop, if your machine has SSH, SMB or RDP enabled, then you are not doing zero trust and you can easily be compromised in a coffee shop and your organization's zero trust perimeter just fell over.