3 ms·
> These days all communication is handled over mTLS I've been hearing of this for the last few years but I doubt any measurable number of companies are doing i
by schoolornot 6y ago
> These days all communication is handled over mTLS
I've been hearing of this for the last few years but I doubt any measurable number of companies are doing it in production. I think unless you're using a service mesh it's difficult to deploy, bootstrap, maintain, secure. Every POC I've seen of it using StrongSwan or vCenter hacks or tunneling one protocol in another are fragile at best.
- kerng 6y agoLarge, well known companies (startups especially) often don't encrypt nor authenticate internal prod traffic - I always wonder how they pass compliance checks. Google with their BeyondCorp stuff really mislead a lot of startup shops and less security savvy organizations, because its easy to get wrong - and they ended up in these situations of having neither a perimeter nor zero trust. If they do "zero trust", zero trust's perimeter is the same size and pool of machines as the their old school network perimeter, meaning pop one machine then freely move around. Check your laptop, if your machine has SSH, SMB or RDP enabled, then you are not doing zero trust and you can easily be compromised in a coffee shop and your organization's zero trust perimeter just fell over.