7 ms·
Many startups and hip companies don't do VPNs anymore - unfortunately they also dont do Zero Trust (which would require machine certs for everything and be enfo
by kerng 6y ago
Many startups and hip companies don't do VPNs anymore - unfortunately they also dont do Zero Trust (which would require machine certs for everything and be enforced) - so stuff is often available over Internet with password auth + maybe MFA. Attacker who gets hold of cookie or bearer token wins.
And the best part, support personnel often doesnt have MFA, because its outsourced to countries where smart phones with Authenticator apps are not as common to own for the regular person. I'm not joking.
- ex3ndr 6y agoI don't see any issue with auth without VPN if TLS is terminated by owner
- deleted 6y ago[deleted]
- kerng 6y agoThe better answer/question is maybe more about what kind of auth?
- callamdelaney 6y agoTo be honest VPN's are a huge pain in the arse for everybody involved.
- kerng 6y agoYep, I'm actually not saying that VPNs are the right or only (no way) solution I just wanted to highlight that auth is complex and there are often loopholes.
- gwittel 6y agoYes, you're most likely right. While physical tokens are relatively cheap, MFA setup can be not the most straightforward outlay. Still a lot simpler given the many SSO companies out there these days. That said, tokens are probably simpler than zero trust network setup. Even if you had a zero trust network, you'd still want tokens in case an employee machine is compromised.
- texasbigdata 6y agoReally stupid question. A key employee leaves, with their personal 2FA. Is there a standardized corporate solution for this yet? Sorry if that’s weirdly worded
- deleted 6y ago[deleted]
- tmpz22 6y agoYa you disable and invalidate all credentials for the user. There's a reason IT usually has prior knowledge of any hiring/firing/leaving.
- yjftsjthsd-h 6y agoDisabling their account or altering their first factor makes the second factor irrelevant. Who cares if I have a TOTP code for my old account, if the account is deactivated and/or its password changed?
- kerng 6y agoThe best part are breakglass keys or certs! Who rotates them when someone who had access to one leaves the org? :)
- hnzix 6y agoThere are various vendor products that support automated deprovisioning when an employee is terminated in the master HR system. You're 1000x more likely to see them in a corporate setting than a startup.
- donkeyd 6y agoMy previous startup had a bit of both. My access to things like mail and Atlassian stuff was automatically revoked, while I could still access the production database months later.