4 ms·

Sorry if I am taking this on a tanget, but in one of the HN threads regarding this exact security incident, it was recommended that this is why something called

• AnonC 6y ago
  I did a quick search on Algolia for HN (hn.algolia.com) and found several comments in this thread and threads related to the recent Cloudflare incident. This could be a starting point in your quest. [1] I don’t have a blog post or article or documentation though. [1]: https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=true&query=Blast%20radius&sort=byDate&type=comment https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=tru...
• ak217 6y ago
  "Blast radius" is a general term for the worst case impact of a specific type of breach of a given system. The recommendation you read was probably about limiting the blast radius. It's a general security best practice, and you implement it through techniques like federating (compartmentalizing) services away from each other, limited lifetime credentials, attribution, SSO for single point of control for invalidation of credentials, principle of least access (PoLA), privilege separation with role-based access control (RBAC), session logging/audit logging, etc. Most importantly the underlying system needs to have a well-defined and pentested authentication/authorization architecture. The hallmark of systems that limit the blast radius is that they have well-defined limits on how much they trust each other. OWASP (https://owasp.org/ https://owasp.org/) is a great starting point for reading about this stuff.