3 ms·
Of course, SDLC security and binary verification is also part of zero-trust systems. But you have to keep in mind - the whole point of zero-trust systems is th
by xvector 6y ago
Of course, SDLC security and binary verification is also part of zero-trust systems.
But you have to keep in mind - the whole point of zero-trust systems is that even if a malicious third-party blob is present on some nodes, it's blast radius is limited by the whitelist of clients that it can communicate with, which makes exfiltrating information particularly difficult unless you have additional exploits that let you move laterally.
- joe_the_user 6y agoI am suggesting you could limit "binary verification" and just allow "sources you compile yourself", 'cause how much can a binary be verified? (enough to know your blob was hacked at the source and not along the way, yeah but as we see, that's not enough). What describing just involves "we make sure our vendors are sort of trying to be secure" and that's about it 'cause that's all you can be when someone hands you a binary. And sure, there exist things like Linux drivers that are binary blobs in source code form but at least directs one's eyes to such things. Edit: Also, even in these environments, some people and some software has to run the network itself, like a sys admin tool. Which makes sys admin tools something everyone should look at. And brings us to the present hack.