3 ms·

> The fact that the attacker had access to a machine inside the corporate network is no better than the kind of access they’d have had if they’d connected to ou

> The fact that the attacker had access to a machine inside the corporate network is no better than the kind of access they’d have had if they’d connected to our corporate WiFi network. I appreciate that they have a zero trust model, but arguably, once you have access to the network, you are one step closer to using any zero-day to get further inside. It's good on CloudFlare that they had security beyond that which protected their customers, but it is still very bad for Verkada and CloudFlare needs to decide if they are okay continuing with a camera setup that can provide easy access to hackers to their corporate network or not, and that wasn't touched upon in the article unfortunately.

evgen 6y ago
Zero trust is a good start, but claiming that it is a panacea is about as dumb as claiming that you are safe from hackers because you have strong perimeter protection. It is not just the potential for a zero-day, but the fact that direct access lets you see traffic flows and even an encrypted protocol is going to leak metadata that will tell you where to pivot and suggest potential attack vectors.
- lupire 6y ago
  You are arguing for security through obscurity?
  - evgen 6y ago
    As the only security? No. OTOH you should never volunteer information to an attacker, even that which seems trivial, innocuous, or obscured.
jeffbee 6y ago
I thought the point of zero trust is there is not an inside nor an outside of the network. There are services, and those services are accessible from anywhere, so everyone is always "inside".
- lupire 6y ago
  Right. The problem is that Verkada is leaking corporate cameras.
- didibus 6y ago
  From my understanding, it's slightly different. There can still be an inside and outside, but the inside doesn't get special privileges just because they are inside. So it's not like each employee connects directly to the public internet and all emails, files, attachments, wikis are all exposed to the public internet and exchanged over the public internet between employees. It's likely all these are still internal to the corporate network and not accessible from the public internet. But if you are inside the network, you don't default to having access to it all either, there is an additional access control in place no matter if it is inside or not. Now depending how confident you are on your access control layer, I have seen some companies literally expose things to the public internet and allow employees to access it without a VPN from any computer or mobile phone connected to the public internet from anywhere. I guess you can consider that on the extreme end of zero trust. But also the question here is does CloudFlare not consider inside camera feeds (which if employees go back to office could let you look at their screens) data that should itself be secured behind their zero trust access controls?

evgen 6y ago

Zero trust is a good start, but claiming that it is a panacea is about as dumb as claiming that you are safe from hackers because you have strong perimeter protection. It is not just the potential for a zero-day, but the fact that direct access lets you see traffic flows and even an encrypted protocol is going to leak metadata that will tell you where to pivot and suggest potential attack vectors.

lupire 6y ago
You are arguing for security through obscurity?
- evgen 6y ago
  As the only security? No. OTOH you should never volunteer information to an attacker, even that which seems trivial, innocuous, or obscured.

jeffbee 6y ago

I thought the point of zero trust is there is not an inside nor an outside of the network. There are services, and those services are accessible from anywhere, so everyone is always "inside".

lupire 6y ago
Right. The problem is that Verkada is leaking corporate cameras.
didibus 6y ago
From my understanding, it's slightly different. There can still be an inside and outside, but the inside doesn't get special privileges just because they are inside. So it's not like each employee connects directly to the public internet and all emails, files, attachments, wikis are all exposed to the public internet and exchanged over the public internet between employees. It's likely all these are still internal to the corporate network and not accessible from the public internet. But if you are inside the network, you don't default to having access to it all either, there is an additional access control in place no matter if it is inside or not. Now depending how confident you are on your access control layer, I have seen some companies literally expose things to the public internet and allow employees to access it without a VPN from any computer or mobile phone connected to the public internet from anywhere. I guess you can consider that on the extreme end of zero trust. But also the question here is does CloudFlare not consider inside camera feeds (which if employees go back to office could let you look at their screens) data that should itself be secured behind their zero trust access controls?