3 ms·

From the PDF linked in the article: > if users are allowed to circumvent the policies, then the benefits of Zero Trust will not be realized in that environment

by stult 6y ago

From the PDF linked in the article: > if users are allowed to circumvent the policies, then the benefits of Zero Trust will not be realized in that environment. Seems like Zero Trust should not depend on the users cooperating at all. Or am I reading the concept too broadly?

whydoyoucare 6y ago
That would require severe restrictions on users to a point where security actually becomes a bottleneck to normal functionality. A better way is reduce the cooperation to the minimum necessary, as opposed to eliminating it. For example, my office MacBook has policies enforced via "security profiles". Now, being, a privileged user, I have the ability to remove these, but knocking off my privileges will severely limit my ability to install new work related software or manage my machine to suit my work, etc. They can monitor and flag if profiles are removed, but there is always this race condition that exists that a user can exploit.
- croutonwagon 6y ago
  Ultimately it takes leaderships buy in. Even things like UAC or sudo/security profiles arent full proof. A lot of people will just type in their password or click yes if prompted and they are perceptively trying to "do something". Even those that "work in tech" but not really security. I have had some good developers try and disable our security services, use proxies etc. And realistically my teams work hard to nurture relationships with dev and give them any and all tools they need. I tried, hard, to implement some basic account separation for people with admin access to backend infra. The goal was simply to reduce the possibility of EOP or lateral movement and really only more specifically only for those that work in Backend infra (aka Dev, Ops, SQL admins etc). Things like removing local admin with a normal account and using admin accounts for backend infra, escalation so the normal users email/browsers cant possibly dump lsass etc.. I got a LOT of pushback, to the point of being called names. I was told i cannot push further without possible recourse and cannot escalate the proposal to c-suites. My org wasnt even open to step 1...

by stult 6y ago

whydoyoucare 6y ago

That would require severe restrictions on users to a point where security actually becomes a bottleneck to normal functionality. A better way is reduce the cooperation to the minimum necessary, as opposed to eliminating it. For example, my office MacBook has policies enforced via "security profiles". Now, being, a privileged user, I have the ability to remove these, but knocking off my privileges will severely limit my ability to install new work related software or manage my machine to suit my work, etc. They can monitor and flag if profiles are removed, but there is always this race condition that exists that a user can exploit.

croutonwagon 6y ago
Ultimately it takes leaderships buy in. Even things like UAC or sudo/security profiles arent full proof. A lot of people will just type in their password or click yes if prompted and they are perceptively trying to "do something". Even those that "work in tech" but not really security. I have had some good developers try and disable our security services, use proxies etc. And realistically my teams work hard to nurture relationships with dev and give them any and all tools they need. I tried, hard, to implement some basic account separation for people with admin access to backend infra. The goal was simply to reduce the possibility of EOP or lateral movement and really only more specifically only for those that work in Backend infra (aka Dev, Ops, SQL admins etc). Things like removing local admin with a normal account and using admin accounts for backend infra, escalation so the normal users email/browsers cant possibly dump lsass etc.. I got a LOT of pushback, to the point of being called names. I was told i cannot push further without possible recourse and cannot escalate the proposal to c-suites. My org wasnt even open to step 1...