11 ms·

It just takes one agent or informant on the inside to bring the whole house down.

• intrasight 5y ago
  > takes one agent or informant Only if that agent has the master keys. Strong security is about making sure that there is no master key.
  • stadium 5y ago
    I was thinking more about the soft targets and people based parts of the system, but you raise an interesting point. Zero trust systems might be solvable from a tech perspective, but zero trust organizations from a social perspective are a whole lot harder to design and enforce, maybe impossible. In accounting systems, which are targets of fraud and malfeasance (e.g. Enron), there is a "4 eyes" principle. It takes at least 2 people to change something that impacts the financials. But that can't stop 2 people from colluding. Back to the topic, if one agent or informant builds trust with one actor in the target group, and they collude or if one slip is made, it could be game over. Once the org is compromised, how do you know who to trust?
    • intrasight 5y ago
      I was thinking something along these lines. Any admin access to any critical/secure system can only be made thought a channel that will record the session. Perhaps such things exist.
• justapassenger 5y ago
  If you have single point of failure, either on technical or human level, you aren’t doing it correctly. But it’s really hard to build systems and organizations like that.