5 ms·

How’s that Zero Trust working out for ya?

HHC-Hunter 5y ago
I really wish more companies would implement Zero Trust. It's just so nonsensical to trust any device at this point - No matter how "secure" someone tells you it is, or even you think it is.
- grumblenum 5y ago
  Is there a clear definition of what ZTA even is? I read the O'Reilly book, and as best I can tell, the advice was fairly obvious recommendations and also 'replace your firewall as a single point of failure and make your access-control system your single point of failure'.
jimbojet 5y ago
Better than trusting the perimeter. A single breach in a “trustful” intranet still results in full network compromise. Best to assume breach and work from there. Hating on zero trust is non-sensical to me, feels like the same as hating on security.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
- yardstick 5y ago
  Given that, would zero trust plus perimeter have better security than each approach individually? Layered defense etc.
knownjorbist 5y ago
What does zero trust have to do with this?
- dhx 5y ago
  The IdM box in the provided diagram [1] is the same single point of failure "policy engine" and "ID management" architecture that is advocated by the "zero trust" crowd [2]. It's the same type of flawed centralised architecture that allowed the Solarwinds Orion exploit to be used to such great effect [3]. At least the ZTA paper calls out this weakness [4], but unless I missed something the paper severely understates the risk that a central "policy engine" presents, and glosses over all the other components ("threat intelligence feeds", host-based agents, etc) which are centralised in this architecture and present a similar risk. [1] https://imgur.com/Hcwayqq https://imgur.com/Hcwayqq [2] NIST SP 800-207, Figure 2, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S... [3] https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach#SolarWinds_exploit_2 https://en.wikipedia.org/wiki/2020_United_States_federal_gov... [4] NIST SP 800-207, Section 5.1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
xvector 5y ago
Zero Trust is the future.
southerntofu 5y ago
I wouldn't call running random Docker images from the Internet a "zero trust" environment.

I really wish more companies would implement Zero Trust. It's just so nonsensical to trust any device at this point - No matter how "secure" someone tells you it is, or even you think it is.

grumblenum 5y ago
Is there a clear definition of what ZTA even is? I read the O'Reilly book, and as best I can tell, the advice was fairly obvious recommendations and also 'replace your firewall as a single point of failure and make your access-control system your single point of failure'.

jimbojet 5y ago

Better than trusting the perimeter. A single breach in a “trustful” intranet still results in full network compromise. Best to assume breach and work from there. Hating on zero trust is non-sensical to me, feels like the same as hating on security.

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
yardstick 5y ago
Given that, would zero trust plus perimeter have better security than each approach individually? Layered defense etc.

knownjorbist 5y ago

What does zero trust have to do with this?

dhx 5y ago
The IdM box in the provided diagram [1] is the same single point of failure "policy engine" and "ID management" architecture that is advocated by the "zero trust" crowd [2]. It's the same type of flawed centralised architecture that allowed the Solarwinds Orion exploit to be used to such great effect [3]. At least the ZTA paper calls out this weakness [4], but unless I missed something the paper severely understates the risk that a central "policy engine" presents, and glosses over all the other components ("threat intelligence feeds", host-based agents, etc) which are centralised in this architecture and present a similar risk. [1] https://imgur.com/Hcwayqq https://imgur.com/Hcwayqq [2] NIST SP 800-207, Figure 2, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S... [3] https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach#SolarWinds_exploit_2 https://en.wikipedia.org/wiki/2020_United_States_federal_gov... [4] NIST SP 800-207, Section 5.1, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...

xvector 5y ago

Zero Trust is the future.

southerntofu 5y ago

I wouldn't call running random Docker images from the Internet a "zero trust" environment.