4 ms·

Good question. In the COVID-19 age and WFH era, companies should consider adding support policies that require visual identification (video call with photo ID o

• mam4 5y ago
  and then, the deepfakes
• ljm 5y ago
  Companies should keep their critical infra behind their own VPN as much as they possibly can and for the things that can't be VPN'd, use an SSO with strong MFA support. Especially for remote work - any critical or internal infra should be behind a company-operated VPN, with the VPN-access gated by MFA. It's obviously not foolproof because the more SaaS you add, the more vulnerable you are, especially because security in HN-land is something you only worry about after-the-fact because it's not MVP or quick to market. But asking for more personal info is perhaps the worst possible conclusion you could take from this. At some point you have to stop asking your users to take responsibility for your own shoddy security.
  • wil421 5y ago
    Bingo. The company I work for even gives certain locales, that are prone to IP theft, VDI only access to company systems. They are given a laptop with nothing on it except tools to access the VPN and VDI.
    • niros_valtos 5y ago
      When security impacts productivity it becomes a difficult battle. Zero trust tries to solve the VPN requirement, but as we all know, the devil is in the implementation details…
  • sofixa 5y ago
    Zero trust has been gaining more and more popularity over the traditional hiding behind a VPN and trusting everything behind it. A VPN, if there's one ( it's still useful and avoids unauthenticated exploits on software), should be the first line of defence.