5 ms·

As I understand it, this sentence says that the application should be safe even if it was exposed to the public internet, not that it needs to be exposed. It i

As I understand it, this sentence says that the application should be safe even if it was exposed to the public internet, not that it needs to be exposed. It is a good practice to securize everything even if visible only internally. The "perimeter defense" given by a VPN can be a plus, but never the only line of defense.

jaywalk 5y ago
No, the memo pretty clearly says that VPNs need to go away.
- deleted 5y ago
  [deleted]
- MattPalmer1086 5y ago
  It says that VPNs and other network tunnels should not be relied on. Where does it say they should go away?
  - nybble41 5y ago
    "Further, Federal applications cannot rely on network perimeter protections to guard against unauthorized access. Users should log into applications, rather than networks, and enterprise applications should eventually be able to be used over the public internet. In the near-term, every application should be treated as internet-accessible from a security perspective. As this approach is implemented, agencies will be expected to stop requiring application access be routed through specific networks, consistent with CISA’s zero trust maturity model." "Actions … 4. Agencies must identify at least one internal-facing FISMA Moderate application and make it fully operational and accessible over the public internet."
    - shkkmo 5y ago
      Which is saying that agencies have to stop relying on / requiring VPNs for authorization and access control, not that any user has to stop using VPNs.
      - nybble41 5y ago
        It's true that they didn't mandate detecting and blocking accesses from VPNs, if the user chooses to connect through one. However, they pretty clearly are saying that the application should be exposed to the public Internet, which is the opposite of what enriquto claimed[0] earlier in this thread: > As I understand it, this sentence says that the application should be safe even if it was exposed to the public internet, not that it needs to be exposed. [0] https://news.ycombinator.com/item?id=30103558 https://news.ycombinator.com/item?id=30103558
    - MattPalmer1086 5y ago
      Yes, good point. I wonder if that applies to all infrastructure, or just enterprise applications.
deleted 5y ago
[deleted]
joshgachnang 5y ago
The memo does say each agency needs to pick one system that is not internet accessible and make it accessible in the next year. The way I read this memo is pushing that VPNs don't add much in the way of security (if you follow the rest of the memo) and should be removed.
- tptacek 5y ago
  The other way to read that part of the memo is that the exercise of exposing an application on the public Internet is a forcing function that will require agencies to build application security skills necessary whether or not they use VPNs. Note that the memo demands agencies find a single FISMA-Moderate service to expose.

jaywalk 5y ago

No, the memo pretty clearly says that VPNs need to go away.

deleted 5y ago
[deleted]
MattPalmer1086 5y ago
It says that VPNs and other network tunnels should not be relied on. Where does it say they should go away?
- nybble41 5y ago
  "Further, Federal applications cannot rely on network perimeter protections to guard against unauthorized access. Users should log into applications, rather than networks, and enterprise applications should eventually be able to be used over the public internet. In the near-term, every application should be treated as internet-accessible from a security perspective. As this approach is implemented, agencies will be expected to stop requiring application access be routed through specific networks, consistent with CISA’s zero trust maturity model." "Actions … 4. Agencies must identify at least one internal-facing FISMA Moderate application and make it fully operational and accessible over the public internet."
  - shkkmo 5y ago
    Which is saying that agencies have to stop relying on / requiring VPNs for authorization and access control, not that any user has to stop using VPNs.
    - nybble41 5y ago
      It's true that they didn't mandate detecting and blocking accesses from VPNs, if the user chooses to connect through one. However, they pretty clearly are saying that the application should be exposed to the public Internet, which is the opposite of what enriquto claimed[0] earlier in this thread: > As I understand it, this sentence says that the application should be safe even if it was exposed to the public internet, not that it needs to be exposed. [0] https://news.ycombinator.com/item?id=30103558 https://news.ycombinator.com/item?id=30103558
  - MattPalmer1086 5y ago
    Yes, good point. I wonder if that applies to all infrastructure, or just enterprise applications.

deleted 5y ago

[deleted]

joshgachnang 5y ago

The memo does say each agency needs to pick one system that is not internet accessible and make it accessible in the next year. The way I read this memo is pushing that VPNs don't add much in the way of security (if you follow the rest of the memo) and should be removed.

tptacek 5y ago
The other way to read that part of the memo is that the exercise of exposing an application on the public Internet is a forcing function that will require agencies to build application security skills necessary whether or not they use VPNs. Note that the memo demands agencies find a single FISMA-Moderate service to expose.