3 ms·

The last paragraph is especially salient. To me, ZT is really about recognizing that perimeter security is dead, and a modern approach to authorization requires

The last paragraph is especially salient. To me, ZT is really about recognizing that perimeter security is dead, and a modern approach to authorization requires defense-in-depth. A zero trust access proxy is just one layer (and is inherently coarse-grained). The identity provider and API gateway can provide more gates. And applications themselves should implement fine-grained authorization in a manner that is complementary but independent of upstream access controls.

Melatonic 5y ago
I dont think perimeter security is dead at all - we are just finally recognizing we need more finely controlled access. Just because a castle has a Keep in its center does not mean it no longer needs its main walls.
- xyzzy_plugh 5y ago
  Perimeter security needs to die before it can be reborn. The point of all of this is perimeter security becomes an optional, small contributor towards a secure context. It turns the entire legacy corporate network on its head. Especially at large megacorps, it's borderline impossible to perform incremental migrations towards a zero trust network without first killing perimeter security as a concept. You can always introduce it later, but it's a different beast entirely.
lupire 5y ago
what's the difference between a perimeter and a proxy? Sure, you can't give everyone in the org root on everything, but that was always true even on a physical or virtual private network.
- deleted 5y ago
  [deleted]
- closeparen 5y ago
  Perimeter: services totally naive to authentication and authorization. It is assumed that no bad actors could open a connection in the first place. If you are in the office or on VPN, you’re good. Perhaps there are broad compartments like different rooms in the office or different firewall profiles loaded by the VPN. Proxy (BeyondCorp): services remain naive but employees and offices are evicted from the trusted network. Employee requests go to the proxy, which checks authentication and authorization before passing along the trusted network to services. Services and potentially engineers/SREs who can get on the production network can still make whatever requests they like. Zero Trust: all services on the production network authenticate all requests. Even if you are root on a production box you would need tokens/certs to get useful responses from other services on the same production network segment. I entered the industry at a “proxy” company that is pushing towards zero trust. It’s hard to believe that the “perimeter” model is real. But you look at something like Target getting owned by thermostats in its stores that merely needed internet access, it is clear that some enterprises do work that way.

Melatonic 5y ago

I dont think perimeter security is dead at all - we are just finally recognizing we need more finely controlled access. Just because a castle has a Keep in its center does not mean it no longer needs its main walls.

xyzzy_plugh 5y ago
Perimeter security needs to die before it can be reborn. The point of all of this is perimeter security becomes an optional, small contributor towards a secure context. It turns the entire legacy corporate network on its head. Especially at large megacorps, it's borderline impossible to perform incremental migrations towards a zero trust network without first killing perimeter security as a concept. You can always introduce it later, but it's a different beast entirely.

lupire 5y ago

what's the difference between a perimeter and a proxy? Sure, you can't give everyone in the org root on everything, but that was always true even on a physical or virtual private network.

deleted 5y ago
[deleted]
closeparen 5y ago
Perimeter: services totally naive to authentication and authorization. It is assumed that no bad actors could open a connection in the first place. If you are in the office or on VPN, you’re good. Perhaps there are broad compartments like different rooms in the office or different firewall profiles loaded by the VPN. Proxy (BeyondCorp): services remain naive but employees and offices are evicted from the trusted network. Employee requests go to the proxy, which checks authentication and authorization before passing along the trusted network to services. Services and potentially engineers/SREs who can get on the production network can still make whatever requests they like. Zero Trust: all services on the production network authenticate all requests. Even if you are root on a production box you would need tokens/certs to get useful responses from other services on the same production network segment. I entered the industry at a “proxy” company that is pushing towards zero trust. It’s hard to believe that the “perimeter” model is real. But you look at something like Target getting owned by thermostats in its stores that merely needed internet access, it is clear that some enterprises do work that way.