3 ms·
eh no. !VPN is not the hallmark of ZT. It'd be so easy just to put services on the Internet with user/pass. Does that give you ZT?
by jiveturkey 5y ago
eh no. !VPN is not the hallmark of ZT. It'd be so easy just to put services on the Internet with user/pass. Does that give you ZT?
- sascha_sl 5y agoIt gives you zero network trust, which is unfortunately what a lot of companies still have. How many companies really do device attestation to connect to a VPN? I haven't been in a single one. (well, one tried, but it didn't really keep you from using a third party client) Putting your internal apps behind an OIDC proxy instead of the VPN is a straight upgrade at that point. Especially if your provider already does some checks for you (e.g. Chrome Enterprise, requiring Cloudflare WARP app)
- theamk 5y agoJust a plain user/pass is not going to cut it, I said "same or better level of security" for a reason. For example, all VPNs give you a single lockout/change password point, so this has to be at least common authentication. And VPNs have good logging for connections, so you got to have this too. And if your VPN client had device attestation, your solution should have have this too. And also services on VPN are not nearly vulnerable to auth bypass bugs, so your webserver should have some protection on this too (authenticating proxy?). I think !VPN is exactly hallmark of ZT... as long as security is preserved. If you disagree, what do you think ZT's hallmark is? (There is a philosophical question: if a company had a crappy VPN with no logging, and multiple VPN servers with no central auth.. and went to equally crappy user/pass webapp on internet.. does this count as "ZT transition"?)
- deleted 5y ago[deleted]