3 ms·
> A major complaint the "Zero Trust" people have about modern VPNs is that app-layer proxies can do device-context authentication --- so "employer-owned device,
by d4mi3n 5y ago
> A major complaint the "Zero Trust" people have about modern VPNs is that app-layer proxies can do device-context authentication --- so "employer-owned device, up-to-date patches" is a valid access rule, and that's harder to do right now with things like Tailscale. Fair enough. But almost nobody is doing anything like that today, and I'm not sure that when the dust settles it'll be a market win for app-layer ZTA proxies.
I may be missing the mark, but Okta and competing IdP (identity platform) or CASB (cloud access security broker) products do stuff like this. SSH access is one piece of the puzzle when you talk about a VPN-less model; generally orgs need this capability around any corporate system that is web/ssh/vpn/api accessible.
- tptacek 5y agoA vanilla IdP doesn't do what BastionZero is talking about here, because you have to individually configure your apps to use them; part of the point of ZTA proxies is that you have simple network access controls that ensure the only way to reach your applications in the first place is through the proxy.
- d4mi3n 5y agoAh, good call out. I'm mixing up Okta's SDK integrations with stuff more similar to a CASB or authenticating proxy. An organization I worked at in the past solved this problem by using Terraform/IaC to deploy authenticating proxies with any in-house applications that were deployed. Everything else went through a CASB or CASB-like product. Seemed to work well enough, but added a lot of complexity to the overall infrastructure that we would have loved to avoid.