3 ms·
There’s still a layer between the application and the big bad internet. It’s just that the layer is an L7 reverse proxy instead of an L3 VPN appliance. This is
by closeparen 5y ago
There’s still a layer between the application and the big bad internet. It’s just that the layer is an L7 reverse proxy instead of an L3 VPN appliance.
This is still a big win, because:
a) You still have to go through the layer even if you’re on an office network.
b) The layer knows exactly which application you’re talking to, and maybe even something about the transaction you’re attempting (URL).
c) The layer can cooperate with the application, for example injecting a header about the authenticated user’s identity and groups.
- Spivak 5y agoAnd then in 20 years there will be a beyondcorp^2 because people will lean on their border gateway in exactly the same way they relied on their VPN. “Oh whatever it’s behind the proxy.” a) You just mandate that people be logged into the VPN always — “the office network” is just as untrusted as a coffee shop. b) That’s the address of the service. c) That’s the address of the client. Also apps that care what user you are basically all implement auth again against probably LDAP if it’s a corp network. I still think it’s a win because VPNs are clunky as hell but I think the security benefits are more to do with the political “rewrite” than the technical details. You can store your policy bits anywhere.
- EthanHeilman 5y ago> You can store your policy bits anywhere. You can but the application layer produces a far more legible policy and record of events. The right layer of abstraction for policy is at the application layer.
- closeparen 5y agoThat seems like either a very old-fashioned service (single permanent server) or very new-fangled one (overlay networking scheme) that you can identify simply by address.