4 ms·

> Traditional network access controls work by assuming that something is trustworthy based on some other factor - for example, if a computer is on your office n

> Traditional network access controls work by assuming that something is trustworthy based on some other factor - for example, if a computer is on your office network, it's trustworthy because only trustworthy people should be able to gain physical access to plug something in. If you restrict access to your services to requests coming from trusted networks, then you can assert that it's coming from a trusted device. Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN. There was always a strategy of defense in depth with multiple layers, network access being just one of them. You need to differentiate between users and their rights in an internal network anyway so of course you had some form of authentication and authorization. > The proxy is made available on the public internet, DNS for the services points to the proxy, and every time your users try to access the service they hit the proxy instead and (if everything's ok) gain access to it no matter which network they're on Why would you eliminate a split VPN though? Software has bugs, why would you expose the proxy or some app for automated scanners and exploiters on the internet? You can have both! You can have a locked building door and a locked apartment door. Of course relying on the building door is not enough but why would you eliminate it? How could that improve security?

sofixa 5y ago
It isn't exactly a straw man because it was often the default implementation. Yes, it was always a good practice to have the computers of the marketing team not have network access ( nor their user accounts LDAP/whatever access) to e.g. production servers, but not everybody deployed it like that, because it's hard, especially in big or acquired companies. There are environments where DHCP is disabled for "security" not to allow an attacker to get an IP in the network. For them obviously an IP is an "in", and they don't trust their defence in depth ( which of course, isn't a given). In any case, Zero Trust fuses authn and authz and makes it so you no longer need firewall rules for protection. All of that now happens on the same layer, which makes it more accessible, accurate and easy to manage. As for VPNs, the point is that they're of limited security utility, so they're just an extra hurdle for your own users. Yes, they "hide" your services from the generic internet, but those services should be hardened and protected in case of a breach of your VPN anyways, so the difference is minimal vs the effort and money spent on a VPN. I feel like i should add a disclaimer that i work at a company who sell products around zero trust, among other things, so opinions my own, held before joining, etc.
- jimmaswell 5y ago
  If the VPN requires an account to connect to then it seema fair to use it as a kind of single-sign-on.
  - hansvm 5y ago
    One of the many problems with that approach is that any service on your machine with network access can now impersonate you, the classic example being malicious JavaScript.
lmm 5y ago
> Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN. I assure you I've connected to more than one real-world network where the admins absolutely did rely on that. > Why would you eliminate a split VPN though? Software has bugs, why would you expose the proxy or some app for automated scanners and exploiters on the internet? You can have both! You can have a locked building door and a locked apartment door. Of course relying on the building door is not enough but why would you eliminate it? How could that improve security? If you put a weakly secured porch on the front of your building, it's easier for someone to take their time breaking into the main lock, and people are more likely to forget to lock the main door. Most vulnerabilities come from either writing code in C or mixing up authorized and unauthorized users. So it's really important to have a simple and understandable authorization model. Weak security layers do more harm than good, because they make mistakes more likely.
tallanvor 5y ago
> Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN. This absolutely used to be the primary method of security, and still is in many places, unfortunately. Even at the enterprise level, most companies only started making serious changes maybe 10 years ago, and are still far from completing the journey, and getting a device connected to a wired port will still get you too much access in most enterprises.
- k__ 5y ago
  Yes, I don't know where GP worked, but I've seen dozens of companies relying on VPNs alone.
- mox1 5y ago
  I'm a pen tester for a mid-ish sized company. I recently got approval to remove "port security" (802.11x) on a single port within the building. It is amazing the amount of access I now have (using a non-company managed laptop, plugged into this port). Once a bad guy has equivalent access, they are very deep into our network (and have bypassed multiple layers of controls). I don't think my company is unique in any way. I would expect this level of access at most companies to be game-over / large problem.

sofixa 5y ago

It isn't exactly a straw man because it was often the default implementation. Yes, it was always a good practice to have the computers of the marketing team not have network access ( nor their user accounts LDAP/whatever access) to e.g. production servers, but not everybody deployed it like that, because it's hard, especially in big or acquired companies. There are environments where DHCP is disabled for "security" not to allow an attacker to get an IP in the network. For them obviously an IP is an "in", and they don't trust their defence in depth ( which of course, isn't a given). In any case, Zero Trust fuses authn and authz and makes it so you no longer need firewall rules for protection. All of that now happens on the same layer, which makes it more accessible, accurate and easy to manage. As for VPNs, the point is that they're of limited security utility, so they're just an extra hurdle for your own users. Yes, they "hide" your services from the generic internet, but those services should be hardened and protected in case of a breach of your VPN anyways, so the difference is minimal vs the effort and money spent on a VPN. I feel like i should add a disclaimer that i work at a company who sell products around zero trust, among other things, so opinions my own, held before joining, etc.

jimmaswell 5y ago
If the VPN requires an account to connect to then it seema fair to use it as a kind of single-sign-on.
- hansvm 5y ago
  One of the many problems with that approach is that any service on your machine with network access can now impersonate you, the classic example being malicious JavaScript.

lmm 5y ago

> Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN. I assure you I've connected to more than one real-world network where the admins absolutely did rely on that. > Why would you eliminate a split VPN though? Software has bugs, why would you expose the proxy or some app for automated scanners and exploiters on the internet? You can have both! You can have a locked building door and a locked apartment door. Of course relying on the building door is not enough but why would you eliminate it? How could that improve security? If you put a weakly secured porch on the front of your building, it's easier for someone to take their time breaking into the main lock, and people are more likely to forget to lock the main door. Most vulnerabilities come from either writing code in C or mixing up authorized and unauthorized users. So it's really important to have a simple and understandable authorization model. Weak security layers do more harm than good, because they make mistakes more likely.

tallanvor 5y ago

> Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN. This absolutely used to be the primary method of security, and still is in many places, unfortunately. Even at the enterprise level, most companies only started making serious changes maybe 10 years ago, and are still far from completing the journey, and getting a device connected to a wired port will still get you too much access in most enterprises.

k__ 5y ago
Yes, I don't know where GP worked, but I've seen dozens of companies relying on VPNs alone.
mox1 5y ago
I'm a pen tester for a mid-ish sized company. I recently got approval to remove "port security" (802.11x) on a single port within the building. It is amazing the amount of access I now have (using a non-company managed laptop, plugged into this port). Once a bad guy has equivalent access, they are very deep into our network (and have bypassed multiple layers of controls). I don't think my company is unique in any way. I would expect this level of access at most companies to be game-over / large problem.