3 ms·

You can also do traditional VPNs ”the right way” - not granting access to resources just because user has a VPN connection, but configuring per-user/group acces

You can also do traditional VPNs ”the right way” - not granting access to resources just because user has a VPN connection, but configuring per-user/group access policies.

tsujamin 5y ago
true, VPNs can be a ZTA building block when coupled with identity-aware policy (Tailscale et al) I think when most think VPNs though they're talking enterprise ICT VPNs that historically don't play in that space :(
- yjftsjthsd-h 5y ago
  I suppose you could start at a really coarse level; it's pretty easy to have the VPN read the user's group from some central source and use that to decide what subnet(s) they get, and then you put ex. internal-use servers (say, file shares) on one subnet, customer application servers on another, and LOM consoles on a third.
Spivak 5y ago
Isn’t that just ZTA but inside the VPN or do you mean still using the appliance to gate access?
theluketaylor 5y ago
Managing that at scale is so unbelievably hard. Network layer stuff like VPN tends to be really isolated from application access restrictions both in terms of data and operational processes, so you end up having to duplicate the access controls and it's never in sync. Ask me how I know; I've been trying for years. Something like Google's BeyondCorp where the access restrictions are done in a proxy or other application layer is much more likely to be tied to the same access controls used within applications. That way ZTA acts as an additional security boundary but not an entirely separate authentication and authorization system that VPNs tend to be.
unethical_ban 5y ago
The point of ZTA, the idea of strong per-application RBAC, is that if you do it right, VPNs are useless. To need a VPN for "defense-in-depth" is to admit you don't have or want ZTA within parts of your perimeter. And that isn't a bad thing! ZTA is really hard to do unless you're building your business and all its core apps from scratch.
RandomChance 5y ago
Would that be something like HashiCorp's Boundary[1] ? [1] https://www.boundaryproject.io/ https://www.boundaryproject.io/

You can also do traditional VPNs ”the right way” - not granting access to resources just because user has a VPN connection, but configuring per-user/group access policies.

tsujamin 5y ago

true, VPNs can be a ZTA building block when coupled with identity-aware policy (Tailscale et al) I think when most think VPNs though they're talking enterprise ICT VPNs that historically don't play in that space :(

yjftsjthsd-h 5y ago
I suppose you could start at a really coarse level; it's pretty easy to have the VPN read the user's group from some central source and use that to decide what subnet(s) they get, and then you put ex. internal-use servers (say, file shares) on one subnet, customer application servers on another, and LOM consoles on a third.

Spivak 5y ago

Isn’t that just ZTA but inside the VPN or do you mean still using the appliance to gate access?

theluketaylor 5y ago

Managing that at scale is so unbelievably hard. Network layer stuff like VPN tends to be really isolated from application access restrictions both in terms of data and operational processes, so you end up having to duplicate the access controls and it's never in sync. Ask me how I know; I've been trying for years. Something like Google's BeyondCorp where the access restrictions are done in a proxy or other application layer is much more likely to be tied to the same access controls used within applications. That way ZTA acts as an additional security boundary but not an entirely separate authentication and authorization system that VPNs tend to be.

unethical_ban 5y ago

The point of ZTA, the idea of strong per-application RBAC, is that if you do it right, VPNs are useless. To need a VPN for "defense-in-depth" is to admit you don't have or want ZTA within parts of your perimeter. And that isn't a bad thing! ZTA is really hard to do unless you're building your business and all its core apps from scratch.

RandomChance 5y ago

Would that be something like HashiCorp's Boundary[1] ? [1] https://www.boundaryproject.io/ https://www.boundaryproject.io/