3 ms·

This reads as a very ignorant article and doesn't even come close to addressing the issues that are faced by enterprise IT teams. As soon as you let users bring

by shaggy 15y ago

This reads as a very ignorant article and doesn't even come close to addressing the issues that are faced by enterprise IT teams. As soon as you let users bring their own devices (whatever they are) onto your corporate network your security concerns now include those devices. Who knows what Bob in accounting is letting his kid do with his laptop when he gets home at night. All the sudden your entire network is compromised or infected because using a VPN or employer provided devices is "hard". The bandwidth argument is really not valid anymore. Just about everyone can get broadband at home and most sensible organizations will allow split tunneling so your non-work related traffic can go out whatever local connection you're on.

barrkel 15y ago
I think that's a problem with enterprise IT mindset, rather; this idea that there's a binary distinction between inside and outside, trusted and untrusted, and therefore whatever you connect to the network must be vetted because it suddenly has all this trust by default. I think it's pretty inevitable that the evolution will be in the direction of distrust by default, and internal apps will slowly require more secure programming models, incrementally becoming more like ordinary public-facing sites. The reason is that the trust-by-default (once you're on the "inside") model is too centralized and can't scale to the increased number of devices. Employee devices will need hardening against intrusion from the corporate network just as much as the network needs hardening against intrusion from Bob from accounting; because you stop infections spreading by stopping the vectors for transmission, and that works from both ends.
- shaggy 15y ago
  There is a distinction of trusted and untrusted, but I wasn't implying a trust by default method because that's not good either. I also wasn't trying to imply that a vetted device is necessarily a trusted device. For example, we allow Blackberry, Apple and Android devices on our network as "officially supported" mobile devices. We don't trust them but we know if something goes wrong we can issue a single command and wipe the device which effectively ends all access that device had/has to our network resources. The point is, and you hit on it, that you have to prevent intrusion, compromise or infection from all places and allowing people to work on their own hardware or without a VPN means that job becomes exponentially more difficult.

by shaggy 15y ago

barrkel 15y ago

I think that's a problem with enterprise IT mindset, rather; this idea that there's a binary distinction between inside and outside, trusted and untrusted, and therefore whatever you connect to the network must be vetted because it suddenly has all this trust by default. I think it's pretty inevitable that the evolution will be in the direction of distrust by default, and internal apps will slowly require more secure programming models, incrementally becoming more like ordinary public-facing sites. The reason is that the trust-by-default (once you're on the "inside") model is too centralized and can't scale to the increased number of devices. Employee devices will need hardening against intrusion from the corporate network just as much as the network needs hardening against intrusion from Bob from accounting; because you stop infections spreading by stopping the vectors for transmission, and that works from both ends.

shaggy 15y ago
There is a distinction of trusted and untrusted, but I wasn't implying a trust by default method because that's not good either. I also wasn't trying to imply that a vetted device is necessarily a trusted device. For example, we allow Blackberry, Apple and Android devices on our network as "officially supported" mobile devices. We don't trust them but we know if something goes wrong we can issue a single command and wipe the device which effectively ends all access that device had/has to our network resources. The point is, and you hit on it, that you have to prevent intrusion, compromise or infection from all places and allowing people to work on their own hardware or without a VPN means that job becomes exponentially more difficult.