6 ms·

Assume everything is compromised and construct internal architecture accordingly. The best you can ultimately do is try to limit the impact. Proper firewall, T

• nine_k 4y ago
  You cannot zero-trust to your web framework. You cannot zero-trust your data access library, to which you have to give credentials to your production database. You have to trust the database itself, and the operating system that runs your whole stack. Zero-trust requires certain scale and is expensive; the most successful high-stakes zero-trust system I know is Bitcoin.
  • mikepurvis 4y ago
    But you can still do things like not allow your DB to make connections to the outside world, or receive connections other than from the application and authorized admins. And similarly for the app, it can be prevented from talking to anyone it doesn’t need to be talking to. They can still be badly behaved, but you are least control the blast radius.
• zomgwat 4y ago
  Default deny egress is an important step in limiting impact. It can be tough though.
  • mschuster91 4y ago
    The biggest problem in "default deny egress" is CDNs. It's a colossal waste of time to set up firewall access lists for your build agents, but even for your production environments - as soon as you have one external API that is hosted behind Cloudflare, Anypoint, Cloudfront, Akamai or one of the hundred other similar services, you may as well give up. Simply because it's extremely annoying to keep up tabs with changing IP addresses.