3 ms·

Although "authorize everything" can also be confusing - so, what, you just let anything query your system?

gz5 4y ago
Agree, not a perfect term. You certainly make a good point and in fact the strongest zero trust approaches don't even let you on the network (even at layer 3) until after you are authorized.
- happyopossum 4y ago
  Err, no - the strongest zero trust approaches never let you “on the network” - authorized or not. They are designed to connect you to an application, you should never see the network.
  - gz5 4y ago
    yeah, agree, 'on the network' is a bad phrase. long form: completely 'eliminate' the network by closing all inbound firewall ports (not even allowing dynamic hole punching), and then opening ephemeral, session-specific L3 outbound connects (from both sides* of the session) only for authorized sessions (strong auth - not IP-address based auth). * requires intermediate 'gateways' which can bridge both sides to enable bidirectional data flow, initiated from either side
jeffbee 4y ago
That seems appropriate in many contexts. The originator of the "beyond corp" meme has all their critical systems just hanging out there on port 443. You could just download all their source code, if you were authorized. The point is if you want the extra layer of security, the belt of physical or VPN access to go along with the "authorize everything" suspenders, you can just put it on top. But you don't assume that the network security actually works, you don't allow its existence to degrade the rest of your security story.
- mr_toad 4y ago
  > But you don't assume that the network security actually works, you don't allow its existence to degrade the rest of your security story. If you implement security at the network layer, what’s to stop app developers from kicking the can down the road rather than implement app security?
pphysch 4y ago
Usually there is a "after authentication" implied "Authenticate everyone, authorize everything"
judge2020 4y ago
This is a valid solution - open everything up to the public internet, but gate everything on the domain behind authn (with the application performing authz only if authn is successful). Proxies can also handle the authn part and ensure the app isn't touched without authn, see: https://teams.cloudflare.com/ https://teams.cloudflare.com/

gz5 4y ago

Agree, not a perfect term. You certainly make a good point and in fact the strongest zero trust approaches don't even let you on the network (even at layer 3) until after you are authorized.

happyopossum 4y ago
Err, no - the strongest zero trust approaches never let you “on the network” - authorized or not. They are designed to connect you to an application, you should never see the network.
- gz5 4y ago
  yeah, agree, 'on the network' is a bad phrase. long form: completely 'eliminate' the network by closing all inbound firewall ports (not even allowing dynamic hole punching), and then opening ephemeral, session-specific L3 outbound connects (from both sides* of the session) only for authorized sessions (strong auth - not IP-address based auth). * requires intermediate 'gateways' which can bridge both sides to enable bidirectional data flow, initiated from either side

jeffbee 4y ago

That seems appropriate in many contexts. The originator of the "beyond corp" meme has all their critical systems just hanging out there on port 443. You could just download all their source code, if you were authorized. The point is if you want the extra layer of security, the belt of physical or VPN access to go along with the "authorize everything" suspenders, you can just put it on top. But you don't assume that the network security actually works, you don't allow its existence to degrade the rest of your security story.

mr_toad 4y ago
> But you don't assume that the network security actually works, you don't allow its existence to degrade the rest of your security story. If you implement security at the network layer, what’s to stop app developers from kicking the can down the road rather than implement app security?

pphysch 4y ago

Usually there is a "after authentication" implied "Authenticate everyone, authorize everything"

judge2020 4y ago

This is a valid solution - open everything up to the public internet, but gate everything on the domain behind authn (with the application performing authz only if authn is successful). Proxies can also handle the authn part and ensure the app isn't touched without authn, see: https://teams.cloudflare.com/ https://teams.cloudflare.com/