4 ms·

Sorry, I should clarify. The overlay network definitely has a listening port/s. The network will be somewhere (usually best on the open internet) listening that

Sorry, I should clarify. The overlay network definitely has a listening port/s. The network will be somewhere (usually best on the open internet) listening that is quite correct, that port is listening. The "no open ports" bit comes from the MQTT client and the MQTT server. Those have no open, listening ports because they will establish connections to the edge-routers. They'll have outbound connections, but no open ports. The security is better than TLS for a few reasons, mostly it's due to the whole "no open ports" on the server or the client. That's a pretty big difference. Also the connections will be mutual TLS, not only TLS to the server. There's other zero trust things that the overall OpenZiti overlay covers too. So there's a bunch of good reasons and I didn't want to blather on ...

metadat 4y ago
What attacks does this realistically protect from? Is it for when you want to run a process in a Raw Sewage network?
- dovholuknf 4y ago
  Not gonna lie - "Raw Sewage network" is pretty spot on. A huge part of zero trust principles is that all networks are untrustworthy, raw sewage networks. So the types of attacks that this protects against are all the 0day CVEs that are AV:N/PR:N. (attack vector=network, privileges required=none). That's the sort of thing like log4shell and the like. The only devices that could leverage those types of attacks would be trusted and authorized identities. That's probably a small number of machines, making the attack that much harder. Also DoS attacks are a lot harder because the "server" (whatever accepts connections) is generally dark to the network and only available over the overlay network. Being on the same subnet (or you know, the whole internet) doesn't help if you're not authorized to access the service in the first place. Where it's really cool is that you don't need to worry about cloud ACLs. Pick your laptop from one raw sewage network to another and it doesn't matter. You don't need to whitelist a new IP in the ACL. That's really convenient for today's road warriors. Similarly, you don't need to whitelist the whole enterprise's exit IP to the cloud. So that sort of thing. Hopefully that answers your question enough but if not lemme know
- ekoby 4y ago
  there are few things that improve your defense posture: - DDOS attacks can only attack the fabric and not the business logic service. Fabric nodes can be easily moved around or added to change attack surface. - you can have multiple services hidden and you don't have to worry about protecting them individually - service nodes themselves can be moved around or added for redundancy without having to stand up additional protection middleware

metadat 4y ago

What attacks does this realistically protect from? Is it for when you want to run a process in a Raw Sewage network?

dovholuknf 4y ago
Not gonna lie - "Raw Sewage network" is pretty spot on. A huge part of zero trust principles is that all networks are untrustworthy, raw sewage networks. So the types of attacks that this protects against are all the 0day CVEs that are AV:N/PR:N. (attack vector=network, privileges required=none). That's the sort of thing like log4shell and the like. The only devices that could leverage those types of attacks would be trusted and authorized identities. That's probably a small number of machines, making the attack that much harder. Also DoS attacks are a lot harder because the "server" (whatever accepts connections) is generally dark to the network and only available over the overlay network. Being on the same subnet (or you know, the whole internet) doesn't help if you're not authorized to access the service in the first place. Where it's really cool is that you don't need to worry about cloud ACLs. Pick your laptop from one raw sewage network to another and it doesn't matter. You don't need to whitelist a new IP in the ACL. That's really convenient for today's road warriors. Similarly, you don't need to whitelist the whole enterprise's exit IP to the cloud. So that sort of thing. Hopefully that answers your question enough but if not lemme know
ekoby 4y ago
there are few things that improve your defense posture: - DDOS attacks can only attack the fabric and not the business logic service. Fabric nodes can be easily moved around or added to change attack surface. - you can have multiple services hidden and you don't have to worry about protecting them individually - service nodes themselves can be moved around or added for redundancy without having to stand up additional protection middleware