3 ms·
> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa) Zero-trust may be a security meme at this point,
by Shank 4y ago
> - Socially engineer an employee to get on their VPN (could have been prevented with webauthn / hardware 2fa)
Zero-trust may be a security meme at this point, the whole point of zero-trust is to make it so that once on your VPN, all of your stuff isn't immediately pwned. You're supposed to have authentication at all layers, not just the corporate VPN edge. An insecure network share is a ticking time bomb, even if it's behind a VPN, because you now have to hope and pray all of your VPN users aren't bribable, aren't morally bankrupt, aren't disgruntled, etc. The same thing could have happened via insider from the lowest level of employee with VPN access if that report is true.
- hardnose 4y agoDing ding ding. This whole incident is symptomatic of eggshell security - crunchy exterior with a delicious gooey inside once you break through it. Hedgehogs dont have this problem.
- staticassertion 4y agoPeople who call ZTN a meme are usually just ignorant. It's a very simple and effective solution. Mutual authentication, explicit authorization, attestation, and auditing. Not exactly buzz word soup.
- Shank 4y agoI was recently on a call with someone who said their company was "totally zero-trust" because they disabled copy & paste on all workstations. I definitely believe in the concept, but it's definitely turning into a parroted term that's applied to anything.
- jjav 4y ago> People who call ZTN a meme are usually just ignorant. It's become a "meme" because it is used in endless irrelevant ways. So many companies are pushing zero-trust solutions that don't have anything to do with the basic idea of requiring access control at every endpoint. Also, while it is a very sound practice, there's also the hyped idea that it replaces everything else. Which is not very wise. You still want defense in depth over and above requiring acess control everywhere.
- raesene9 4y agoIt shouldn't be buzzword soup, that does not mean that companies and vendors don't use it that way. Pretty much any time a new security concept comes up vendors race to say that they implement it, whether they do or not. With Zero trust, it's hardly a new idea (e.g the Jericho forum de-perimeterization) but it's hard to implement well across all systems.
- staticassertion 4y agoIf you're stupid enough to fall for vendor buzzword garbage that's kind of on you though, right? It says nothing about ZTN.
- raesene9 4y agoBy that definition of stupid, pretty much every large company in the world is stupid in someway or another :)