3 ms·

A perspective from someone who hasn't been super involved in network security: Historically, many folks would treat a VPN as something like a moat around the c

A perspective from someone who hasn't been super involved in network security: Historically, many folks would treat a VPN as something like a moat around the castle. If you're on the VPN, you can access stuff, and if you're not on the VPN, you cannot. However, this leads to a sort of ambient authority: break into the VPN, and you've broken into anything. "Zero Trust" is a model closer to capability-based security than to ambient authority: just because you're inside the VPN does not automatically mean that you have access to the servers inside of it, you must also authenticate with them, specifically. It's "zero trust" because no user is trusted by default, not because you as a user cannot trust the network.

dovholuknf 4y ago
If you're interested in learning more about it in video (still need to write the content up in 'blog/article' form) you can watch me blather about it at the beginning of the talk i gave to developer week... https://www.youtube.com/watch?v=kVW2SOETP90 https://www.youtube.com/watch?v=kVW2SOETP90 I actually use that castle/moat analogy and talk about how that's how vpn's work... it's a tried and true example. :)
cyberge99 4y ago
Thus, zk is akin to all doors within the castle being locked and only the appropriate persons can access their respective areas: chefs -> pantry; knights -> armory, etc.
- PLG88 4y ago
  Aspects of it yes, that would be the principles of micro-segmentation and least privilege. There are other aspects of ZT principles, e.g., software-defined perimeters which OpenZiti delivers where this anology does not work. For example, SDP allows OpenZiti to do authentication/authorisation before any connectivity is established with outbound only connectivity as well as not even trusting the host OS if you use an SDK. I wrote a blog on this a few months back - https://netfoundry.io/demystifying-the-magic-of-zero-trust-with-my-daughter-and-opensource/ https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...

dovholuknf 4y ago

If you're interested in learning more about it in video (still need to write the content up in 'blog/article' form) you can watch me blather about it at the beginning of the talk i gave to developer week... https://www.youtube.com/watch?v=kVW2SOETP90 https://www.youtube.com/watch?v=kVW2SOETP90 I actually use that castle/moat analogy and talk about how that's how vpn's work... it's a tried and true example. :)

cyberge99 4y ago

Thus, zk is akin to all doors within the castle being locked and only the appropriate persons can access their respective areas: chefs -> pantry; knights -> armory, etc.

PLG88 4y ago
Aspects of it yes, that would be the principles of micro-segmentation and least privilege. There are other aspects of ZT principles, e.g., software-defined perimeters which OpenZiti delivers where this anology does not work. For example, SDP allows OpenZiti to do authentication/authorisation before any connectivity is established with outbound only connectivity as well as not even trusting the host OS if you use an SDK. I wrote a blog on this a few months back - https://netfoundry.io/demystifying-the-magic-of-zero-trust-with-my-daughter-and-opensource/ https://netfoundry.io/demystifying-the-magic-of-zero-trust-w...