4 ms·
Stuff is so complex nowadays that there's a ton of vectors an employee can use to eventually access almost anything on production systems. Unless you kneecap th
by AYBABTME 4y ago
Stuff is so complex nowadays that there's a ton of vectors an employee can use to eventually access almost anything on production systems. Unless you kneecap their ability to reach anything at all. Even if say you use Vault for secrets, extensive ACLs, on-demand access, there's an almost infinite amount of ways to squeeze out data in ways it hasn't been anticipated. Kuberneters, containers, etc doesn't always help, often sometimes it makes things worse.
Defending against internal threat seems like a losing battle that can only be mitigated, slowing down more than preventing an attack.
- debarshri 4y agoStopping employee from accessing anything and everything in production impacts productivity and engineer often do not want to work in that kind of environment.
- AYBABTME 4y agoIt's also not possible, by definition someone needs some access. Compromise enough of those people and there's no way around it.
- debarshri 4y agoExactly. Only thing you can do is make a drill where you assume everything is hacked and audit access daily, weekly and monthly.
- wepzen 4y agoImplementing a zero-trust architecture with a trust-score system for users and a dynamic policy for accessing resources can help to limit potential damage in the event of a security incident. But I agree that the balance between protecting against attacks and maintaining productivity can be delicate.