5 ms·

Zerotrust is cancer. I dismissed it a few years ago as a harmless hype but I am now seeing real harm being caused by this hype. To avoid writing an essay here

by _8j50 4y ago

Zerotrust is cancer. I dismissed it a few years ago as a harmless hype but I am now seeing real harm being caused by this hype. To avoid writing an essay here let me keep it short and explain why: I am seeing orgs spending valuable time, money and resources on box checking and implementing false security all over. It is being used in place of improving security posture that is aware of threat context facing the organization. It has scope-creeped beyond the original intended purpose of ensuring all actions are explicitly authorized and eliminating implicit trust to mean a buch of ridiculous goals and hype words no one can explain consistently. I caution everyone to avoid using the term but to still implement the original beyondcorp architecture. Another cancer that is begining to spread:"passwordless".

cscheueuer 4y ago
What is the easiest way to implement the original beyondcorp architecture without spending multiple months building a solution in house?
- jupp0r 4y ago
  If you already have authentication and authorization in front of every service in your internal network (unlikely), it's as easy as making everything routable from the internet. If not (more likely) you need to start there, which will improve your security posture incrementally, even if the beyondcorp project gets cancelled along the way.
  - adobrawy 4y ago
    I will add that in the case of authentication before each service, it is important that it does not happen in the application itself, but before reaching it, which usually means either network centralization (e.g. Teleport) or authentication proxy (Traefik + forward auth + proxy, GCP identity-proxy, AWS Verified Access). It is also important to centralize the identity provider, of course, which in the times of SAML / OAuth is easily achievable even for small organizations.
eikenberry 4y ago
Isn't this basically true of every tech idea once it hits the enterprise? Agile is the usual whipping boy paraded when discussions of enterprise ruining something but it seems just true in general. As a problem I think this mostly boils down to technical decisions being made by non-technical people. Like many articles about Zero-Trust (some easy examples here in the comments) come out of the gate talking about AuthN, which is inherently about trust, they just don't seem to get it.
- deleted 4y ago
  [deleted]
deleted 4y ago
[deleted]
tinglymintyfrsh 4y ago
I don't know what "zerotrust" is supposed to mean. Maybe they're stretching the meaning of zero knowledge constructions. "Zero knowledge" should mean "the service provider never keeps logs, data, metadata, or secrets in the clear that can be retrieved without user intervention, preferably not knowing anything about any particular user." MEGA is partially this. "Passwordless" isn't terrible if it means "use a physical device or TPM-stored secret instead of a password". It shouldn't replace 2FA by having 2 actual factors.
- pclmulqdq 4y ago
  From a more cynical point of view, "zero-trust" tends to mean something along the lines of: "trust a TPM on the user side... and all of my server logic and my cloud provider." From a less cynical point of view it means "hold all the client's keys in their TPM and only authenticate on the server side, but don't decrypt (or otherwise pass keys around)"
  - matthewaveryusa 4y ago
    zero trust at its core means authentication and authorization at each service, for each request. at a high level it means not trusting a connection from another service in the same network just because it’s on the same network. rooting trust to tpms is orthogonal but certainly the right way to root trust. The space where I think zero trust is the most interesting are vpns like tailscale/wireguard/microsegmentation that flip the status quo around and say the network is the identity/authoritzed group
    - pclmulqdq 4y ago
      Wait, but I thought everyone was doing that anyway prior to the "zero trust" thing. The difference was who you trusted to hold user (and concern-specific) keys - before zero trust, it was your server, and afterward, it's the user. Authentication and authorization for internal services is kind of basic.
      - 4y ago
flangola7 4y ago
> Another cancer that is begining to spread:"passwordless". I have got to hear your problems with it! As I see it passwordless will eliminate whole families of attack methods. Lookalike credential phishing pages made obsolete. I wish we had started using it years ago. What are the downsides?
- NoZebra120vClip 4y ago
  For one thing, a password is a string of characters that you and I carry around in our heads. At least they were, until complexity requirements, forced expiration, and proliferation of accounts caused us to rely more on password managers than our memories. However, the platonic ideal of a password is one that you remember: "Something You Know". Therefore, it is usable at the library, it is usable in the hospital after your ambulance transport, it is usable when you're stranded in Portugal and borrowing someone's phone at the U.S. Embassy in Lisbon. Passwords are not something that can just drop out of your pocket, or be "stolen" from you, in the sense of depriving you of that knowledge. "Passwordless auth" comes to rely on devices. MFA did this to us first, of course, where SMS codes come through our phone, which is now mandatory, or come off our Yubikeys or Google Authenticator, which in turn depend on a computing device. "Passwordless auth" is always tied to a device of some kind. Therefore, passwordless auth is something that can easily fail or be taken away from us. How easy is it to lose your phone? What are the chances you'll need to sign in to, say, Apple, to retrieve a contact's phone number, and all you have is your brain connected to your fingers? Your passwordless auth is now useless. So yeah, it's great from a technerd perspective, where we have lots of devices, always a backup, plenty of cash to replace them, disaster plans in place, etc. Passwordless auth (and MFA along with it) isn't so attractive when you're addicted to heroin, mentally ill, homeless and living on the streets, and you're trying to sign in at a library computer so that you can apply for SNAP benefits, Medicaid, and Section 8 housing assistance.
- _8j50 4y ago
  It is inferior to multi-factor authentication. It sounds fancy but you are removing a layer of security for no reason other than it's trendy and hyped up! Good security is application of layers of defenses in a disciplined and consistent way. I should not be able to steal a yubikey or find one flaw in your passwordless credential reset method or abuse the next and greatest phishing method like in-browser vnc with webusb and that's all I need to take over an account. Let me clarify: the problem is removal of "what you know" as a layer of defense and a factor of authentication. I don't care if it is a password, passphrase, pin, puzzle, picture or whatever, without it having only one factor of authentication is remarkably inferior to MFA. And this is detrimental to 10-15+ years of security culture improvements all because vendors and clueless c-suite execs prefer to follow trends instead of listening to actual security professionals.
HyperSane 4y ago
Zerotrust makes perfect sense. It takes the default deny firewall policy and applies it to every host. Entities can only communicate after proving their identities to each other and every single packet is authenticated. When done correctly every host could be completely open to the internet without any security issues.
- CKMo 4y ago
  That's one of the ways I like to think about it. When you have zero trust, you can comfortably expose any app to the internet. If you can't comfortably expose your app to the internet, you probably don't have zero trust. The problem is, "exposed to the internet" is pretty much how most things are today, in a world where everything is trying to be "smart." There is a pathway to most assets and resources and that's what causes breaches. So all services and resources should be assumed as "exposed" until proven otherwise, therefore all infrastructure (and development) should apply zero trust principles.
- _8j50 4y ago
  Did you read my comment? I agree with that part. That isn't what people are doing.
- deleted 4y ago
  [deleted]

by _8j50 4y ago

cscheueuer 4y ago

What is the easiest way to implement the original beyondcorp architecture without spending multiple months building a solution in house?

jupp0r 4y ago
If you already have authentication and authorization in front of every service in your internal network (unlikely), it's as easy as making everything routable from the internet. If not (more likely) you need to start there, which will improve your security posture incrementally, even if the beyondcorp project gets cancelled along the way.
- adobrawy 4y ago
  I will add that in the case of authentication before each service, it is important that it does not happen in the application itself, but before reaching it, which usually means either network centralization (e.g. Teleport) or authentication proxy (Traefik + forward auth + proxy, GCP identity-proxy, AWS Verified Access). It is also important to centralize the identity provider, of course, which in the times of SAML / OAuth is easily achievable even for small organizations.

eikenberry 4y ago

Isn't this basically true of every tech idea once it hits the enterprise? Agile is the usual whipping boy paraded when discussions of enterprise ruining something but it seems just true in general. As a problem I think this mostly boils down to technical decisions being made by non-technical people. Like many articles about Zero-Trust (some easy examples here in the comments) come out of the gate talking about AuthN, which is inherently about trust, they just don't seem to get it.

deleted 4y ago
[deleted]

deleted 4y ago

[deleted]

tinglymintyfrsh 4y ago

I don't know what "zerotrust" is supposed to mean. Maybe they're stretching the meaning of zero knowledge constructions. "Zero knowledge" should mean "the service provider never keeps logs, data, metadata, or secrets in the clear that can be retrieved without user intervention, preferably not knowing anything about any particular user." MEGA is partially this. "Passwordless" isn't terrible if it means "use a physical device or TPM-stored secret instead of a password". It shouldn't replace 2FA by having 2 actual factors.

pclmulqdq 4y ago
From a more cynical point of view, "zero-trust" tends to mean something along the lines of: "trust a TPM on the user side... and all of my server logic and my cloud provider." From a less cynical point of view it means "hold all the client's keys in their TPM and only authenticate on the server side, but don't decrypt (or otherwise pass keys around)"
- matthewaveryusa 4y ago
  zero trust at its core means authentication and authorization at each service, for each request. at a high level it means not trusting a connection from another service in the same network just because it’s on the same network. rooting trust to tpms is orthogonal but certainly the right way to root trust. The space where I think zero trust is the most interesting are vpns like tailscale/wireguard/microsegmentation that flip the status quo around and say the network is the identity/authoritzed group
  - pclmulqdq 4y ago
    Wait, but I thought everyone was doing that anyway prior to the "zero trust" thing. The difference was who you trusted to hold user (and concern-specific) keys - before zero trust, it was your server, and afterward, it's the user. Authentication and authorization for internal services is kind of basic.
    - 4y ago

flangola7 4y ago

> Another cancer that is begining to spread:"passwordless". I have got to hear your problems with it! As I see it passwordless will eliminate whole families of attack methods. Lookalike credential phishing pages made obsolete. I wish we had started using it years ago. What are the downsides?

NoZebra120vClip 4y ago
For one thing, a password is a string of characters that you and I carry around in our heads. At least they were, until complexity requirements, forced expiration, and proliferation of accounts caused us to rely more on password managers than our memories. However, the platonic ideal of a password is one that you remember: "Something You Know". Therefore, it is usable at the library, it is usable in the hospital after your ambulance transport, it is usable when you're stranded in Portugal and borrowing someone's phone at the U.S. Embassy in Lisbon. Passwords are not something that can just drop out of your pocket, or be "stolen" from you, in the sense of depriving you of that knowledge. "Passwordless auth" comes to rely on devices. MFA did this to us first, of course, where SMS codes come through our phone, which is now mandatory, or come off our Yubikeys or Google Authenticator, which in turn depend on a computing device. "Passwordless auth" is always tied to a device of some kind. Therefore, passwordless auth is something that can easily fail or be taken away from us. How easy is it to lose your phone? What are the chances you'll need to sign in to, say, Apple, to retrieve a contact's phone number, and all you have is your brain connected to your fingers? Your passwordless auth is now useless. So yeah, it's great from a technerd perspective, where we have lots of devices, always a backup, plenty of cash to replace them, disaster plans in place, etc. Passwordless auth (and MFA along with it) isn't so attractive when you're addicted to heroin, mentally ill, homeless and living on the streets, and you're trying to sign in at a library computer so that you can apply for SNAP benefits, Medicaid, and Section 8 housing assistance.
_8j50 4y ago
It is inferior to multi-factor authentication. It sounds fancy but you are removing a layer of security for no reason other than it's trendy and hyped up! Good security is application of layers of defenses in a disciplined and consistent way. I should not be able to steal a yubikey or find one flaw in your passwordless credential reset method or abuse the next and greatest phishing method like in-browser vnc with webusb and that's all I need to take over an account. Let me clarify: the problem is removal of "what you know" as a layer of defense and a factor of authentication. I don't care if it is a password, passphrase, pin, puzzle, picture or whatever, without it having only one factor of authentication is remarkably inferior to MFA. And this is detrimental to 10-15+ years of security culture improvements all because vendors and clueless c-suite execs prefer to follow trends instead of listening to actual security professionals.

HyperSane 4y ago

Zerotrust makes perfect sense. It takes the default deny firewall policy and applies it to every host. Entities can only communicate after proving their identities to each other and every single packet is authenticated. When done correctly every host could be completely open to the internet without any security issues.

CKMo 4y ago
That's one of the ways I like to think about it. When you have zero trust, you can comfortably expose any app to the internet. If you can't comfortably expose your app to the internet, you probably don't have zero trust. The problem is, "exposed to the internet" is pretty much how most things are today, in a world where everything is trying to be "smart." There is a pathway to most assets and resources and that's what causes breaches. So all services and resources should be assumed as "exposed" until proven otherwise, therefore all infrastructure (and development) should apply zero trust principles.
_8j50 4y ago
Did you read my comment? I agree with that part. That isn't what people are doing.
deleted 4y ago
[deleted]