3 ms·
Wait, but I thought everyone was doing that anyway prior to the "zero trust" thing. The difference was who you trusted to hold user (and concern-specific) keys
by pclmulqdq 4y ago
Wait, but I thought everyone was doing that anyway prior to the "zero trust" thing. The difference was who you trusted to hold user (and concern-specific) keys - before zero trust, it was your server, and afterward, it's the user.
Authentication and authorization for internal services is kind of basic.
- PeterisP 4y ago> I thought everyone was doing that anyway prior to the "zero trust" thing. Nope, lots and lots of organizations who have a zillion of internal services which they know to be insecure but are kept that way because they "are accessible only on the protected network".