4 ms·
If org uses zero-trust this is not vulnarabity at all. The fact that you can run something on a employees dev machine does not mean a lot. That is the entire po
by tlogan 4y ago
If org uses zero-trust this is not vulnarabity at all. The fact that you can run something on a employees dev machine does not mean a lot. That is the entire point of zero-trust.
- ptx 4y agoSurely the dev machine must somehow interact with Google's systems at some point? Even if every interaction requires 2FA, malware with access to the user's Windows/X11 session could intercept user input, modify requests, steal session tokens, etc.
- tlogan 4y agoI'm not familiar with Google dev process. But I have extensive experience working in large corporations. In such environments, it is crucial to maintain a high level of isolation between development machines, personal computers, test farms, production servers, and source code repositories. Also there are various types of development machines and environments to cater to different needs. Some are highly restricted, only allowing developers to interact with and modify the production source code. These environments provide minimal functionality beyond code editing and submitting changes to test farm. On the other hand, there are more flexible environments, akin to "scratch pads," where developers have greater freedom to experiment and explore.