5 ms·

Given the number of corporate networks that I've worked I've found this pattern: Jump/Bastion servers everywhere, with the ability to "get work done" (via scp,

Given the number of corporate networks that I've worked I've found this pattern: Jump/Bastion servers everywhere, with the ability to "get work done" (via scp, and restricted SSH options) severely limited. That with VLANs lets' the PHB and 'Cyber insurance' people checkbox that "yes we are secure". Everybody can `sudo su` with no restrictions and no additional password/2FA. Boxes on internal network can't access the internet (outgoing comms blocked). While this is handy during general usage, during setup for a 'TESTING' environment that might require 100 ruby/gems and 3rd party files to be installed, it's a royal pain in the ass. I could easily breakout with SSH tunnels, but I'm trying to respect the client wishes. It makes the job 1000x unnecessarily difficult. Penny wise and pound foolish. So they give lip service. OH, and all passwords are a variation on 123_$CORPNAME, $CORPNAME123, and abc$CORPNAME123.

edrxty 3y ago
Lemme guess. Aerospace/defense? This is the usual strategy to satisfy defense procurement regulations regarding IT security. Also the reason nothing ever gets done.
sdflhasjd 3y ago
> I'm trying to respect the client wishes More patience than me haha, I remember the last project like that I was on with a small group of contractors - we spent the half of the first few weeks working around all these theatrical limits. We had an HTTP Proxy that could run over RDP. Fortunately nobody was really looking (or caring).
entuno 3y ago
Bastions seem to be something that a lot of organisations really don't understand. They feel that they need to have them for "security" or to tick some kind of compliance box, but haven't really thought about how to configure them, how to design the network or even what they're trying to achieve by having them.
- Zetobal 3y ago
  Working for some pretty big automotive clients I can tell you we implemented a bastion just to tick of a checkbox.

edrxty 3y ago

Lemme guess. Aerospace/defense? This is the usual strategy to satisfy defense procurement regulations regarding IT security. Also the reason nothing ever gets done.

sdflhasjd 3y ago

> I'm trying to respect the client wishes More patience than me haha, I remember the last project like that I was on with a small group of contractors - we spent the half of the first few weeks working around all these theatrical limits. We had an HTTP Proxy that could run over RDP. Fortunately nobody was really looking (or caring).

entuno 3y ago

Bastions seem to be something that a lot of organisations really don't understand. They feel that they need to have them for "security" or to tick some kind of compliance box, but haven't really thought about how to configure them, how to design the network or even what they're trying to achieve by having them.

Zetobal 3y ago
Working for some pretty big automotive clients I can tell you we implemented a bastion just to tick of a checkbox.