3 ms·
They mention Zero Trust, yet you can gain access to applications with just a single bearer token? Am I missing something here? There’s no machine cert used? A
by wepple 3y ago
They mention Zero Trust, yet you can gain access to applications with just a single bearer token?
Am I missing something here?
There’s no machine cert used? AuthN tokens aren’t cryptographically bound?
This doesn’t meet my definition of ZT, it seems more like “we don’t have a VPN”
- _cenw 3y agothese were service accounts used by third parties to provide jira integrations, not a user account
- Bluecobra 3y agoIf they are using Active Directory, wouldn’t a service account be no different than a regular employee account? Both a Jira service account and the CEO of Cloudflare are still Domain Users in AD. Granted, a service account should be way more locked down and have the least amount of access possible.
- _cenw 3y agohttps://developers.cloudflare.com/cloudflare-one/identity/service-tokens/ https://developers.cloudflare.com/cloudflare-one/identity/se...
- Bluecobra 3y agoYeah it seems odd to me that their internal wiki, code repo, and Jira is exposed directly to the internet and arbitrary IPs could connect to it. Atlassian had a rash of vulnerabilities recently, who knows how many undiscovered ones still exist. If they had a VPN in place secured with machine certs, that would be yet another layer for an attacker to defeat.
- prg20 3y agoYou're not. The article makes no sense. They claim robust security controls but apparely lacked a proper accounting of service accounts with external access, especially with admin access to freakin' Jira.
- Bluecobra 3y agoThank you! The more I think about his it makes no sense to me. If a service account needs external access why can't they also whitelist connectivity to specific public IP addresses?