4 ms·
An attacker who gets username/pw still can't get on the overlay network (the overlay requires credentials which can't easily be stolen or compromised, e.g. a pr
by gz5 2y ago
An attacker who gets username/pw still can't get on the overlay network (the overlay requires credentials which can't easily be stolen or compromised, e.g. a private key signed X.509 certificate).
Yes, because 99% of attacks use the underlay network to access the target and exfiltrate the data. Said the other way, an attacker didn't physically walk into a Snowflake data center, console into the right server, and walk out with all the data.
- Aloisius 2y agoThat sounds more like the lack of certificate-based authentication (or some other stronger authentication method) was the problem, not the lack of a private overlay network. After all, plenty of private overlay networks use simple username/password auth or no auth at all.
- gz5 2y agoAgree, good point, the overlay needs to do strong identity, authN, authZ. The critical part the overlay adds to traditional auth is making the server unreachable from the underlay networks, reducing attack surface by billions. Meaning: + Let's say the server did have good auth, but there was a bug, misconfig, zero day, etc. (one of the myriads of proximate causes). + Since the server is available on the underlay network, that vulnerability can be exploited by anyone on the underlay (billions Internet nodes). + In contrast, making the server only available on the overlay, reduces the attack surface from billions of Internet nodes to the nodes which can ID, authN and authZ (for that particular server) on the overlay.