4 ms·
This is a fairly common recommendation for "zero trust." A VPN is theoretically superfluous in a zero trust environment, where you have no concept of a trusted
by brendoelfrendo 2y ago
This is a fairly common recommendation for "zero trust." A VPN is theoretically superfluous in a zero trust environment, where you have no concept of a trusted network and your applications should be sufficiently hardened to prevent unauthorized access. Google operates this way, if I recall correctly. It's how their "Beyond Corp" white-paper recommends setting up the environment.
It's not exactly a "one size fits all" solution; I believe PCI requires VPN usage, for example, so a bank trying to implement zero trust practices would need to keep their VPN intact, but that's a regulatory concern, not so much a technical one.
- dataflow 2y ago> A VPN is theoretically superfluous in a zero trust environment, where you have no concept of a trusted network and your applications should be sufficiently hardened to prevent unauthorized access. Defense in depth is theoretically superfluous in a secure system, but it's still a good idea for... what I thought were obvious reasons. I don't see how this is any different. And, again, as I mentioned above this isn't even just about network trust, it's also about the ability to monitor, audit, and intercept potentially malicious connections when something does get compromised. "We assume our one layer of security will work perfectly" cannot be the starting assumption... > Google operates this way, if I recall correctly. Google also has 24/7 world-class security teams monitoring everything across the planet. They have a ton of power to monitor and mitigate damage across the entire internet. Just because something works for Google that doesn't mean it'll work for arbitrary organizations.
- tptacek 2y agoYes. This is the right way to think about the OMB memo. Good thoughts, which may or may not apply to your organization.