3 ms·

Both of the following can be true simultaneously: 1. The term "defense in depth" can be popularly abused by irresponsible people looking to pass the buck on se

by kibwen 2y ago

Both of the following can be true simultaneously: 1. The term "defense in depth" can be popularly abused by irresponsible people looking to pass the buck on security. 2. An application that is intended to withstand being exposed to the public internet becomes strictly more secure when it isn't exposed to the public internet. I can buy that the government contractors who fall into the former category are sufficiently numerous and sufficiently gormless that this memo is intended to be used as a weapon to drag them kicking and screaming towards default-secure applications. But for people who are already responsible enough that they're doing the right thing, keep using a VPN. Redundancy is resiliency.

ethbr1 2y ago
The problem is you can't simultaneously say "secure things via network access" AND "ensure everything has strong auth" -- invariably that collapses to the easier/cheaper of the two. So the superior realpolitik approach is to mandate the latter and remain silent about the former. Best case, they'll do both. Worst case, at least now they do the important one.
tptacek 2y ago
The idea behind the OMBZT memo is that, in the OMB's setting, concealing applications with VPNs made them less secure: at a large enough scale, it becomes inevitable that an attacker in any threat model is going to get on the other side of the VPN. One reason half the industry nodded along with that observation is that anyone who's ever done a site-wide pentest knows that the pentest is about to go explosively game-over as soon as someone finds an SSRF and pivots into the perimeter. People contract out "internal" pentests, where attackers start with a VPN connection, but they only do it to make a point to management: "we're fucked". People on message boards massively overindex on the "VPN" term in the memo. You can readily do a BeyondTrust-style individually-authenticated security architecture using VPN technology. The underlying theme is 1:1 user:app authentication.

by kibwen 2y ago

ethbr1 2y ago

The problem is you can't simultaneously say "secure things via network access" AND "ensure everything has strong auth" -- invariably that collapses to the easier/cheaper of the two. So the superior realpolitik approach is to mandate the latter and remain silent about the former. Best case, they'll do both. Worst case, at least now they do the important one.

tptacek 2y ago

The idea behind the OMBZT memo is that, in the OMB's setting, concealing applications with VPNs made them less secure: at a large enough scale, it becomes inevitable that an attacker in any threat model is going to get on the other side of the VPN. One reason half the industry nodded along with that observation is that anyone who's ever done a site-wide pentest knows that the pentest is about to go explosively game-over as soon as someone finds an SSRF and pivots into the perimeter. People contract out "internal" pentests, where attackers start with a VPN connection, but they only do it to make a point to management: "we're fucked". People on message boards massively overindex on the "VPN" term in the memo. You can readily do a BeyondTrust-style individually-authenticated security architecture using VPN technology. The underlying theme is 1:1 user:app authentication.