5 ms·

Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lo

Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed. So you don't do that. You use zero trust and don't care that things are exposed to the internet. Working from anywhere (remote sites, home, your phone) is a huge benefit. Organizations want to control their data entirely while still wanting their organization to be able to access it.

anonymars 1y ago
Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!
- zamadatix 1y ago
  In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).
  - anonymars 1y ago
    So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?
    - hug 1y ago
      Yes, that's zero trust in a nutshell: A VPN that does a tunnel per TCP connection instead of one tunnel for all TCP connections. The other salient point is that all connections are established outbound through a broker, and importantly this is the case from both sides: The appliance at the terminating end of the tunnel establishes reverse tunnels to the broker for the connections, so it's never "exposed to the internet". The broker can then push to your SIEM or whatever so you can have your SOC log jockeys harass your employees for accidentally leaving NordVPN on after watching international sports. There are actual benefits: You can do things like allow logins to system A from anywhere, but system B only from your home country, you can do JIT network access requests, etc... but mostly it's vendor marketing to get you to spend too much money.
      - esseph 1y ago
        (Not just TCP)
    - baby_souffle 1y ago
      At a high level, yeah. They can be implemented using a variety of technical patterns but they all share a common "each request is authenticated, encrypted" property instead of "anything goes once the tunnel is up" property.
      - pmontra 1y ago
        HTTPS calls with any kind of authentication (cookies, tokens, even basic auth) are one way to be "authenticated, encrypted" for "each request". If they go to a reverse proxy at the entrance of a company network (a common setup for every internet facing http server) they are a way to do without a VPN. And yet every customer of mine have some of their servers on a VPN. At the very least they enable ssh only on ports on the private network.
    - zamadatix 1y ago
      Something I'll add to the other responses is "the network" isn't an assumption of zero trust. Whether it's a single server on the private corporate network or a multi-cloud multi-region service hosted on the internet zero trust treats them the same. My way of mapping it to VPN mindset is "per app clientless VPNs straight to where the things are hosted". In an extremely open ruleset with all of the servers on a corporate network this could theoretically devolve into "a traditional clientless VPN to the office".
  - BobbyTables2 1y ago
    Makes “zero trust” sound like basic username/password from ancient times.
    - tjohns 1y ago
      Think machine certs (stored in a TPM). Plus perimeter-enforced username/password/2FA. Plus additional policy checks, like making sure your machine is up to date on security patches. It doesn’t matter what network you are connecting from, but it does matter that you’re connecting from a company-issued laptop that’s in a trustworthy state.
      - rockskon 1y ago
        Sounds like multiple single points of failure to make a security infrastructure so hostile to the end user it would be considered the equivalent of being under persistent attack.
      - mike_hearn 1y ago
        VPN products do all of that.
        tjohns 1y ago
        They absolutely do, that’s fair. The big difference is once you’re in, with a VPN you have direct access to the whole network. With a zero trust setup, access has to be granted to you (or your ACL group) on a per-application basis. It makes it much harder for an attacker to move laterally when everything is default-deny.
        mike_hearn 1y ago
        But you can combine VPNs with SSO and limited permissions. Real networks all work that way these days. Logging into the VPN doesn't get you very far, you'll need to be provisioned with specific apps and permissions too.
  - this_steve_j 1y ago
    That’s my understanding. In a pure implementation, the same level of trust is implied (absolutely none at all) whether a device is connecting to a resource from the public internet or the same subnet.
- michaelt 1y ago
  Arainach is advocating for something called "Zero Trust" which, from a user's perspective, is very much like a VPN. It's software your employer pre-installs on your work PC, that asks you to log in with your work SSO credentials, performs some endpoint security checks, then routes your traffic over a virtual network adapter, and thereby allows you to access workplace resources, even when working from home. The main difference is it adds some semi-authenticated states. Correct device, username, password, and 2FA, but failed a device posture check because they plugged their phone into their laptop to charge it? The 'Zero Trust' system can block some systems, while letting them retain access to others. The other big difference is the pricing - rather than paying a five-figure sum upfront for networking hardware, you instead pay $25 per employee per month, forever.
  - xxpor 1y ago
    >then routes your traffic over a virtual network adapter this is not a requirement of zero trust.
- nine_k 1y ago
  Zero trust is when every session with every service is like its own VPN, independently authenticated and encrypted. Consider the way an HTTPS session between a server and a browser is created anew every time the browser accesses a domain, and ends after a short flurry of requests needed to load a page.
  - BobbyTables2 1y ago
    Almost sounds like “zero trust” is classic HTTPS authentication with extra marketing added…
    - anonymars 1y ago
      There's a significant difference which my original message hints at and is subsequently clarified: there's still an intermediary. If there's an exploit in the service, like this case, it's still not directly exposed. The intermediary device is still sitting in between and won't allow any old traffic through without separate authorization
this_steve_j 1y ago
Microsoft’s version of “Zero Trust” doesn’t care if things are reachable from the public internet. They have been preaching “identity is the new perimeter” [1] for years, and it doesn’t wash. The NIST Zero Trust Architecture (ZTA) implementation guides (SP 1800-35) [2] cut through the nonsense and AI generated marketing smoke. In ZTA, ALL network locations are untrusted. Network connections are created by a Policy Engine that creates and tears down tunnels to each resource dynamically using attribute-based-access-controls (ABAC). Per request. Microsoft doesn’t have any products that can do full ZTA, so several pillars are missing from their “Zero Trust” marketing materials. [1] https://www.microsoft.com/insidetrack/blog/securing-the-borderless-enterprise-how-were-using-ai-to-reinvent-our-network-security/ https://www.microsoft.com/insidetrack/blog/securing-the-bord... [2] https://doi.org/10.6028/NIST.SP.1800-35 https://doi.org/10.6028/NIST.SP.1800-35
- tacticus 1y ago
  > several pillars are missing from their “Zero Trust” marketing materials. TBH several pillars are missing from their entire security posture.
  - Tokumei-no-hito 1y ago
    why bother when not a single vulnerability has resulted in any appreciable fines or loss of market share? it's absurd how untouchable their ubiquity has become.
    - sneak 1y ago
      They’re the Boeing of software. They go down with the ship, but, critically, it means they also can’t go down until and unless the ship also does. It’s a symbiotic relationship that allows them to stop having to spend resources to compete in the market on merit.
      - realusername 1y ago
        That's pretty accurate, if you want modern practice and product quality you go to Google or Amazon, if you want compliance and reassuring the board, you go to Microsoft.

anonymars 1y ago

Maybe I'm missing something but doesn't this very story cut your assertion off at the knees? With a VPN the attack surface of this vulnerability would have been miniscule compared to a publicly accessible zero-day RCE (And it's not like you have to allow carte-blanche access behind the wall) Defense in depth!

zamadatix 1y ago
In zero trust "exposed to the internet" is a bit of a misnomer compared to how traditional security would use the term. A better description might be "you're allowed to form a session to it from over the internet but only after your identity and set of rights have been verified". From this view: "zero trust" < "vpn" < "wide open" (in terms of exposure).
- anonymars 1y ago
  So it's essentially a more seamless and granular analog of a VPN? A device sits in front of the network and requires some sort of authenticated handshake (ideally all SSO) before passing packets through to a target endpoint?
  - hug 1y ago
    Yes, that's zero trust in a nutshell: A VPN that does a tunnel per TCP connection instead of one tunnel for all TCP connections. The other salient point is that all connections are established outbound through a broker, and importantly this is the case from both sides: The appliance at the terminating end of the tunnel establishes reverse tunnels to the broker for the connections, so it's never "exposed to the internet". The broker can then push to your SIEM or whatever so you can have your SOC log jockeys harass your employees for accidentally leaving NordVPN on after watching international sports. There are actual benefits: You can do things like allow logins to system A from anywhere, but system B only from your home country, you can do JIT network access requests, etc... but mostly it's vendor marketing to get you to spend too much money.
    - esseph 1y ago
      (Not just TCP)
  - baby_souffle 1y ago
    At a high level, yeah. They can be implemented using a variety of technical patterns but they all share a common "each request is authenticated, encrypted" property instead of "anything goes once the tunnel is up" property.
    - pmontra 1y ago
      HTTPS calls with any kind of authentication (cookies, tokens, even basic auth) are one way to be "authenticated, encrypted" for "each request". If they go to a reverse proxy at the entrance of a company network (a common setup for every internet facing http server) they are a way to do without a VPN. And yet every customer of mine have some of their servers on a VPN. At the very least they enable ssh only on ports on the private network.
  - zamadatix 1y ago
    Something I'll add to the other responses is "the network" isn't an assumption of zero trust. Whether it's a single server on the private corporate network or a multi-cloud multi-region service hosted on the internet zero trust treats them the same. My way of mapping it to VPN mindset is "per app clientless VPNs straight to where the things are hosted". In an extremely open ruleset with all of the servers on a corporate network this could theoretically devolve into "a traditional clientless VPN to the office".
- BobbyTables2 1y ago
  Makes “zero trust” sound like basic username/password from ancient times.
  - tjohns 1y ago
    Think machine certs (stored in a TPM). Plus perimeter-enforced username/password/2FA. Plus additional policy checks, like making sure your machine is up to date on security patches. It doesn’t matter what network you are connecting from, but it does matter that you’re connecting from a company-issued laptop that’s in a trustworthy state.
    - rockskon 1y ago
      Sounds like multiple single points of failure to make a security infrastructure so hostile to the end user it would be considered the equivalent of being under persistent attack.
    - mike_hearn 1y ago
      VPN products do all of that.
      - tjohns 1y ago
        They absolutely do, that’s fair. The big difference is once you’re in, with a VPN you have direct access to the whole network. With a zero trust setup, access has to be granted to you (or your ACL group) on a per-application basis. It makes it much harder for an attacker to move laterally when everything is default-deny.
        mike_hearn 1y ago
        But you can combine VPNs with SSO and limited permissions. Real networks all work that way these days. Logging into the VPN doesn't get you very far, you'll need to be provisioned with specific apps and permissions too.
- this_steve_j 1y ago
  That’s my understanding. In a pure implementation, the same level of trust is implied (absolutely none at all) whether a device is connecting to a resource from the public internet or the same subnet.
michaelt 1y ago
Arainach is advocating for something called "Zero Trust" which, from a user's perspective, is very much like a VPN. It's software your employer pre-installs on your work PC, that asks you to log in with your work SSO credentials, performs some endpoint security checks, then routes your traffic over a virtual network adapter, and thereby allows you to access workplace resources, even when working from home. The main difference is it adds some semi-authenticated states. Correct device, username, password, and 2FA, but failed a device posture check because they plugged their phone into their laptop to charge it? The 'Zero Trust' system can block some systems, while letting them retain access to others. The other big difference is the pricing - rather than paying a five-figure sum upfront for networking hardware, you instead pay $25 per employee per month, forever.
- xxpor 1y ago
  >then routes your traffic over a virtual network adapter this is not a requirement of zero trust.
nine_k 1y ago
Zero trust is when every session with every service is like its own VPN, independently authenticated and encrypted. Consider the way an HTTPS session between a server and a browser is created anew every time the browser accesses a domain, and ends after a short flurry of requests needed to load a page.
- BobbyTables2 1y ago
  Almost sounds like “zero trust” is classic HTTPS authentication with extra marketing added…
  - anonymars 1y ago
    There's a significant difference which my original message hints at and is subsequently clarified: there's still an intermediary. If there's an exploit in the service, like this case, it's still not directly exposed. The intermediary device is still sitting in between and won't allow any old traffic through without separate authorization

this_steve_j 1y ago

Microsoft’s version of “Zero Trust” doesn’t care if things are reachable from the public internet. They have been preaching “identity is the new perimeter” [1] for years, and it doesn’t wash. The NIST Zero Trust Architecture (ZTA) implementation guides (SP 1800-35) [2] cut through the nonsense and AI generated marketing smoke. In ZTA, ALL network locations are untrusted. Network connections are created by a Policy Engine that creates and tears down tunnels to each resource dynamically using attribute-based-access-controls (ABAC). Per request. Microsoft doesn’t have any products that can do full ZTA, so several pillars are missing from their “Zero Trust” marketing materials. [1] https://www.microsoft.com/insidetrack/blog/securing-the-borderless-enterprise-how-were-using-ai-to-reinvent-our-network-security/ https://www.microsoft.com/insidetrack/blog/securing-the-bord... [2] https://doi.org/10.6028/NIST.SP.1800-35 https://doi.org/10.6028/NIST.SP.1800-35

tacticus 1y ago
> several pillars are missing from their “Zero Trust” marketing materials. TBH several pillars are missing from their entire security posture.
- Tokumei-no-hito 1y ago
  why bother when not a single vulnerability has resulted in any appreciable fines or loss of market share? it's absurd how untouchable their ubiquity has become.
  - sneak 1y ago
    They’re the Boeing of software. They go down with the ship, but, critically, it means they also can’t go down until and unless the ship also does. It’s a symbiotic relationship that allows them to stop having to spend resources to compete in the market on merit.
    - realusername 1y ago
      That's pretty accurate, if you want modern practice and product quality you go to Google or Amazon, if you want compliance and reassuring the board, you go to Microsoft.