News for hackers. Stuff that matters.

A comment on Who’s behind Wednesday’s epic Twitter hack?. Parent comment

Re:Who’s behind Wednesday’s epic Twitter hack? by hnzix on Friday July 17, 2020 @12:01AM (#23866856)
Exactly, assume zero trust but VPN with MFA provides another layer of security. Given the weekly volume of package vulns Github notifies me about I don't want to miss a 0day and get scanned. Perimeterless is fine if you're only using SaaS or you have an army of SecOps, but I don't want an internal app rumbled.
[ Parent | on HN ]
Re:Who’s behind Wednesday’s epic Twitter hack? by VectorLock on Friday July 17, 2020 @01:57AM (#23867517)
Is a VPN a suitable replacement for good security hygiene and vulnerability management?
[ Parent | on HN ]
Re:Who’s behind Wednesday’s epic Twitter hack? by hnzix on Friday July 17, 2020 @02:03AM (#23867565)
Nobody is saying VPN is a replacement. Users should still have to authenticate against an IDP once they're inside the perimeter. VPN + MFA protects apps from drive-by attacks while they're waiting to be patched.

Yes, in a perfect world everyone would have an army of SecOps ninjas pentesting and patching all systems 24/7, but this is the Real World™

Defence in depth.

[ Parent | on HN ]