I read the federal government’s Zero-Trust Memo so you don’t have to

Re:I read the federal government’s Zero-Trust Memo so you do... by SecurityLagoon on Thursday January 27, 2022 @02:17PM (#30104873)

Thanks for saying this. This was exactly my take. Saying goodbye to VPNs just completely ignores the risk of RCE vulnerabilities on your services. You can have a VPN that still brings you into a zero trust network.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by tptacek on Thursday January 27, 2022 @02:21PM (#30104924)

It does essentially define away the authentication bypass problem, which is a class of vulnerability we still regularly find in modern web applications. To say nothing of the fact that no human has ever implemented a SAML RP without a game-over vulnerability. Seems like a self-evidently bad plan.

[ Parent | on HN ]