I read the federal government’s Zero-Trust Memo so you don’t have to

Re:I read the federal government’s Zero-Trust Memo so you do... by dragonwriter on Thursday January 27, 2022 @04:37PM (#30107106)

SHOULD NOT and MUST NOT are very different from a compliance perspective.

The former usually means something between nothing at all and “you can do it but you have to write paperwork that no one will actually read in detail, but someone will maybe check the existence of, if you do”.

The latter means “do it and you are noncompliant”.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by dllthomas on Thursday January 27, 2022 @04:59PM (#30107391)

https://datatracker.ietf.org/doc/html/rfc2119 is a good reference, although those precise definitions may or many not be in effect in any particular situation (including this one).

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by gkop on Thursday January 27, 2022 @06:52PM (#30108778)

Thanks for pointing out the improvement over NIST, it wasn’t clear to me. But did you mean to reply to my parent? Both the draft and the current language say SHOULD NOT. I’d rather “must”, but will settle for “should”; the NIST docs have certainly made my work easier. Hopefully NIST improves, and perhaps this memo will help!

The essential purpose of my comment was only to correct my parent on the date.

[ Parent | on HN ]