I read the federal government’s Zero-Trust Memo so you don’t have to

Re:I read the federal government’s Zero-Trust Memo so you do... by mjg59 on Friday January 28, 2022 @02:01AM (#30111498)

Most SSO solutions don't verify device identity or state, so you're not ensuring that the connection is coming from a computer you trust running software you trust.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by xyzzy_plugh on Friday January 28, 2022 @03:42AM (#30112189)

I guess it's a matter of what the IdP attests. It's definitely possible for an IdP like Okta to include a ton of client details as part of the attestation payload. Stuff like GeoIP, client certificate fields, MDM status, etc.

[ Parent | on HN ]

Re:I read the federal government’s Zero-Trust Memo so you do... by tptacek on Friday January 28, 2022 @10:36AM (#30115912)

Right, but you have to individually set up all of your apps to work with it; the proxy can be mandatory for all apps by dint of network controls.

[ Parent | on HN ]