Re:Zero Trust Architecture doesn't solve all problems, but p...
by lmm on Friday April 01, 2022 @05:54AM
(#30876600)
> Every time I hear about ZTA they start with this straw man of restricted internal networks. There where never a time when admins relied only on restricted physical network access or VPN.
I assure you I've connected to more than one real-world network where the admins absolutely did rely on that.
> Why would you eliminate a split VPN though? Software has bugs, why would you expose the proxy or some app for automated scanners and exploiters on the internet? You can have both! You can have a locked building door and a locked apartment door. Of course relying on the building door is not enough but why would you eliminate it? How could that improve security?
If you put a weakly secured porch on the front of your building, it's easier for someone to take their time breaking into the main lock, and people are more likely to forget to lock the main door.
Most vulnerabilities come from either writing code in C or mixing up authorized and unauthorized users. So it's really important to have a simple and understandable authorization model. Weak security layers do more harm than good, because they make mistakes more likely.
I assure you I've connected to more than one real-world network where the admins absolutely did rely on that.
> Why would you eliminate a split VPN though? Software has bugs, why would you expose the proxy or some app for automated scanners and exploiters on the internet? You can have both! You can have a locked building door and a locked apartment door. Of course relying on the building door is not enough but why would you eliminate it? How could that improve security?
If you put a weakly secured porch on the front of your building, it's easier for someone to take their time breaking into the main lock, and people are more likely to forget to lock the main door.
Most vulnerabilities come from either writing code in C or mixing up authorized and unauthorized users. So it's really important to have a simple and understandable authorization model. Weak security layers do more harm than good, because they make mistakes more likely.