News for hackers. Stuff that matters.

A comment on Implementing a Zero Trust Architecture. Parent comment

Re:Implementing a Zero Trust Architecture by happyopossum on Tuesday August 09, 2022 @06:47PM (#32405572)
Err, no - the strongest zero trust approaches never let you “on the network” - authorized or not.

They are designed to connect you to an application, you should never see the network.

[ Parent | on HN ]
Re:Implementing a Zero Trust Architecture by gz5 on Tuesday August 09, 2022 @07:09PM (#32405813)
yeah, agree, 'on the network' is a bad phrase. long form:

completely 'eliminate' the network by closing all inbound firewall ports (not even allowing dynamic hole punching), and then opening ephemeral, session-specific L3 outbound connects (from both sides* of the session) only for authorized sessions (strong auth - not IP-address based auth).

* requires intermediate 'gateways' which can bridge both sides to enable bidirectional data flow, initiated from either side

[ Parent | on HN ]