Re:Implementing a Zero Trust Architecture
by judge2020 on Tuesday August 09, 2022 @11:56PM
(#32407694)
I think they meant that software is 'what the identity should gain access to', and you 'should not grant that identity access to networks'; it is worded a bit confusingly.
Re:Implementing a Zero Trust Architecture
by lokar on Wednesday August 10, 2022 @12:22AM
(#32407835)
From a known identity to an API
Re:Implementing a Zero Trust Architecture
by nightpool on Thursday August 11, 2022 @11:54AM
(#32427643)
I feel like you need to go back and read the comment I'm responding to again, because you have deeply misinterpreted what I'm saying. I'm talking about the things users access, not who they are when they access them.
Re:Implementing a Zero Trust Architecture
by politician on Wednesday August 10, 2022 @11:31AM
(#32413663)
Close! Identity and environment. Even if you have "launch the missiles" authority, you might not have it on the weekends, at night, or from Cuba.
You should be providing access to an identity, not software. If someone is running the same software but with the wrong identity, it should be denied access.
One non-malicious example that comes to mind is the right application from the wrong environment, e.g. dev frontend calling prod backend, or even worse prod backend calling test DB, etc.