On: Zero Trust Networks

[closeparen]

BeyondCorp does not imply opening up your network to the entire world! If anything, it means locking down your network tighter, because not even the office is privileged. Production is a black box that you touch by authenticating through the same reverse proxy tier, no matter where outside of it you are. In effect, nginx is your “VPN” server and everyone has to use it.

Plenty of companies paid dearly for trusting every device that merely needed internet access.

[jiveturkey → closeparen]

> BeyondCorp does not imply opening up your network to the entire world!

I think GP is implying that IT departments are taking away that [wrong] message. Just look at the proliferation of zero trust companies that do no such thing.

[supdatecron → jiveturkey]

> Just look at the proliferation of zero trust companies that do no such thing.

Is there a list I can look at? Who are you referring to?

[kerng → closeparen]

Internet exposed bastion hosts to production, that have no IP whitelisting are not the best idea, unfortunately not uncommon nowadays.

[closeparen → kerng]

That's what a VPN server is.

[kerng → closeparen]

Organizations that have high value assets would deploy multiple layers of these, not just one, basically depending on value of assets.

[closeparen → kerng]

You're gonna get some pretty fun pathological networking behaviors tunneling VPNs on VPNs.

[xxpor → kerng]

You need always need multiple layers of security. Using the network itself as one was never necessary, although it has been convenient.

Nowadays U2F based 2fa authentication and need to know based authorization are usually superior.

[kerng → xxpor]

Applying both is better, then just depending on one of them.