Does anyone happen to know what this costs? They’re predictably quiet about it.
Remote access to production infrastructure (death to the VPN)
61–70 of 120 posts
Re: Remote access to production infrastructure (death to the VPN)
#62I'm surprised to see no mention of Mutual TLS (MTLS), PIV cards, or the like
Re: Remote access to production infrastructure (death to the VPN)
#63Earlier quoted context omitted.
The control I listed, NIST 800-53 SC-7(7) [which is a part of the FedRAMP Moderate suite of controls], specifically requires you implement a technical control such that your users cannot split tunnel.
If this is for complying with NIST 800-53 SC-7, then I'd be really curious how this actually works. Because SC-7 is all wrapped up in language around split tunneling I feel like this is focused on the wrong thing -- you'd still need to accommodate for controlling access of laptops etc. to external resources. Yes, in a VPN landscape that means not allowing for side-stepping the VPN, but that would be true of any other…
The risk of split tunneling is that the remote client has the ability to relay data in real time. Allowing it means the local printers or laptops on an open WiFi are effectively on your network.
Re: Remote access to production infrastructure (death to the VPN)
#64Authenticating the source IP address on the fly (as detected from the browser) is definitely not the way to go for many reasons: 1. With NAT and metropolitan area networks, hundreds of thousands of devices could share the same public IP. 2. Large networks with many devices often connect to the public network through trunking (load balance the connections through multiple routers), so the HTTP connection between OKTA…
NAT and single IP adresses for multiple users are going away with IPv6 ?
Eventually, for now v4 CGNAT exists too though.
Re: Remote access to production infrastructure (death to the VPN)
#65Pure Zero Trust is just as ridiculous as using Pure-VPN-around-a-garden. The first gives an attacker unlimited retries, and the second gives an attacker full system access once they breach the outer wall. The correct solution is somewhere in the middle: block everything by default to get you to an inner courtyard, where the zero trust model is deployed... (which ironically he suggests by deploying port knocking (port…
Also just to note there is nothing to stop you from using a rotating port knock key, particularly if you are willing to assume the client's clock is reasonably accurate.
Re: Remote access to production infrastructure (death to the VPN)
#66Pure Zero Trust is just as ridiculous as using Pure-VPN-around-a-garden. The first gives an attacker unlimited retries, and the second gives an attacker full system access once they breach the outer wall. The correct solution is somewhere in the middle: block everything by default to get you to an inner courtyard, where the zero trust model is deployed... (which ironically he suggests by deploying port knocking (port…
So VPN in to a subnet where only a bastion host is exposed effectively?
Re: Remote access to production infrastructure (death to the VPN)
#67I'm surprised to see no mention of Mutual TLS (MTLS), PIV cards, or the like
I believe in this case he's talking about MTLS:
> OASA also protects these hops by issuing client certificates with 10-minute expirations after first verifying your identity through our single sign-on provider, and then also verifying you are on a pre-enrolled (and approved) trusted company device.
Re: Remote access to production infrastructure (death to the VPN)
#68In my experience, the best way to eliminate the VPN is to expose your various internal business services as websites w/ TLS1.2 & multi-factor authentication. Obviously, this isn't practical for everything. But, if the thing you were using VPN for is already a web application, you are basically halfway there. Ideally, you just directly expose a secure web application to clients, but in some cases (i.e. very old legacy…
I want this, but with a twist.
1) I want the websites to do certificate verification on the certs I'm using on my desktop.
2) Then on top of that my website should use usb security key verification as well.
Easy enough to do #2, but I want #1 to be ubiquitous as well.
... So basically my HTTPS server will use my public key as my identity, not my username/email and password.
Re: Remote access to production infrastructure (death to the VPN)
#69I work in this space who has a commercial offering. Ill just leave this CSA spec here for reference. Please also look up SPA - newer than port knocking, but based on same premise. https://downloads.cloudsecurityalliance.org/initiatives/sdp/...
Re: Remote access to production infrastructure (death to the VPN)
#70In my experience, the best way to eliminate the VPN is to expose your various internal business services as websites w/ TLS1.2 & multi-factor authentication. Obviously, this isn't practical for everything. But, if the thing you were using VPN for is already a web application, you are basically halfway there. Ideally, you just directly expose a secure web application to clients, but in some cases (i.e. very old legacy…
I want this, but with a twist. 1) I want the websites to do certificate verification on the certs I'm using on my desktop. 2) Then on top of that my website should use usb security key verification as well. Easy enough to do #2, but I want #1 to be ubiquitous as well. ... So basically my HTTPS server will use my public key as my identity, not my username/email and password.
[deleted]