Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I read the federal government’s Zero-Trust Memo so you don’t have to

bastionzero.com

Post reply on HN
Print view View original

41–50 of 369 posts

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#41

Post by Sesse__ »

adreamingsoul wrote: post #16

Here in Norway we have BankID which uses MFA. To access any government, banking, or official system you have to authenticate with your BankID. Its simple amazing.

BankID: A system with a secret spec, where the bank holds your secret key, there is no transparency log whatsoever (so you have no idea what your bank used that secret key for), can be used to authenticate as yourself almost everywhere, and where you can get huge, legally binding bank loans in minutes (and transfer the money away) with no further authentication.

Oh, and if you choose to not participate in this system, enjoy trying to find out the results of your covid test :-) (I ended up getting a Buypass card, but they officially support only Windows and macOS.)

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#42

Post by the_jeremy »

paganel wrote: post #24

> Do not give long-lived credentials to your users. This screams "we'll use more post-it notes for our passwords compared to before", or maybe the real world to which this memo is addressed is different compared to the real (work-related) world I know.

It specifically calls out not requiring regular password rotation. Short-lived credentials is for tokens with expiration, not the password you use to login to the service that gives you the token.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#43

Post by Sesse__ »

uncomputation wrote: post #5

> “Enterprise applications should be able to be used over the public internet.” Isn’t exposing your internal domains and systems outside VPN-gated access a risk? My understanding is this means internaltool.faang.com should now be publicly accessible.

internaltool.faang.com _is_ publicly accessible, as in, you can get to the login page.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#44

Post by nybble41 »

MattPalmer1086 wrote: post #19
jaywalk wrote: post #10

Earlier quoted context omitted.

No, the memo pretty clearly says that VPNs need to go away.

It says that VPNs and other network tunnels should not be relied on. Where does it say they should go away?

"Further, Federal applications cannot rely on network perimeter protections to guard against unauthorized access. Users should log into applications, rather than networks, and enterprise applications should eventually be able to be used over the public internet. In the near-term, every application should be treated as internet-accessible from a security perspective. As this approach is implemented, agencies will be expected to stop requiring application access be routed through specific networks, consistent with CISA’s zero trust maturity model."

"Actions … 4. Agencies must identify at least one internal-facing FISMA Moderate application and make it fully operational and accessible over the public internet."

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#45

Post by wordsarelies »

ctime wrote: post #38

The real crux of the issue is the long-tail of applications which were never conceived with anything but network-based trust. I'm certain the DoD is absolutely packed with these, probably for nearly every workflow. The reason this was so "easy" for Google (and some other companies, like GitLab[1]) to realize most of these goals is that they are a web-based technology company - fundamentally the tooling and scalable s…

As if Gov't does their own IT infrastrucutre...

This is a windfall for Gov't contractors.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#46

Post by coffeefirst »

KarlKemp wrote: post #22

I’m somewhat unhappy the “zero trust” terminology ha caught on. The technology is fine, but trust is an essential concept in many parts of life[0], and positioning it as something to be avoided or abolished will just further erode the relationships that define a peaceful and civil society. 0: trade only works if the sum of your trust in the legal system, intermediates, and counterparts reaches some threshold. The sam…

Yeah, it's a terrible name. "Zero Assumptions" or similar might be more clear.

Words matter. If nothing else, laypersons hear these terms and shape their understanding assuming based on what it sounds like.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#47

Post by chasd00 »

suns wrote: post #3
staticassertion wrote: post #2

This is pretty incredible. These aren't just good practices, they're the fairly bleeding edge best practices. 1. No more SMS and TOTP. FIDO2 tokens only. 2. No more unencrypted network traffic - including DNS, which is such a recent development and they're mandating it. Incredible. 3. Context aware authorization. So not just "can this user access this?" but attestation about device state! That's extremely cutting edg…

Yea, imagine the implications of federal agencies all implementing this successfully. Can't wait to see what the trickle down(?) effect is.

lots of billable hours for the various consulting firms. "we'er so happy we can hardly count" - Pink Floyd

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#48

Post by pm90 »

CGamesPlay wrote: post #40
meepmorp wrote: post #17

Earlier quoted context omitted.

Also, “Password policies must not require use of special characters or regular rotation.” They even call out the fact that it's a proven bad practice that leads to weaker passwords - and such policies must be gone from government systems in 1 year from publication of the memo. It's delightful.

I am a bit concerned that this will be read as "Password policies must require the use of no special characters", possibly as a misguided attempt to push people away from adding using "Password123!" as the password. I wish the memo had spelled out a little more clearly that there's nothing wrong with special characters, but they shouldn't be required. Also, is a whitespace a special character?

If we were to stop using special characters and only use human friendly phrases (eg “jupiterIsTheSmallestPlanet”) it wouldn’t be the end of the world.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#49

Post by nybble41 »

seibelj wrote: post #34
c0l0 wrote: post #31

Earlier quoted context omitted.

I think 3. is very harmful for actual, real-world use of Free Software. If only specific builds of software that are on a vendor-sanctioned allowlist, governed by the signature of a "trusted" party to grant them entry to said list, can meaningfully access networked services, all those who compile their own artifacts (even from completely identical source code) will be excluded from accessing that remote side/service.…

Reproducible builds are a thing, I don't know how widespread they are. I know the monero project has that built in so everyone compiles the exact same executable regardless of environment, and can verify the hash against the official version https://github.com/monero-project/monero

Reproducible builds allow the user of the software to verify the version that they are using or installing. They do not, by themselves, allow the sort of remote attestation which would permit a service to verify the context for authentication—the user, or a malicious actor, could simply modify the device to lie about the software being run.

Secure attestation about device state requires something akin to Secure Boot (with a TPM), and in the context of a BYOD environment precludes the device owner having full control of their own hardware. Obviously this is not an issue if the organization only permits access to its services from devices it owns, but no organization should have that level of control over devices owned by employees, vendors, customers, or anyone else who requires access to the organization's services.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#50

Post by paganel »

the_jeremy wrote: post #42
paganel wrote: post #24

> Do not give long-lived credentials to your users. This screams "we'll use more post-it notes for our passwords compared to before", or maybe the real world to which this memo is addressed is different compared to the real (work-related) world I know.

It specifically calls out not requiring regular password rotation. Short-lived credentials is for tokens with expiration, not the password you use to login to the service that gives you the token.

Got it, thanks.
Post reply on HN