Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CISA Zero Trust Maturity Model

cisa.gov

Post reply on HN
Print view View original

11–20 of 22 posts

Re: CISA Zero Trust Maturity Model

#11

Post by waz0wski »

acdha wrote: post #8

I like seeing these guidelines but I definitely have been thinking about this essay from a couple months back which I think accurately calls the current situation untenable. These are all good advice, but even most government agencies have nowhere near the budget to fully implement them. https://doublepulsar.com/the-hard-truth-about-ransomware-we-... > The truth is, while governments are pushing frameworks such as Ze…

Goes hand-in-hand with the recent scathing message from Nicolas Chaillan regarding DoD development modernization efforts

https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch...

Re: CISA Zero Trust Maturity Model

#12

Post by xxpor »

annoyingnoob wrote: post #10
user3939382 wrote: post #3

I perused the draft and was surprised by my jaded reaction: Great! More effort put into detailed cybersecurity strategies for the likes of OPM, T-Mobile, and Equifax to ignore. We have thousands of pages of frameworks and NIST guides and the people in charge, especially in the private sector, are free to neglect or ignore them with impunity because apparently regulators don’t care and the market doesn’t care, so why…

If you want to work in the DoD supply chain after 2024 then you'll have to implement NIST 800-171 and some level of CMMC. Its no longer a self-attestation and requires a 3rd party audit and certification. Its not trivial.

The compliance costs aren't what worry me. The part that worries me is ending up with FIPS but even worse everywhere. Just because of how slowly it evolves and how people are stuck on old things because of that.

Re: CISA Zero Trust Maturity Model

#13

Post by acdha »

waz0wski wrote: post #11
acdha wrote: post #8

I like seeing these guidelines but I definitely have been thinking about this essay from a couple months back which I think accurately calls the current situation untenable. These are all good advice, but even most government agencies have nowhere near the budget to fully implement them. https://doublepulsar.com/the-hard-truth-about-ransomware-we-... > The truth is, while governments are pushing frameworks such as Ze…

Goes hand-in-hand with the recent scathing message from Nicolas Chaillan regarding DoD development modernization efforts https://www.linkedin.com/pulse/time-say-goodbye-nicolas-m-ch...

I know the HN discussion had some debate over that (https://news.ycombinator.com/item?id=28408399) but I definitely think there's a lot of good discussion about how to make these problems more tractable. Even in the .gov space, which does tend to treat security as something you can't just brush away, there's generally limited money and resources for actually shipping improvements and especially challenging are the issues of legacy apps (which probably require Congress to allocate money for replacements) and adequately staffing for O&M (contractors are usually a bad fit with lower continuity and restrictions on flexibility). Most of the breaches you hear about trace back to something which someone has been complaining about for ages but been unable to get support for actually fixing.

Re: CISA Zero Trust Maturity Model

#14

Post by annoyingnoob »

xxpor wrote: post #12
annoyingnoob wrote: post #10

Earlier quoted context omitted.

If you want to work in the DoD supply chain after 2024 then you'll have to implement NIST 800-171 and some level of CMMC. Its no longer a self-attestation and requires a 3rd party audit and certification. Its not trivial.

The compliance costs aren't what worry me. The part that worries me is ending up with FIPS but even worse everywhere. Just because of how slowly it evolves and how people are stuck on old things because of that.

I cant argue. I dont love all of the things we are required to do. I'm sure my current VPN is better than what I'll have to implement. The things I'm required to implement are major attack targets with histories of vulnerabilities - but they are certified.

Re: CISA Zero Trust Maturity Model

#15

Post by giaour »

user3939382 wrote: post #3

I perused the draft and was surprised by my jaded reaction: Great! More effort put into detailed cybersecurity strategies for the likes of OPM, T-Mobile, and Equifax to ignore. We have thousands of pages of frameworks and NIST guides and the people in charge, especially in the private sector, are free to neglect or ignore them with impunity because apparently regulators don’t care and the market doesn’t care, so why…

One target audience for this document that can’t ignore it (at least not as easily) is the federal government and the contractors they hire. In 2020, the chief information security officer of a federal agency told me they didn’t buy into this newfangled zero trust stuff and would continue to rely on network perimeter security, largely because that’s what CISA and OMB documents offered as a reference architecture.

Re: CISA Zero Trust Maturity Model

#17

Post by ziddoap »

lvspiff wrote: post #6
user3939382 wrote: post #3

I perused the draft and was surprised by my jaded reaction: Great! More effort put into detailed cybersecurity strategies for the likes of OPM, T-Mobile, and Equifax to ignore. We have thousands of pages of frameworks and NIST guides and the people in charge, especially in the private sector, are free to neglect or ignore them with impunity because apparently regulators don’t care and the market doesn’t care, so why…

Come work in healthcare - if you are at one of the larger insurance orgs (UHG, Anthem, Humana) or hospital networks (HCA, Dignity, etc) you are locked into a world of this model making your life the most difficult imaginable. Need vendor support? Hope you like watching them work over webex as they wont have any access to any of your servers. Need a VPN to tunnel data across? Yeah good luck with that it'll take at lea…

This sort of speaks to what the GP was talking about -- not following guidelines and frameworks.

For example,

>On top of rotating passwords on a yearly basis

> rotating passwords for users every 90 days

NIST 800-63B, as of 2017, explicitly advised against this.

"Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)." [1]

[1]https://pages.nist.gov/800-63-3/sp800-63b.html

Re: CISA Zero Trust Maturity Model

#18

Post by offmycloud »

Zero Trust is such a terrible name. What they really mean is less trust in network location, static firewalls, and site-to-site VPNs, and much more trust in the cryptography behind TLS, identity systems, and how they interact with applications.

Re: CISA Zero Trust Maturity Model

#19

Post by elevation »

Regarding authentication, the "optimal" practice is described as:

> Agency continuously validates identity, not just when access is initially granted.

How does this work practically without having terrible UX? MFA to login, then periodically poll for the presence of a hardware token and less frequently, prompt for password reauthentication?

Re: CISA Zero Trust Maturity Model

#20

Post by slaymaker1907 »

offmycloud wrote: post #18

Zero Trust is such a terrible name. What they really mean is less trust in network location, static firewalls, and site-to-site VPNs, and much more trust in the cryptography behind TLS, identity systems, and how they interact with applications.

I think defense in depth is also a major related principle. Make each layer as beefy as possible in terms of security even if seemingly redundant since these help when other layers are bypassed through some exploit.

However, in my opinion one major failing of this paradigm is that while some additional layers are useful, it's still good to think about threat models and failure modes since at some point, you can't implement additional security measures due to the computational and human cost.

Post reply on HN