The National Security Agency is sharing new guidance to help organizations limit an adversary's movement on the internal network by adopting zero-trust framework principles.

The NSA has issued guidance on adopting zero-trust principles to counter internal network threats. Zero-trust architecture prevents unauthorized access and movement within networks by assuming threats exist and enforcing strict access controls. The approach includes data flow mapping, segmentation, and software-defined networking to minimize breach impacts. No CVEs are associated with this guidance.

  • CaptObvious@literature.cafeEnglish
    53·
    9 months ago

    So they recommend reinstating all the silos that efficiency experts have been telling us to break down for decades?

    Has anyone found NSA’s backdoor in the proposal?

    • agent_flounder@lemmy.worldEnglish
      9·
      9 months ago

      That’s not what (the new hype buzzwords) Zero Trust Architecture means. Like at all.

      Instead of the crunchy shell network perimeter and gooey center paradigm of enterprise networks of the past 30 years, ZTA is a response to the nebulous and disappearing permitted. It’s supposed to control access to anything anywhere anytime but securely.

      The main feature is dynamic attribute-based network access control. Access can be granted or revoked moment to moment based on who you are, where you are, even attributes of your computer like patch level.

      Let’s say a patch just came out for your laptop yesterday but it isn’t applied yet. ZTA approach denies you access to sensitive networks, but not to patching infrastructure. Once patched, your access is permitted. Or say you turn off your antivirus mid-download. Access revoked within moments.

      Rather than erect silos it sort of makes access more transparent to the end user and so remote vs on site access basically seems the same to them.

      Yeah, yeah, I know, NSA bad-- I am wearing the EFF T-shirt that says so right now.

      But in addition to wrecking privacy and spying on the innocent (hi, you fuckers, .l…), they also do offer somewhat legit advice now and then.

    • phdepressed@sh.itjust.worksEnglish
      5·
      9 months ago

      Yes, siloing info is less efficient. However, it is significantly more secure. NSA unlikely to purposefully backdoor themselves.

    • Ajen@sh.itjust.worksEnglish
      1·
      9 months ago

      Security and efficiency make up 2 corners of an iron triangle. You generally have to sacrifice one of them to get the other (or increase the project cost/schedule).