undefined

points

[-]

Completely agree there is lots you can do to shut down exposed surface area.

Is encrypting data at rest useful when the app must have access to decrypt the data? What sort of scenarios do you use it for and where do the keys live?

by lokar21 hours ago|

prev|

[-]

Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.

If your plan is to quickly apply upstream patches, your plan is bad.

by forgotaccount321 hours ago|

parent|

[-]

> Full zero trust internally

I try so hard for this, but don't even get approval to change an internal site to use https instead of http.

I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.

by lokar20 hours ago|

parent|

[-]

It’s a hard transition, but possible. Obviously less work to do it from the start.

by saalweachter20 hours ago|

parent|

[-]

It requires management buy-in, both to allow some number of engineers to be allocated to such "non-production" work, and also to allow the friction security creates to continue to exist and "slow down" the "real work", both by vetoing things that would weaken security and by forcing everyone to use more cumbersome workflows.

That usually doesn't happen unless the company has suffered a large financial or reputational loss as a result of poor security practices. Sometimes not even then, if the company doesn't get scared they'll start losing money or get in some sort of legal trouble.

by lokar20 hours ago|

parent|

[-]

I’ve worked places that did a lot of this (not everything, but a lot) from very early on.