
Cloud Security from First Principles - ffwang2
https://franklyspeaking.substack.com/p/frankly-speaking-52620-cloud-security
======
time0ut
I see a lot of the topics/questions here paralleled more and more on-prem.

A decade ago, we assumed the network running on the hardware we owned was safe
and didn't bother with things like encryption and authentication if the client
was inside our walls. This has changed dramatically, marching towards full
zero trust. These days all communication is handled over mTLS and enforce
policy on every endpoint. We do these things on bare metal, VMs, or
containers. It is easier on the higher layers of abstraction though.

Personally, I think the most interesting part of cloud security is the greater
ability to automate parts of the incident response process.

~~~
schoolornot
> These days all communication is handled over mTLS

I've been hearing of this for the last few years but I doubt any measurable
number of companies are doing it in production. I think unless you're using a
service mesh it's difficult to deploy, bootstrap, maintain, secure. Every POC
I've seen of it using StrongSwan or vCenter hacks or tunneling one protocol in
another are fragile at best.

~~~
kerng
Large, well known companies (startups especially) often don't encrypt nor
authenticate internal prod traffic - I always wonder how they pass compliance
checks.

Google with their BeyondCorp stuff really mislead a lot of startup shops and
less security savvy organizations, because its easy to get wrong - and they
ended up in these situations of having neither a perimeter nor zero trust. If
they do "zero trust", zero trust's perimeter is the same size and pool of
machines as the their old school network perimeter, meaning pop one machine
then freely move around.

Check your laptop, if your machine has SSH, SMB or RDP enabled, then you are
not doing zero trust and you can easily be compromised in a coffee shop and
your organization's zero trust perimeter just fell over.

------
alexchantavy
> There isn’t a corporate network you can trust (however, SaaS applications
> already started to break that down), and you have little to no control over
> that network.

> Identities are becoming more important, but how does the notion of identity
> change and how do they work in a hybrid and multi-cloud world?

Yup. The main challenge is there is often no centralized system for identity
authentication and authorization, or it is difficult to integrate such a
system with the vendors a company relies on. The attack surface from an
identity standpoint is much larger as a company will need to manage credential
rotation and account provisioning/deprovisioning across so many more assets
than in an on-prem model.

