Hacker News Reader

Comment by SpicyLemonZest | Hacker News Reader

For a large company, there are all kinds of data security and compliance rules requiring that sensitive data can only be accessed from a secure network. Your lawyers are unlikely to sign off on PCI, HIPAA, GDPR, etc. with only application level security.

View on HN

PCI seems to be the posterchild of checklist based security, second only to FIPS in terms of worthlessness. I guess it is soemwhat useful for convincing people to outsource the checkout path, so they can avoid PCI compliance nonsense.

That's because it's designed to be impossible to implement. Note that:

> "no compromised entity has yet been found to be in compliance with PCI DSS at the time of a breach."

https://www.computerworld.com/article/2531828/post-breach-cr...

What about entities that haven't been breached?

They are irrelevant. PCI compliance protects people by prohibiting unsafe storage of sensitive information in case of a breach.

As a result, fewer companies store the data unsafely, but speaking strictly in terms of "entities that haven't been breached" then PCI compliance doesn't really matter one way or the other.

The easiest way to come up with rules where no compromised entity is found in compliance is to make the rules impossible (or wildly impractical) for anyone to comply with.

If it were a matter of "we 100% know lots of companies that haven't had breaches fully comply with the rules", it would be a relevant data point. If we don't know that, we can just assume that the rules—much like our legal code—are written in a way where a motivated auditor can always find non-compliance. "Give me six lines written by the most honorable of men, and I will find an excuse in them to hang him." and all that...

Isn't that the whole point of BeyondCorp though? That application level security can work. Long term, trusting the network is a bad idea anyway.

Can work, yes. Has the budget (in both money and engineer time), probably not. It’s not as easy as just installing a new appliance and flipping a switch, especially for companies with low risk appetite and strict SLAs around service uptime.

Plenty of enterprises have mission-critical applications running on mainframes because either no one understands the software enough to move it to more modern platforms or because the business can’t spare the time/money to have their engineers work on moving it. It’s hard to expect them to adopt zero-trust and BeyondCorp with that kind of culture.

I agree “don’t trust the network” and especially the idea that those four walls don’t offer any real protection, but enterprise culture is incredibly slow, inefficient, and risk averse.

To add to this. In (old school) enterprise security measures seem to exist more for compliance and legal protection. Top management and especially shareholders care much more about being financially protected via some insurance or government action than technically safe(ish). See Equifax.

That's nice, but it seems the whole Zoom and Teams hype has done a quick end-run around those.

Given that Zoom looks like the interface on the moon lander, I'm sure part of the appeal must be in ignoring all these rules.

> That's nice, but it seems the whole Zoom and Teams hype has done a quick end-run around those.

It has. And somebody's going to get the book thrown at them for a breach at some point. At which point businesses will shut down Zoom and Teams post haste.

Corporate security is solely driven by perceived legal liability.

PCI, HIPAA and GDPR all would agree that most of your users most of the time should not have any access to sensitive data. It's reasonable to have users VPN'ing in only when/if they need access to a specific system storing sensitive data, and even then, have only that access happen through that VPN, there's no need to pass their Zoom conference through the same VPN, and it would be a benefit (or even a requirement) to ensure that the sensitive data is separate from their Zoom conference. E.g. a remote desktop access that prohibits copy/pasting and file exchange so that you can't accidentally get the sensitive data to your email or chat environment.

Reply on news.ycombinator.com