Hacker News Reader

Comment by chrismarlow9 | Hacker News Reader

Assume everything is compromised and construct internal architecture accordingly. The best you can ultimately do is try to limit the impact.

Proper firewall, TLS, strong crypto, secrets management, 2FA and regular audits. Zero trust stuff

View on HN

You cannot zero-trust to your web framework. You cannot zero-trust your data access library, to which you have to give credentials to your production database. You have to trust the database itself, and the operating system that runs your whole stack.

Zero-trust requires certain scale and is expensive; the most successful high-stakes zero-trust system I know is Bitcoin.

But you can still do things like not allow your DB to make connections to the outside world, or receive connections other than from the application and authorized admins. And similarly for the app, it can be prevented from talking to anyone it doesn’t need to be talking to.

They can still be badly behaved, but you are least control the blast radius.

Default deny egress is an important step in limiting impact. It can be tough though.

The biggest problem in "default deny egress" is CDNs. It's a colossal waste of time to set up firewall access lists for your build agents, but even for your production environments - as soon as you have one external API that is hosted behind Cloudflare, Anypoint, Cloudfront, Akamai or one of the hundred other similar services, you may as well give up. Simply because it's extremely annoying to keep up tabs with changing IP addresses.

Reply on news.ycombinator.com