Attacking Zero Trust Designs in 2021
summary
Zero Trust promises continual verification but 2021 deployments often fail on specifics: many SaaS apps do not accept device trust signals, session revocation via API is rare, and session timeouts remain long. MFA pairing is a practical weak point (SS7, SMS, TOTP phishing at pairing), attackers pivot from non-proxied SaaS into wider estates (noted Twitter admin case). Home labs testable tools include Cloudflare Access and OPSWAT; defenders need EDR/MDM telemetry, alerting for app-specific passwords, and immediate proxy kill-switches.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:55Summary
- 1:13Zero Trust Principles
- 2:51Zero Trust Subsystems
- 4:10A Perfect World
- 6:36AntiPENs
- 10:07Attack Resistance
- 14:52Proxy Problems
- 17:52User Sessions
- 20:02Pen Tests
- 23:43Monitoring
- 28:29Conclusion
related talks
24mExploring Zero Trust, Threat Intelligence, and Secure SDLC
31mEmbracing Zero Trust When You Aren't the World's Largest Internet Company
18mRedefining Cybersecurity: Harnessing Zero Trust Architecture for a Resilient Future
51mConducting a Pre-Mortem on the Next Zero Trust Breach
34mZero Trust Best Practices in Government and Federal Industries
40mZero Trust in a Post-pandemic World
51mSecurity 101: A Beginner’s Guide to Cybersecurity and Zero Trust for Developers
39mBuilding With Zero Trust Architecture