One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the “unnecessary” USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

  • @G00d4y0u
    link
    78 months ago

    Zscaler being the middleman is somewhat the point for security/IT teams using that feature.

    • AggressivelyPassive
      link
      fedilink
      88 months ago

      And it’s a horrible point. You’re opening up your entire external network traffic to a third party, whose infrastructure isn’t even deployed or controllable in any form by you.

      • @G00d4y0u
        link
        08 months ago

        The idea being that it’s similar to using other enterprise solutions, many of which do the same things now.

        Zscaler does have lesser settings too, at it’s most basic it can do split tunneling for internal services at an enterprise level and easy user management. Which is a huge plus.

        I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

        The bigger deal would be the internal network, which is also a valid argument.

        • AggressivelyPassive
          link
          fedilink
          68 months ago

          I’d also like to point out that the entire Internet is a third party you have no control over which you open your external traffic to everyday.

          Not really. Proper TLS enables relatively secure E2E encryption, not perfect, but pretty good. Adding Zscaler means, that my entire outgoing traffic runs over one point. So one single incident in one single provider basically opens up all of my communication. And given that so many large orgs are customers of ZScaler, this company pretty much has a target on its back.

          Additionally: I’m in Germany. My Company does a lot of contracting and communication with local, state and federal entities, a large part of that is not super secret, but definitely not public either. And now suddenly an Amercian company, that is legally required to hand over all data to NSA, CIA, FBI, etc. has access to (again) all of my external communication. That’s a disaster. And quite possibly pretty illegal.