https://tailscale.com/blog/how-nat-traversal-works
A delightful and thorough explanation of NAT traversal.
/ht @Cirio
šØš¦
Daniel Davidson
@tacky1@defcon.social
- 1 Followers
- 41 Following
- 55 Posts
Infrastructure security champion. Zero trust evangelist. Threat modelling leader.
šØš¦
šØš¦
āThe entire enterprise private network is not considered an implicit trust zone.ā
If your VPN rules include, āfrom trust to trustā, itās not #ZeroTrust.
I had my first #freelance client call yesterday. A solid first performanceā¦ except for the part where I referred to the NIST Cybersecurity Framework as the NIST Cloud something something. Fortunately, the client wasnāt fussed about it. š
Funniest thing I heard today thatās actually a good idea: āthis docuemnt should be pinned to every channel in slack and considered required readingā When I shared a link to our Data Taxonomy Management System (DTMS).
I'm pretty stoked on https://github.com/mrwadams/stride-gpt for helping folks produce STRIDE-based threat models. I was pleasantly surprised by the threats identified by pointing it at some public GitHub repos. Looking forwarding to trying it at work this week
GitHub - mrwadams/stride-gpt: An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology.
An AI-powered threat modeling tool that leverages OpenAI's GPT models to generate threat models for a given application based on the STRIDE methodology. - mrwadams/stride-gpt
#FounderMode vs leading from behind. Looking back at this last project, implementing preliminary ZTNA: we got there in the end, but in almost none of the ways I intended for it be implementedā¦ I havenāt decided yet if I should have been more hands on and prescriptive, or if I gave folks the appropriate level of autonomy and the process worked as intended. In any case, more #ZeroTrust and less VPN is better.
Unfortunately my first reaction was, of course Microsoft is vulnerable to an ATO schemeā¦ but in theory any provider that supports device code flow is vulnerable. Itās not an OAuth 2 problem, itās a phishing problem.
This attack method emphasizes the importance of device verification and authorization. An untrusted device shouldnāt be permitted to participate in the device code flow.
Sam Stepanyan 
š#AWS: "whoAMI" attacks give attackers code execution on Amazon EC2 instances:
OAuth2 Proxy: the MVP of zero trust network access.
Cool example of using an LLM for threat modelling that Iām keen to try.
https://xvnpw.github.io/posts/scaling-threat-modeling-with-ai/
h/t @adamshostack