[Info-vax] US Gov't "Zero Trust" Security Requirements

[Phil Howell]

On Wednesday, 21 September 2022 at 4:25:05 am UTC+10, Simon Clubley wrote:
> > 
> > Nice post .. ZTA illustrates transformation from relying on network perimeters (e.g. local firewalls) to enterprise App/DB and IDM (identity management) architectures. 
> > 
> > More detailed whitepaper architecture pointer in the link above: 
> ><https://dodcio.defense.gov/Portals/0/Documents/Library/(U)ZT_RA_v1.1(U)_Mar21.pdf> 
> >
> I looked briefly at this document and it appears that VMS would fall 
> down hard when judged by the standards of section 2.1.1, which makes 
> it clear that systems in a zero trust environment have to operate in 
> what is assumed to be an actively hostile environment internally, and 
> not just protect against some external nebulous threats from the outside 
> world. 
> 
> Some people around here argue that VMS doesn't really need to be kept 
> to the same security standards as everything else "because it's run in 
> an isolated and controlled environment". For anyone new around here, 
> I disagree strongly with that statement. 
> 
> How do you see it as being viable to run VMS in such an actively hostile 
> environment ? 
> 
> Simon. 
> 
> -- 
Perhaps you should ask those who have run such systems in
"hostile environments" for at least 25 years, like Sydney ASX?
Average daily transaction value is over $50 billion (AU)
Hey, they even have a job on offer, you surely know pascal?

https://www2.asx.com.au/content/dam/asx/about/job-opportunities/securities-and-payments/senior-analyst-programmer%20-chess.pdf

Phil