brent timothy saner on 17 May 2018 05:43:37 -0700


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Fwd: VMware Releases Security Update 

On 05/17/2018 08:33 AM, Rich Freeman wrote:
> 
> Nothing you said contradicts what I said.  I said that centralizing it
> eliminates the need to manage every switch individually.  Is that not
> accurate?
> 

"I guess it depends on what you mean by 'need.'  Your servers will work
fine without SELinux or netfilter rules or POSIX capabilities.  Heck,
they'll work fine if you run all your daemons as root too."

"However, your infrastructure will still 'work' if your LAN is wide open
and all the controls are on the gateway.  It just means that if
something gets into your LAN you don't have defense in depth."


both of these predicate that one must use SD networking in order to have
defense in depth. this is false. if this is not what you meant, then why
bring up such examples within the context? one does not need SD
networking for defense in depth, full stop.

further, it can even be harmful - if a network is smaller than a certain
threshold, you add unnecessary complexity to your network by using SD
networking. hopefully it goes without saying that unnecessary*
complexity is an enemy of a thorough security policy.


* "unnecessary" being the operative word. SELinux is what i'd consider
necessary in many environments. implementing SD networking is not for a
network that has, say, all of 5 machines (virtual or otherwise,
cumulatively).

Attachment: signature.asc
Description: OpenPGP digital signature

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug