Book – Zero Trust Architecture
ZTA – IOT / OT Technologie
How to Secure IOT and OT Networks with an Zero Trust aproach? Microsoft
The Hidden Risk in Zero Trust: Vendor Lock-In Through Proprietary Data Formats
Zero Trust Architecture (ZTA) has become a cornerstone of modern cybersecurity. By continuously verifying access based on dynamic data — user identity, device health, threat intelligence, enterprise context — ZTA helps organizations stay resilient against evolving threats. But there's a catch: the data that makes Zero Trust work has to come from somewhere, and much …
Continue reading "The Hidden Risk in Zero Trust: Vendor Lock-In Through Proprietary Data Formats"
Zero Trust Use Case: Remote Access & VPN Replacement
In today’s hybrid work environment, traditional VPNs are increasingly seen as outdated and risky. They create broad network access once a user is authenticated, which can expose sensitive systems to lateral movement and insider threats. Enter Zero Trust Architecture (ZTA)—a modern approach that redefines remote access by enforcing strict, identity-based controls. Why Replace VPNs with Zero …
Continue reading "Zero Trust Use Case: Remote Access & VPN Replacement"
Zero Trust Network Access
Zero Trust Network Access (ZTNA) is often used as a synonym for "Zero Trust" in general, but it actually describes a specific product category: software that replaces a traditional remote-access VPN. This post looks at what ZTNA actually is architecturally, and which open-source options exist if you want to run it yourself instead of buying …
Zero Trust Architecture – Overview
Notes about ZeroTrust Security Contents What is Zero Trust? History of ZT Definitions, Concepts, & Components of ZT Tenets Design Principles Pillars Components & Elements Logical Components of Zero Trust Architecture Mapping ZTA components to SDP CISA Zero Trust Maturity Model for the identity pillar CISA Zero Trust Maturity Model for the networks pillar Function: …
Fortigate Hidden drops
#!/bin/bash # Patrick Marc Preuss (c)2021 - 2025 # Check for required environment variable if [ -z "${SSHPASS}" ]; then echo "Error: Please set the SSHPASS environment variable." exit 127 fi # Check for firewall argument FW="$1" if [ -z "${FW}" ]; then echo "Usage: $0 <firewall-hostname-or-IP>" exit 127 fi # Timestamp for output file …
Fortigate – IPerf3
Note to my self. Looks like Fortigate changed the access to IPerf3. FG (global) # diagnose traffictest set_pair mgmt:mgmt Server:Client pair is mgmt:mgmt Server CPU affinity: None Client CPU affinity: None Stream number: 1 Traffic protocol: TCP Server IP address: 192.90.255.199 Server VDOM: vsys_hamgmt Client IP address: 192.90.255.199 Client VDOM: vsys_hamgmt FG (global) # diagnose …
AAA
FreeRadiustac_plusCiscoFortinetCheckPointLinks FreeRadius /usr/local/etc/raddb/clients.conf client cisco { ipaddr = 8.8.8.8 secret = testing123 } /usr/local/etc/raddb/users cisco Cleartext-Password := "cisco" Service-Type = NAS-Prompt-User, Reply-Message := "Hello, %{User-Name}", Cisco-AVpair = "shell:priv-lvl=15" /usr/local/etc/raddb/sites-available/default # Read the 'users' file. In v3, this is located in # raddb/mods-config/files/authorize files # MAC Auth rewrite_called_station_id # Now check against the authorized_macs file authorized_macs …
Avocent – MTU
Avocent ACS – Forcing MTU and MSS per Route The Situation A WAN link did not offer the full Ethernet MTU of 1500 bytes (tunnel/overlay overhead). Two effects came together: The WAN environment did not advertise the lower MTU properly – ICMP "Fragmentation Needed" (type 3, code 4) never made it back to the sender, …