Full zero trust internally. Both inbound and outbound proxies (different machines) to carefully limit access, and provide a place to mitigate attacks. Etc.
If your plan is to quickly apply upstream patches, your plan is bad.
> Full zero trust internally
I try so hard for this, but don't even get approval to change an internal site to use https instead of http.
I get we gotta keep the new features and workflows coming, but a single resource dedicated to low hanging fruit of security could fix a lot in a very short time.
loading story #50304846