Assume-breach, zero-trust, and security-first mindset
The classical approach to security was to prevent breaches. The most important measures were these:
- Layers of trust: The internal network was considered secure and protected with firewalls. Access to the network was only allowed by company-owned devices and virtual private network (VPN) tunnels. The public internet was not trusted—and in between were demilitarized zones (DMZs).
- Risk analysis: Risk analysis with threat modeling.
- Security reviews: Architecture and code reviews from security experts.
- Security testing: External security testing with a specific scope.
But with the prevent-breach approach, the question as to whether a company was already under attack could basically not be answered.
In an interview in 2012, General Michael Hayden, former director of the National Security Agency (NSA) and the Central Intelligence Agency (CIA), said the following:
