Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use BeyondCorp to ditch VPN, improve security and go to the cloud

blog.google

Post reply on HN
Print view View original

51–60 of 163 posts

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#51

Post by thomashabets2 »

radlad wrote: post #46
thomashabets2 wrote: post #45

Earlier quoted context omitted.

VPNs will remain because of SSH, eh? https://github.com/google/huproxy

I think you misunderstood. My point is that you will still need direct access into the network in order to work on the BeyondCorp servers themselves, for example -- not that SSH shouldn't, or couldn't, be covered under the zero trust model as well.

Maybe.

Are you saying that "the bootstraps" (panic access) is VPN? Why isn't the first level just an open SSH port?

I'm not sure why "when all else fails" is better left a VPN port than an SSH port.

I'd say SSH infrastructure (a server with only pubkey login, maybe behind TCP-MD5 and/or heavily filtered source addresses) is probably more reliable and safer than a VPN.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#52

Post by DorothySim »

izacus wrote: post #8
yegle wrote: post #4

My ex-manager who left Google to another well established company once said the most missed thing from Google was the ability to work remotely right away on corp laptop with BeyondCorp. Disclaimer I work for Google not related to BeyondCorp.

I thought Google doesn't allow remote work?

I think the only restriction is working on Google approved hardware so no BYOD there.

(Disclosure: not a Google employee).

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#53

Post by foobarge »

milesward wrote: post #47
theDoug wrote: post #17

Earlier quoted context omitted.

This is incorrect! I began as a full-time remote employee and stayed so for 16 months until it made more sense for me to move to HQ. There are hundreds of remote workers, but being local has definitely allowed me to not need to rely on email and video chats so heavily. (Disclosure: Google employee)

I concur: I'm typing this from my home office in Palm Springs, and I'm a Director at Google.

Same here - not a the same level though :-) Undisclosed location from the European Alps - I've always worked remotely, even when my company HQs were in Sunnyvale and I was living a few blocks from the office.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#54

Post by fortyfivan »

radlad wrote: post #44
fortyfivan wrote: post #42

Earlier quoted context omitted.

Very true... the "ditch your VPN" sure is a nice soundbite, but in reality it's the last thing you should be doing. I mean that literally... as in it's the last step. Better know what you're doing before getting there. The first couple BeyondCorp papers talk a lot about how Google deployed this architecture side-by-side their traditional LAN, and slowly migrated applications over, only after closely inspecting and un…

I'm not sure I understand the argument you're making here. A VPN offers you direct access to all the servers within your internal network. The BeyondCorp model offers you proxied access to only particular applications that have been opened up based on a wide variety of checks on the user and device accessing the application. How is the latter going to be less secure than opening up your entire LAN to everyone who nee…

The point was that fundamentally the Internet is not safe, so companies will do the right things to secure their resources. So yes, in BeyondCorp this means running a proxy service that centralizes the auth workflow through policies that check the user and connecting device against the resource at the time of the request.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#55

Post by radlad »

thomashabets2 wrote: post #51
radlad wrote: post #46

Earlier quoted context omitted.

I think you misunderstood. My point is that you will still need direct access into the network in order to work on the BeyondCorp servers themselves, for example -- not that SSH shouldn't, or couldn't, be covered under the zero trust model as well.

Maybe. Are you saying that "the bootstraps" (panic access) is VPN? Why isn't the first level just an open SSH port? I'm not sure why "when all else fails" is better left a VPN port than an SSH port. I'd say SSH infrastructure (a server with only pubkey login, maybe behind TCP-MD5 and/or heavily filtered source addresses) is probably more reliable and safer than a VPN.

With a VPN you have two security layers -- one into the network, and a second one into each individual server.

They aren't mutually exclusive. Sure, you can leave SSH open publicly on WAN. I wouldn't for anything mission-critical.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#56

Post by thomashabets2 »

radlad wrote: post #55
thomashabets2 wrote: post #51

Earlier quoted context omitted.

Maybe. Are you saying that "the bootstraps" (panic access) is VPN? Why isn't the first level just an open SSH port? I'm not sure why "when all else fails" is better left a VPN port than an SSH port. I'd say SSH infrastructure (a server with only pubkey login, maybe behind TCP-MD5 and/or heavily filtered source addresses) is probably more reliable and safer than a VPN.

With a VPN you have two security layers -- one into the network, and a second one into each individual server. They aren't mutually exclusive. Sure, you can leave SSH open publicly on WAN. I wouldn't for anything mission-critical.

I did mention two other security layers, so I take issue with you counting only one.

Especially since the SSH access would obviously be on a dedicated jumpgate, so that IS two just right there. Maybe running a different OS and architecture just lower risk of one zero-day piercing both.

Also huproxy, or squid, or anything else that provides network-level access.

But I also think that if you consider network-level access as fundamentally different from other access then that's kinda missing the point of BeyondCorp.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#57

Post by donalhunt »

radlad wrote: post #44
fortyfivan wrote: post #42

Earlier quoted context omitted.

Very true... the "ditch your VPN" sure is a nice soundbite, but in reality it's the last thing you should be doing. I mean that literally... as in it's the last step. Better know what you're doing before getting there. The first couple BeyondCorp papers talk a lot about how Google deployed this architecture side-by-side their traditional LAN, and slowly migrated applications over, only after closely inspecting and un…

I'm not sure I understand the argument you're making here. A VPN offers you direct access to all the servers within your internal network. The BeyondCorp model offers you proxied access to only particular applications that have been opened up based on a wide variety of checks on the user and device accessing the application. How is the latter going to be less secure than opening up your entire LAN to everyone who nee…

There's a good video on the topic from this year's RSA conference here: https://www.rsaconference.com/events/us17/agenda/sessions/66...

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#58

Post by radlad »

thomashabets2 wrote: post #56
radlad wrote: post #55

Earlier quoted context omitted.

With a VPN you have two security layers -- one into the network, and a second one into each individual server. They aren't mutually exclusive. Sure, you can leave SSH open publicly on WAN. I wouldn't for anything mission-critical.

I did mention two other security layers, so I take issue with you counting only one. Especially since the SSH access would obviously be on a dedicated jumpgate, so that IS two just right there. Maybe running a different OS and architecture just lower risk of one zero-day piercing both. Also huproxy, or squid, or anything else that provides network-level access. But I also think that if you consider network-level acce…

> But I also think that if you consider network-level access as fundamentally different from other access then that's kinda missing the point of BeyondCorp.

I understand what you're saying here. I think to me, the point is, don't trust LAN access more than WAN access. But that doesn't mean that restricting LAN access is a bad idea. One of the benefits to BeyondCorp is that you don't (generally) require LAN access in order to access resources. But if your BeyondCorp server goes down, then what? How will you access it?

I probably still wouldn't want to expose my mission critical services over WAN (though I understand your point that VPN is a service exposed over WAN -- and why not SSH then?) Maybe that's wrong of me (I likely haven't given this as much thought as you), especially if you're using TCP-MD5 (which I actually haven't heard of until now, sorry for missing that), or filtering source IP addresses.

This is an interesting discussion, and I really appreciate your thoughtfulness. I'd love to hear more about huproxy and how it's working for you, if you'd care to discuss it more. My email is jmaguire@duo.com.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#59

Post by DorothySim »

madjam002 wrote: post #26

How is this different or more secure than let's say TLS client authentication with the private key on a smart card / Yubikey?

They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs alone are good for authentication (don't work in HTTP/2 though) but they want to reach even better target - no malicious software running on your computer.

That's from reading old papers, I don't know if anything changed now.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#60

Post by AceJohnny2 »

izacus wrote: post #8
yegle wrote: post #4

My ex-manager who left Google to another well established company once said the most missed thing from Google was the ability to work remotely right away on corp laptop with BeyondCorp. Disclaimer I work for Google not related to BeyondCorp.

I thought Google doesn't allow remote work?

Maybe you're confused with Yahoo?

https://www.fastcompany.com/3020930/yahoo-says-that-killing-...

They're very, very different companies/work culture :)

Post reply on HN