Earlier quoted context omitted.
I'm the one who wrote that patent (sorry).
Amazon or Google? One hour ago you posted that you're "a Director at Google". https://news.ycombinator.com/item?id=14597662
It's plausible that they changed jobs ;).
How to use BeyondCorp to ditch VPN, improve security and go to the cloud
91–100 of 163 posts
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#92Earlier quoted context omitted.
It seems from the article this is only being offered as a product to people already using Google Cloud services, specifically for accessing those services? Otherwise it's just a series of papers describing the system.
You're right, the initial version of Identity-Aware Proxy (IAP) is for Cloud applications, but that's not the end of the story, and we're learning from BeyondCorp's 7 year journey to inform the direction of IAP going forward. [I work at Google, and helped make these papers, and blog post, happen]
When are we going to hear about further contextual auth capabilities coming to IAP? It's awesome.
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#93Earlier quoted context omitted.
It seems from the article this is only being offered as a product to people already using Google Cloud services, specifically for accessing those services? Otherwise it's just a series of papers describing the system.
You're right, the initial version of Identity-Aware Proxy (IAP) is for Cloud applications, but that's not the end of the story, and we're learning from BeyondCorp's 7 year journey to inform the direction of IAP going forward. [I work at Google, and helped make these papers, and blog post, happen]
How do you use IAP with GKE?
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#94Is there a link to the actual (fourth) paper? I only see the abstract.
Working on that now, I think I messed up on my end with our internal tool, hope to have the full PDF download from research.google.com in a day or two, maybe next week if I epic failed. [I work at Google, and helped make these papers, and blog post, happen]
& add cross-link to things like google/huproxy ?
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#95Earlier quoted context omitted.
They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs alone are good for authentication (don't work in HTTP/2 though) but they want to reach even better target - no malicious software running on your computer. That's from reading old papers, I don't know if anything changed now.
That's correct. Previous papers touch on the inventory data pipeline and machine health, though without as much detail as I might like in your shoes. Our agents track a wide variety of things on client machines, and we use that inventory data to determine how trustworthy a machine could be. [I work at Google, and helped make these papers, and blog post, happen]
Also FYI- there's visible template code here: https://cloud.google.com/iap/docs/quickstart
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#96Earlier quoted context omitted.
You're right, the initial version of Identity-Aware Proxy (IAP) is for Cloud applications, but that's not the end of the story, and we're learning from BeyondCorp's 7 year journey to inform the direction of IAP going forward. [I work at Google, and helped make these papers, and blog post, happen]
How do you use IAP with GKE?
Haven't tried yet myself, but since the ingress resource is just an https load balancer, enable IAP on that. Like so: https://medium.com/@DazWilkin/google-cloud-iap-and-gke-c773d...
Edit more direct: https://cloud.google.com/iap/docs/container-engine-quickstar...
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#97Sorry this will come off as a super dumb question. I use ssh. I can login, edit, develop, run, basically anything. What am I missing? I thought VPNs are for 'admin' types that need access to a MS Excel file.
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#98Sorry this will come off as a super dumb question. I use ssh. I can login, edit, develop, run, basically anything. What am I missing? I thought VPNs are for 'admin' types that need access to a MS Excel file.
The VPN changes your network route. This can get you around geographic locks (services that only work in certain areas). It can also get you around traffic issues, if your ISP has technical/political routing issues. Like with Comcast/Verizon refusing to add additional peering because they wanted to double-bill netflix traffic.
Some VPN services also advertise additional privacy or anonymity, but trusting a stranger to not sell you out to their local government isn't usually a good idea.
From a business standpoint, you may want web and network services without exposing them to the wider internet. So they're only accessible on IPs in local subnets. VPNs will get you inside the wall.
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#99Great to see them continue this series, and glad that this one touches on what it takes for other companies to achieve something similar. I talk about BeyondCorp a lot as evidence that the Zero Trust model works, and that employees will love it. The most common feedback I get is that it seems like too much of a stretch for companies that don’t operate at Google scale. That may be true if looking at the system as a wh…
In case anyone is unfamiliar with them, ScaleFT is a leader in this space and a team of solid folks. They took the BeyondCorp paper and model and really ran with it. Worth listening.
Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud
#100Sorry this will come off as a super dumb question. I use ssh. I can login, edit, develop, run, basically anything. What am I missing? I thought VPNs are for 'admin' types that need access to a MS Excel file.
The VPN changes your network route. This can get you around geographic locks (services that only work in certain areas). It can also get you around traffic issues, if your ISP has technical/political routing issues. Like with Comcast/Verizon refusing to add additional peering because they wanted to double-bill netflix traffic. Some VPN services also advertise additional privacy or anonymity, but trusting a stranger t…
[deleted]