Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use BeyondCorp to ditch VPN, improve security and go to the cloud

blog.google

Post reply on HN
Print view View original

111–120 of 163 posts

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#111

Post by sooper »

com2kid wrote: post #31

With productivity apps being cloud hosted (Office 365, Google Docs, Tableau, PowerBI, etc) and with source code and team management services being hosted (Github, Visual Studio Online, Gitlab, etc) huge percent of people's day to day work can seemingly happens without a VPN. The largest notable exceptions seem to be internal file shares, and remote connections to machines that need to be behind a firewall. I guess th…

"The largest notable exceptions seem to be internal file shares, and remote connections to machines that need to be behind a firewall."

Office 365 / OneDrive and Google Drive are even doing away with the requirement for internal fileshares. We used the former heavily at my previous job and I use the latter in my current role. Both have been pretty good alternatives.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#112

Post by nunez »

izacus wrote: post #8
yegle wrote: post #4

My ex-manager who left Google to another well established company once said the most missed thing from Google was the ability to work remotely right away on corp laptop with BeyondCorp. Disclaimer I work for Google not related to BeyondCorp.

I thought Google doesn't allow remote work?

they do; many teams discourage it though

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#113

Post by nunez »

milesward wrote: post #47
theDoug wrote: post #17

Earlier quoted context omitted.

This is incorrect! I began as a full-time remote employee and stayed so for 16 months until it made more sense for me to move to HQ. There are hundreds of remote workers, but being local has definitely allowed me to not need to rely on email and video chats so heavily. (Disclosure: Google employee)

I concur: I'm typing this from my home office in Palm Springs, and I'm a Director at Google.

how long did it take for you to obtain clearance on that?

i tried to create a plan to go remote within a year of starting, and i was told that people WAY more senior than me have tried and failed to go remote

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#114

Post by nunez »

maxsaltonstall wrote: post #64
DorothySim wrote: post #52

Earlier quoted context omitted.

I think the only restriction is working on Google approved hardware so no BYOD there. (Disclosure: not a Google employee).

Bring Your Own Device is fine for ChromeOS and Mobile. You might not get the full amount of trust as a Google-issued device (for mobile/tablet). To achieve the highest levels of access in the BeyondCorp model you need a machine with Google's management agents, so we can evaluate device state accurately and pull information from our inventory management system.

you can't clone code from a non-Google-approved device so if you write code you might as well have a google issued machine

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#115

Post by JeremyBanks »

milesward wrote: post #47
theDoug wrote: post #17

Earlier quoted context omitted.

This is incorrect! I began as a full-time remote employee and stayed so for 16 months until it made more sense for me to move to HQ. There are hundreds of remote workers, but being local has definitely allowed me to not need to rely on email and video chats so heavily. (Disclosure: Google employee)

I concur: I'm typing this from my home office in Palm Springs, and I'm a Director at Google.

Directors might get to work remotely. Good for you. I hope you enjoy Palm Springs while your reports are trapped on 101.

Mere Developers are essentially never permitted to work remotely long-term. Google would rather lose someone valuable like Tim Bray to a major competitor than allow him to do so.

If you're a global subject expert like Professor Hinton, maybe you'll be accommodated, but you dare don't mislead people into believing it's remotely common. That would be a lie.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#116

Post by brazzledazzle »

brianhama wrote: post #110

This sounds a lot like Microsoft's DirectAccess which has been in the Enterprise version of Windows since Windows 8. Please correct me if I'm wrong though.

Kind of. Microsoft sold it more as an always-on VPN. They weren't selling a radically different philosophy for securing your network with it. But regardless of the differences Microsoft really hamstrung themselves by making it so Windows centric.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#117

Post by closeparen »

api wrote: post #34
fortyfivan wrote: post #24

Great to see them continue this series, and glad that this one touches on what it takes for other companies to achieve something similar. I talk about BeyondCorp a lot as evidence that the Zero Trust model works, and that employees will love it. The most common feedback I get is that it seems like too much of a stretch for companies that don’t operate at Google scale. That may be true if looking at the system as a wh…

The major barrier is really for companies that lack a lot of internal IT expertise. It's really dangerous for people who don't understand security and networking to just open up like this, since most enterprise software is grotesquely insecure out of the box. Everyone assumes LAN = safe = no need to worry about security. This is always false, but it's especially false if you're devolving away from LAN.

The illusion that it's okay to run cleartext, unauthenticated services on an internal network is also pretty dangerous. Making it clear that the network is out in public might actually yield a better security posture overall.

If an organization is doing 802.1x, competently manages its endpoints (this is a tiny, tiny fraction of "managed" Windows sites), etc then maybe a BeyondCorp-style architecture is a net loss of security.

If an attacker can waltz into a conference room or exploit some salesperson's IE6 and start making requests from the "secure" network, probably best to make it obvious that there is no secure network.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#118

Post by maxsaltonstall »

fortyfivan wrote: post #54
radlad wrote: post #44

Earlier quoted context omitted.

I'm not sure I understand the argument you're making here. A VPN offers you direct access to all the servers within your internal network. The BeyondCorp model offers you proxied access to only particular applications that have been opened up based on a wide variety of checks on the user and device accessing the application. How is the latter going to be less secure than opening up your entire LAN to everyone who nee…

The point was that fundamentally the Internet is not safe, so companies will do the right things to secure their resources. So yes, in BeyondCorp this means running a proxy service that centralizes the auth workflow through policies that check the user and connecting device against the resource at the time of the request.

Exactly. And because you can't be sure that the intervening network is safe, you need to encrypt all the traffic, even after checking authorization and authentication. That's the BeyondCorp mission at Google. [Disclaimer: I work for Google, and worked on these papers and blog post]

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#120

Post by maxsaltonstall »

maxsaltonstall wrote: post #62
rayvd wrote: post #61

Dumb question - is the 4th article in the series only available via ;login;[1]? The other articles in the series have PDF links, but not the latest one. I'm assuming it will eventually... [1] https://www.usenix.org/publications/login/summer2017/peck

I think that was my mistake, the PDF is in the pipeline, expect it live within a week.

Blog post now links to downloadable PDF
Post reply on HN