Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use BeyondCorp to ditch VPN, improve security and go to the cloud

blog.google

Post reply on HN
Print view View original

121–130 of 163 posts

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#121

Post by jgsec »

I commend the Google team for not only deploying an effective and innovative security solution, but also for contributing to security community through this series of informative articles.

Enterprises need to know that while BeyondCorp is Google-specific, there are similar types of open architectures that they can deploy today, most notably the Software-Defined Perimeter (SDP).

SDP is an open architecture from the Cloud Security Alliance, and with it security teams can ensure that:

. All users are authenticated and authorized BEFORE they can access network resources

. Network resources are inaccessible to unauthorized users, dramatically reducing the attack surface

. Fine-grained policies control access for all users – remote and on-premises – to all resources , whether physical, virtual, or cloud

. All network traffic is encrypted, even if the underlying protocol is insecure

Here’s a video of me presenting on Software-Defined Perimeter at the CSA Summit at the 2017 RSA Conference https://www.youtube.com/watch?v=ysi_9c5fmBg and a brief overview from our corporate site https://www.cryptzone.com/products/appgate/why-a-software-de...

Disclaimer: I led the CSA’s Software-Defined Perimeter working group publication of SDP-for-IaaS, and am leading the current effort to create an SDP Architecture Guide. I also work at Cryptzone, an SDP platform vendor.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#122

Post by e12e »

maxsaltonstall wrote: post #69
DorothySim wrote: post #59

Earlier quoted context omitted.

They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs alone are good for authentication (don't work in HTTP/2 though) but they want to reach even better target - no malicious software running on your computer. That's from reading old papers, I don't know if anything changed now.

That's correct. Previous papers touch on the inventory data pipeline and machine health, though without as much detail as I might like in your shoes. Our agents track a wide variety of things on client machines, and we use that inventory data to determine how trustworthy a machine could be. [I work at Google, and helped make these papers, and blog post, happen]

How is trust anchored?

There's tpm and secure boot - does the (presumably signed, in the trusted boot->os->user binary/service-path) agent access signing services from tpm - backed by a key in tpm, and use that to identify itself as an authentic agent?

Otherwise I can't see how an (admin) user couldn't extract the key from ram and run the os and agent in a vm?

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#123

Post by brandon »

zxv wrote: post #82

Part 3 [0] discusses "Wrapping SSH traffic in HTTP over TLS." Can one comfortably do coding over a good cellular (LTE) connection over this? I ask because, I find it relatively comfortable to do coding on a chromebook over a 'mosh' session over LTE. [0] https://static.googleusercontent.com/media/research.google.c...

The actual framing is WebSockets over TLS once the session is established and the latency is no worse than SSH over VPN practically speaking.

The protocol also supports session resumption in case your connection to the relays is briefly interrupted, but client support is buggy so it's been disabled for years (with few complaints)

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#124

Post by e12e »

londons_explore wrote: post #90
zxv wrote: post #82

Part 3 [0] discusses "Wrapping SSH traffic in HTTP over TLS." Can one comfortably do coding over a good cellular (LTE) connection over this? I ask because, I find it relatively comfortable to do coding on a chromebook over a 'mosh' session over LTE. [0] https://static.googleusercontent.com/media/research.google.c...

To get good performance, one would need a BeyondCorp enabled mosh proxy. With plain SSH over HTTP over TLS, performance is satisfactory but not great. 4G is just about usable for vim, but you'd probably be best off using sshfs over http over tls and running vim locally, then compiling and running remotely.

Git/mercurial over ssh and preform actions on push?

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#125

Post by brandon »

ransom1538 wrote: post #97

Sorry this will come off as a super dumb question. I use ssh. I can login, edit, develop, run, basically anything. What am I missing? I thought VPNs are for 'admin' types that need access to a MS Excel file.

Google's model allows SSH to "internal machines" over a set of relays that apply the same machine authentication and trust tier logic that's laid out in the papers.

So your workflow would still be supported, and it would likely be more secure than exposing SSH traffic to the internet at large.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#126

Post by yegle »

VectorLock wrote: post #104
yegle wrote: post #4

My ex-manager who left Google to another well established company once said the most missed thing from Google was the ability to work remotely right away on corp laptop with BeyondCorp. Disclaimer I work for Google not related to BeyondCorp.

Is logging into a VPN in 3 seconds and starting to work not "right away" enough?

Maintaining a stateful VPN connection is much harder than making a stateless HTTP request.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#127

Post by j_s »

noinsight wrote: post #101
DorothySim wrote: post #59

Earlier quoted context omitted.

They also take into account the state of the machine you're working on. So locked bootloader and probably a client cert in TPM-like component, plus "device health". Client certs alone are good for authentication (don't work in HTTP/2 though) but they want to reach even better target - no malicious software running on your computer. That's from reading old papers, I don't know if anything changed now.

> Client certs alone are good for authentication (don't work in HTTP/2 though) Um, what? Did client certs get removed from HTTP 2?

I have been collecting conflicting reports on HTTP/2 client certificate support:

14 months ago: "No. But TLS!" https://news.ycombinator.com/item?id=11556762

7 months ago: "421" https://news.ycombinator.com/item?id=13022596

Maybe it would be worth the time to test out the various implementations if someone has not already done so?

--

Doing some preliminary research, support is still a working draft https://datatracker.ietf.org/doc/draft-bishop-httpbis-http2-... source: https://daniel.haxx.se/blog/2016/08/18/http2-connection-coal...

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#128

Post by obstinate »

JeremyBanks wrote: post #115
milesward wrote: post #47

Earlier quoted context omitted.

I concur: I'm typing this from my home office in Palm Springs, and I'm a Director at Google.

Directors might get to work remotely. Good for you. I hope you enjoy Palm Springs while your reports are trapped on 101. Mere Developers are essentially never permitted to work remotely long-term. Google would rather lose someone valuable like Tim Bray to a major competitor than allow him to do so. If you're a global subject expert like Professor Hinton, maybe you'll be accommodated, but you dare don't mislead people…

Probably more dependent on one's immediate manager and/or chain than on company wide policy.

Personally, I would not want to report to someone who spends the majority of time remote. But maybe this person is a really great boss.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#129

Post by obstinate »

zxv wrote: post #82

Part 3 [0] discusses "Wrapping SSH traffic in HTTP over TLS." Can one comfortably do coding over a good cellular (LTE) connection over this? I ask because, I find it relatively comfortable to do coding on a chromebook over a 'mosh' session over LTE. [0] https://static.googleusercontent.com/media/research.google.c...

Yes, although I tend to use SSHFS and a local editor. Even a cellular quality connection is not required. It works fine from an airplane.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#130

Post by whyagaindavid »

sooper wrote: post #111
com2kid wrote: post #31

With productivity apps being cloud hosted (Office 365, Google Docs, Tableau, PowerBI, etc) and with source code and team management services being hosted (Github, Visual Studio Online, Gitlab, etc) huge percent of people's day to day work can seemingly happens without a VPN. The largest notable exceptions seem to be internal file shares, and remote connections to machines that need to be behind a firewall. I guess th…

"The largest notable exceptions seem to be internal file shares, and remote connections to machines that need to be behind a firewall." Office 365 / OneDrive and Google Drive are even doing away with the requirement for internal fileshares. We used the former heavily at my previous job and I use the latter in my current role. Both have been pretty good alternatives.

I am looking for ideas to control hardware connrcted to PC. We use vnc-viewer now. Can beyondcorp help here?
Post reply on HN