Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Beyond Zero: Enterprise Security for the AI Era

spawn-queue.acm.org

Post reply on HN
Print view View original

31–40 of 87 posts

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#31

Post by thesuitonym »

kriro wrote: post #25

""" Beyond Zero shifts the trust boundary from the application to the action being performed on a piece of data in realtime—and from after-the-fact investigation to in-the-moment evaluation and containment. It augments BeyondCorp’s foundational identity with a “brain” capable of reasoning about the context and intent of a specific request in realtime. """ Doesn't this simply shift the attack vector? Compromising this…

All security measures "simply shift the attack vector." The idea is to shift it to something that is more difficult to compromise.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#32

Post by insanitybit »

prmph wrote: post #29
skinfaxi wrote: post #26

Earlier quoted context omitted.

> This is going make things worse. Isn't this for enterprises managing access to corporate resources?

I'm talking about the general direction this is taking. I don't think once this is established in enterprises it is going to stop there.

That's not what the article advocates for though. This is about enterprise policy decisions for internal access.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#33

Post by YeahThisIsMe »

prmph wrote: post #22
insanitybit wrote: post #12

Earlier quoted context omitted.

This would be paired with deterministic controls. So you have, for example, "engineers can only read from the database, and only after they've perform a 2FA" but then there's context like "why is this engineer reading from the payments table when their IP is in a weird location and they're supposed to be on PTO?" and perhaps that's something a model decides. It's possible to turn that second thing into a sort of "ris…

This is going to make things worse for all kind of use cases that are legitimate but seem non-standard or marginal. Heck, many websites I visit on the web cannot understand why I, a Ghanaian living in Ghana, might be interested in the service offered or the information therein. I am sometimes blocked for no good reason. If you are in a third world country, the web is extra hostile. This is going make things worse.

It doesn't even take being in a "third world country".

Plenty of US websites are blocking access from EU IP addresses because of our data protection laws.

Local news companies are the biggest offenders in this regard.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#34

Post by insanitybit »

billyp-rva wrote: post #17
insanitybit wrote: post #12

Earlier quoted context omitted.

This would be paired with deterministic controls. So you have, for example, "engineers can only read from the database, and only after they've perform a 2FA" but then there's context like "why is this engineer reading from the payments table when their IP is in a weird location and they're supposed to be on PTO?" and perhaps that's something a model decides. It's possible to turn that second thing into a sort of "ris…

The engineer could be fixing an emergency issue while on vacation. For financial data, that would hopefully be an auto-deny anyway until someone on-site whitelists their IP. And this is if they aren't using VPNs. Adding AI to this party feels like it wouldn't really help.

> The engineer could be fixing an emergency issue while on vacation.

Okay, but that's why there are always loud "breakglass" escalation options for access.

> that would hopefully be an auto-deny anyway until someone on-site whitelists their IP

About as far from "zero trust" as any solution could be.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#35

Post by speed_spread »

exitheone wrote: post #4
urup2l8 wrote: post #2

Oh yeah, a company whose business model is taking everyone’s data and selling it is going to help me secure my data. I guess there’s one born every minute…

This trope is so tiring. There is a massive difference between Google for enterprise customers and Google for consumers. The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business. The Enterprise offering guarantees you contractually that they never touch your data.

In this case, they wouldn't touch your data but their AI safety system would also prevent you from accessing it!

What do you think their security model will be trained on? That's right, other people's data.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#36

Post by mooreds »

firasd wrote: post #5

Honestly I think non-malicious odd behavior is under-weighted when it comes to AI agents. Even the example in this paper is about someone suspiciously accessing sales data when "why did you do that" often comes down to something in the model's training that fired as a reflex I wrote about this a few days ago https://firasd.substack.com/p/accidental-data-loss-in-claude... "Many researchers have made demos along these…

> Preparing for AI agents means expanding auditability and reversibility in software

While I think that makes sense, I also think more controls are a good solution. That is, prevent access to the sales data without escalation, probably to a human, but possibly to another AI. The issue there is twofold:

- if you start with least privilege, the agents become less useful

- need to balance escalation with frequency otherwise it's just another version of MFA fatigue

Agree that auditability is important because otherwise you don't know what you don't know.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#37

Post by FailMore »

If this is interesting to you (as it is to me) but you want to quickly digest it instead of read the paper, Claude + SmallDocs[1] converted it into a slideshow which serves it to you in bitesized ideas:

https://smalldocs.org/s/2SH6FHiUK1mcym24Z8E37I#k=2Sk6c_IdKJL...

[1] I am the developer behind SmallDocs.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#38

Post by stingraycharles »

arccy wrote: post #9
stingraycharles wrote: post #3

Earlier quoted context omitted.

Where do you see them offering this service to you? They’re just publishing what they developed internally, which is what they often do. Now, Cloudflare, on the other hand, would be much more likely to offer a service like this.

you could probably buy it as part of BeyondCorp https://cloud.google.com/beyondcorp

Tell me where I can buy it then. Because it’s not listed there. And the approach the paper describes requires tight integration between applications and a security provider, which I don’t think exists yet.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#39

Post by BorisMelnik »

FailMore wrote: post #37

If this is interesting to you (as it is to me) but you want to quickly digest it instead of read the paper, Claude + SmallDocs[1] converted it into a slideshow which serves it to you in bitesized ideas: https://smalldocs.org/s/2SH6FHiUK1mcym24Z8E37I#k=2Sk6c_IdKJL... [1] I am the developer behind SmallDocs.

not sure if you made the app or not - I like it a lot, only feedback is it should be a bit more intuitive on how to start the slides, I couldn't figure it out and old ppl like me don't always know

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#40

Post by freshpots »

BorisMelnik wrote: post #39
FailMore wrote: post #37

If this is interesting to you (as it is to me) but you want to quickly digest it instead of read the paper, Claude + SmallDocs[1] converted it into a slideshow which serves it to you in bitesized ideas: https://smalldocs.org/s/2SH6FHiUK1mcym24Z8E37I#k=2Sk6c_IdKJL... [1] I am the developer behind SmallDocs.

not sure if you made the app or not - I like it a lot, only feedback is it should be a bit more intuitive on how to start the slides, I couldn't figure it out and old ppl like me don't always know

Press the arrow key.
Post reply on HN