Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Beyond Zero: Enterprise Security for the AI Era

spawn-queue.acm.org

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#61

Post by preommr »

exitheone wrote: post #4
urup2l8 wrote: post #2

Oh yeah, a company whose business model is taking everyone’s data and selling it is going to help me secure my data. I guess there’s one born every minute…

This trope is so tiring. There is a massive difference between Google for enterprise customers and Google for consumers. The consumer offering is massively subsidized by ads and will use your data for ad placement, although they still never sell your data because that would hurt their business. The Enterprise offering guarantees you contractually that they never touch your data.

> This trope is so tiring.

While I also find it annoying, the alternative of just rolling over and being desensitized to it is much, much worse.

If we're going to be wrong, I'd rather be wrong by being overly cautious than overly trusting.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#62

Post by vouaobrasil »

This is exactly why big tech companies love AI. It's not because it will take every job - it probably won't. It's not because it will achieve AGI. It probably won't. It's because it threatens security with more subtle, advanced, and automated exploits so that you'll HAVE to rely on them for countermeasures.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#63

Post by mannanj »

I wonder: Could your data be more secure if you didn't give its custody to a company like Google? i.e. is there actually a sound basis that an alternative like taking control of your data and securing it yourself, would be more secure that the "banks exist to protect you" type of fear-mongered custodian idea against the self-ownership of things?

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#64

Post by antonvs »

thesuitonym wrote: post #31
kriro wrote: post #25

""" Beyond Zero shifts the trust boundary from the application to the action being performed on a piece of data in realtime—and from after-the-fact investigation to in-the-moment evaluation and containment. It augments BeyondCorp’s foundational identity with a “brain” capable of reasoning about the context and intent of a specific request in realtime. """ Doesn't this simply shift the attack vector? Compromising this…

All security measures "simply shift the attack vector." The idea is to shift it to something that is more difficult to compromise.

This is oversimplifying.

For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as a result, but only because an avenue was blocked.

That's very different from e.g. adding a layer of protection around something insecure, where the insecure thing remains insecure inside the protection, which I think is what the other commenter was imagining.

Similarly, memory safe languages (including most GC languages, not just a certain language beginning with R) eliminate entire classes of security hole. Again, the possible attack vectors necessarily "shift", but that doesn't capture the fact that you've entirely eliminated a class of attacks.

The same goes for eliminating unnecessary services, firewall holes, etc.

None of these are specifically trying to "shift it to something to something that is more difficult to compromise." They're entirely blocking attack vectors, and the strength or weakness of other parts of the system aren't really a factor.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#65

Post by idkyall »

galactushonor wrote: post #60
rawgabbit wrote: post #56

Earlier quoted context omitted.

Before zero trust, once you logged in, you have access to the entire kingdom of resources/files/APIs etc. To me, this sounds like zero trust version 2.0. The "brain" challenges agentic AI trying to access resources it normally doesn't access. Personally, I like the name "Beyond Zero" because it isn't oxymoronic like "Zero Trust".

I have a simple question. When a company gets compromised, how come there are no alarms when TBs of data gets egressed?

At a high level it's possible to alarm on data egress, but at the same time it depends on the type and degree of compromise we're discussing and how the attacker exfiltrates the data. If an intruder isn't detected, they could slowly egress the data to borrowed residential IPs, rather than a giant multi TB transfer that might set off more obvious alarms. For a large enough organization with substantial outbound traffic to start, it can become incredibly hard to distinguish from legitimate activity.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#66

Post by skybrian »

Maybe this is more interesting in the context of the HuggingFace incident? Suppose you have an AI and some access controls for what it can do. If the access control is too broad or has a bug, can you still detect suspicious activity and slow it down long enough for someone to be alerted?

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#68

Post by didibus »

oscarcp wrote: post #6

Am I undertanding this correctly? The idea is to have ultimately an AI decide if I can have access to a resource based on dynamic inference, identity , intent and service signals that can easily be manipulated? Unless I gravely misunderstood the text, this seems like a terrible idea (fancy non-scifi, but still terrible)

I feel some systems already operate like this, but typically it was done for fraud and abuse, now it will be done for permissions as well.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#69

Post by ikiris »

antonvs wrote: post #64
thesuitonym wrote: post #31

Earlier quoted context omitted.

All security measures "simply shift the attack vector." The idea is to shift it to something that is more difficult to compromise.

This is oversimplifying. For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as a result, but only because an avenue was blocked. That's very different from e.g. adding a layer of protection around something insecure, where the insecure thing remains insecure inside the protection, which I think is what the other commenter was imagining. S…

What? Encryption has never eliminated attack vectors, it just shifts them to weaknesses in the implementation
Post reply on HN