Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google's Beyond Zero: Enterprise Security for the AI Era

spawn-queue.acm.org

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#71

Post by madeofpalk »

antonvs wrote: post #64
thesuitonym wrote: post #31

Earlier quoted context omitted.

All security measures "simply shift the attack vector." The idea is to shift it to something that is more difficult to compromise.

This is oversimplifying. For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as a result, but only because an avenue was blocked. That's very different from e.g. adding a layer of protection around something insecure, where the insecure thing remains insecure inside the protection, which I think is what the other commenter was imagining. S…

Doesn’t encryption shift the attack vector to the key and/or the method?

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#72

Post by seanc »

My goodness, the security layer looks like it could be more complex than the applications themselves.

And if this security agent is wandering around the IT system gathering all of these details about access and identity and business process, who watches the watcher? How does that thing build and maintain trust?

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#73

Post by rawgabbit »

galactushonor wrote: post #60
rawgabbit wrote: post #56

Earlier quoted context omitted.

Before zero trust, once you logged in, you have access to the entire kingdom of resources/files/APIs etc. To me, this sounds like zero trust version 2.0. The "brain" challenges agentic AI trying to access resources it normally doesn't access. Personally, I like the name "Beyond Zero" because it isn't oxymoronic like "Zero Trust".

I have a simple question. When a company gets compromised, how come there are no alarms when TBs of data gets egressed?

Organizations today run every SAAS under the sun. Files and data are wired up in a hodgepodge with security usually being an afterthought. There are companies like Big Banks that do monitor all network traffic including traffic to their provisioned Google Drive or Clickhouse. A lot of companies only have logs which they feed to an alerting system which is after the fact.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#74

Post by antonvs »

ikiris wrote: post #69
antonvs wrote: post #64

Earlier quoted context omitted.

This is oversimplifying. For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as a result, but only because an avenue was blocked. That's very different from e.g. adding a layer of protection around something insecure, where the insecure thing remains insecure inside the protection, which I think is what the other commenter was imagining. S…

What? Encryption has never eliminated attack vectors, it just shifts them to weaknesses in the implementation

Eliminating an attack vector means stopping a specific path or method that can be used to break into a system.

"Shift" in this context means that the attacker has to use a different attack vector. They can no longer just access plain text.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#75

Post by antonvs »

madeofpalk wrote: post #71
antonvs wrote: post #64

Earlier quoted context omitted.

This is oversimplifying. For example, encryption at rest or in transit essentially eliminates attack vectors. The possible attack avenues necessarily shift as a result, but only because an avenue was blocked. That's very different from e.g. adding a layer of protection around something insecure, where the insecure thing remains insecure inside the protection, which I think is what the other commenter was imagining. S…

Doesn’t encryption shift the attack vector to the key and/or the method?

That's a different attack vector. The attack vector that involves accessing plain text has been eliminated. An attack vector is a specific path or method that can be used to break into a system.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#76

Post by aniceperson »

FailMore wrote: post #37

If this is interesting to you (as it is to me) but you want to quickly digest it instead of read the paper, Claude + SmallDocs[1] converted it into a slideshow which serves it to you in bitesized ideas: https://smalldocs.org/s/2SH6FHiUK1mcym24Z8E37I#k=2Sk6c_IdKJL... [1] I am the developer behind SmallDocs.

really nice project! I would never consider websockets for the bridge mode, why do browsers allow websockets to localhost crossing domains ahah

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#77

Post by nitwit005 »

> In this scenario, a system administrator logs into a service as usual, but in another window is looking up basic questions about the architecture of the system—information that would be obvious to anyone experienced at the company. These signals are placed in long-term storage but are then processed into an attribute indicating potential risk.

Every system admin is going to send that signal. People pin pictures of the architecture to the walls sometimes.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#78

Post by orf »

antonvs wrote: post #75
madeofpalk wrote: post #71

Earlier quoted context omitted.

Doesn’t encryption shift the attack vector to the key and/or the method?

That's a different attack vector. The attack vector that involves accessing plain text has been eliminated. An attack vector is a specific path or method that can be used to break into a system.

> That's a different attack vector

So you’re saying that the attack vector has… shifted.

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#79

Post by antonvs »

orf wrote: post #78
antonvs wrote: post #75

Earlier quoted context omitted.

That's a different attack vector. The attack vector that involves accessing plain text has been eliminated. An attack vector is a specific path or method that can be used to break into a system.

> That's a different attack vector So you’re saying that the attack vector has… shifted.

No. The attack vector has changed to a different attack vector.

In English, the word "the" in "the attack vector has shifted" is a definite article that refers to a single attack vector.

If your car breaks down and you switch to using a different car, would you say "the car has shifted"?

Speaking loosely, one might use "the attack vector has shifted" to mean something like "the possible attack vectors have changed", but that kind of looseness is misleading in an absolute claim like the one I originally responded to, about "all security measures". In fact, it would be more accurate to say that no security measures "shift the attack vector".

Re: Google's Beyond Zero: Enterprise Security for the AI Era

#80

Post by kbart »

galactushonor wrote: post #60
rawgabbit wrote: post #56

Earlier quoted context omitted.

Before zero trust, once you logged in, you have access to the entire kingdom of resources/files/APIs etc. To me, this sounds like zero trust version 2.0. The "brain" challenges agentic AI trying to access resources it normally doesn't access. Personally, I like the name "Beyond Zero" because it isn't oxymoronic like "Zero Trust".

I have a simple question. When a company gets compromised, how come there are no alarms when TBs of data gets egressed?

That's a survirvorship bias - we normally only hear of the attacks that succeed, not the ones that have been successfully prevented.
Post reply on HN