Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Moves Its Corporate Applications to the Internet

blogs.wsj.com

Post reply on HN
Print view View original

41–50 of 155 posts

Re: Google Moves Its Corporate Applications to the Internet

#41

Post by passive »

dm2 wrote: post #31
passive wrote: post #20

As a remote worker, it's delightful to see things move in this direction, as VPNs are a regular thorn in my side. Of course, there's a certain irony that Google isn't fond of remote workers. :)

Why are VPNs a problem for you? It's hard to fully trust a person that is remote. Are they keeping your data safe? Another solution is the idea of Amazons virtual workspaces for remote workers, this allows the company to have more control over the computer that the employee is using.

My work has required daily VPN use over most of the past 7 years, and I have yet to find one that is reliable. I'm certain this has more to do with properly setting them up then an inherent flaw in the concept, but it still means when I can avoid them, I do.

Re: Google Moves Its Corporate Applications to the Internet

#42

Post by tjohns »

It's worth reading the original "BeyondCorp" paper that discusses this:

http://static.googleusercontent.com/media/research.google.co...

As some other folks have pointed out (and contrary to what the headline implies), there's isn't just setting your firewall to allow 0.0.0.0/0. In particular, pay attention to the Device Identity (client cert) and the Access Proxy parts.

Re: Google Moves Its Corporate Applications to the Internet

#43

Post by tracker1 »

istvan__ wrote: post #32
furyg3 wrote: post #13

We tried this where I worked (with the exception of the evil desktop app financial program)... and had to retract after a zero day defacement in one of our web apps. In the meantime we also learned that keeping all of your web apps 100% up to date at all times is really freaking difficult. The good news is that the (failed) attempt got us off of a few client side applications and made us much more platform agnostic t…

The only way to succeed with this is with heavy firewalling or VPNs. There are several unknown zero days in any application so just by opening up your application to 0.0.0.0/0 makes it possible for blackhats to get in. The only question is how much your information is worth for somebody. If you it is less than price of a brand new zero day you might be ok, but there are still the script kiddies and political blackhat…

There are different layers of firewall, and VPN isn't really the issue here.

You can still have location-aware servers that can talk to eachother directly. This should be done over an encrypted channel as much as possible.

As to firewalls, on each server only allowing access from those ports applications run on is probably a good start. Better still would be publicly facing machines that act as reverse-proxies to backing servers that run said applications.

As intimated only approved machines (likely with client certificates and pinning to mac addresses, and probably only a limited number of accounts beyond that) can tighten things farther.

Putting your exposed (internal use) applications facing the internet doesn't mean unlocking all the doors. There are ways to mitigate and reduce the effects of a 0-day vulnerability in practice. The fact is that by making it all available anywhere, makes you think of the risks in a way that is actually better in practice than just believing because you are behind a hard shell it isn't easy enough to get to the soft-gooey center.

A hardened system involves more than firewalls and vpn access. A properly hardened system should be able to run over the internet. TLS channels with certificate/mac pinning alone can go a long way in terms of communications, and is far more than a typical firewall/vpn setup would offer for protection. This goes from SSH to your internal services. For that matter not exposing anything beyond SSH, and requiring tunnels for all communications may be simpler still.

Mix in LDAP for access, with accounts, machines and certificates all tied together and you have a pretty good base recipe for a hardenned system. That said, this isn't the only approach, just me rambling on about the ideas. There is overhead in terms of development, operations and management to setup such a system. Not everyone can implement such a system, given what they may be starting from. A smaller company would have an easier time for many cases than a larger company. It may require the use of a windows terminal server behind a secured channel in order to keep some critical applications (likely wrt finance). Other applications may be excessively costly to migrate, and others still may not have the necessary protections.

Given that most internal applications are web based these days it is slightly easier than at any other time in computing history.

Re: Google Moves Its Corporate Applications to the Internet

#44

Post by NovaS1X »

"The Cloud" that they're talking about is their own datacenters (they're certianly not using EC2) and they're hosting their web-apps over a WAN without VPNs or other traditional forms of closing off access.

However, this doesn't say much about their datacenters which will still be heavily firewalled. IPMI, SSH, and other access wouldn't be shared over a wide open WAN. The "Cloud" (see: datacenter) LAN will still be protected traditionally.

This article doesn't have enough information in my opinion.

Re: Google Moves Its Corporate Applications to the Internet

#45

Post by jklein11 »

wahsd wrote: post #33
stephengillie wrote: post #23

Earlier quoted context omitted.

Few workplaces are fond of remote workers. The major reason a lot of people remain employed is so they have a purpose to wake up, leave their houses, and spend the day occupied by the relative comfort of an office building, surrounded by reasonably-intelligent coworkers, as a faux-family. And it's a slap in their face that you don't want to spend your time basking in their physical proximity.

Interesting way of putting that perspective. I have been trying to put my finger on the whole remote working issue for a while. What you expressed is one aspect to the issue, but I also think that it is probably just an intermediary symptom, a phantom / false cause if you will. Personally I think we would see a lot more remote working and even a social revolution if at very least the incentives for physical office sp…

Could you explain what you mean about the incentives from tax and accounting policy? Are you saying that tax benefits for having office space are richer than the actual expense of renting that office space?

Re: Google Moves Its Corporate Applications to the Internet

#46

Post by dragonwriter »

rdl wrote: post #40

This kills BYOD, right, at least for now? "Employees can only access corporate applications with a device that is procured and actively managed by the company"

It seems to me that any company whose business involves providing secure web apps to external users (who aren't using devices specially trusted by the company providing the service) ought to be able to provide its corporate applications on the same basis.

Re: Google Moves Its Corporate Applications to the Internet

#47

Post by passive »

mahyarm wrote: post #36
stephengillie wrote: post #23

Earlier quoted context omitted.

Few workplaces are fond of remote workers. The major reason a lot of people remain employed is so they have a purpose to wake up, leave their houses, and spend the day occupied by the relative comfort of an office building, surrounded by reasonably-intelligent coworkers, as a faux-family. And it's a slap in their face that you don't want to spend your time basking in their physical proximity.

Communication and management overhead of remote workers is harder to do right. Like functional programming.

This is absolutely true also, but it is generally easier to address than the need for physical interaction often felt by people in management. (I'm not trying to be derogatory here, as good physical interaction is often closely tied to a manager's success, so it's natural that they would be wary of removing that aspect of their relationships.)

Re: Google Moves Its Corporate Applications to the Internet

#49

Post by rixed »

istvan__ wrote: post #32
furyg3 wrote: post #13

We tried this where I worked (with the exception of the evil desktop app financial program)... and had to retract after a zero day defacement in one of our web apps. In the meantime we also learned that keeping all of your web apps 100% up to date at all times is really freaking difficult. The good news is that the (failed) attempt got us off of a few client side applications and made us much more platform agnostic t…

The only way to succeed with this is with heavy firewalling or VPNs. There are several unknown zero days in any application so just by opening up your application to 0.0.0.0/0 makes it possible for blackhats to get in. The only question is how much your information is worth for somebody. If you it is less than price of a brand new zero day you might be ok, but there are still the script kiddies and political blackhat…

> There are several unknown zero days in any application

I think you want all your applications to authenticate the device and the user before proceeding to anything. This looks indeed impossible with third party closed source apps (if only because you can never be sure there is no backdoor).

Then, even if you authenticate every remote peers using TLS client certificates, you have to follow closely the vulnerabilities of your TLS implementation... But that should not be less manageable than to make sure your firewalls are reliable.

Re: Google Moves Its Corporate Applications to the Internet

#50

Post by passive »

beachstartup wrote: post #39
mahyarm wrote: post #36

Earlier quoted context omitted.

Communication and management overhead of remote workers is harder to do right. Like functional programming.

with modern software, it's only hard to do right if they're not at their laptop/workstation. which means they're doing some other shit other than working. our entire team is remote. it's really obvious when someone isn't at their computer. it's basically the only hard requirement of the job beyond the work product - be at your computer when you say you are going to be at your computer.

Management isn't just about who's working or not. There's a lot of what makes a successful team that requires careful consideration to replicate when everyone is remote. Yes, modern technology makes much of this easier, but it still requires effort to identify and address, whereas it is somewhat automatic at physical offices.

For example, "water cooler" conversations. In a physical office these happen because people are conditioned to make small talk. That is not the case virtually, as it's easy to spend an entire day in a chat room with a co-worker and never interact with them.

Post reply on HN