Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to use BeyondCorp to ditch VPN, improve security and go to the cloud

blog.google

Post reply on HN
Print view View original

31–40 of 163 posts

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#31

Post by com2kid »

With productivity apps being cloud hosted (Office 365, Google Docs, Tableau, PowerBI, etc) and with source code and team management services being hosted (Github, Visual Studio Online, Gitlab, etc) huge percent of people's day to day work can seemingly happens without a VPN.

The largest notable exceptions seem to be internal file shares, and remote connections to machines that need to be behind a firewall.

I guess the overall point I have is that with the data files for both productivity and source code being stored cloud side, that VPNs become less and less necessary for a large % of workers.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#32

Post by api »

This is really awesome. My own venture ZeroTier (www.zerotier.com) was strongly influenced by the original BeyondCorp paper. Our vision is a little different in that we do network virtualization that treats the whole world like one data center. Instead of eliminating the LAN you make it fully virtual and mobile and replace the physical perimeter with a cryptographic one.

Here's a somewhat over-simplified TL;DR on Google's approach:

Make everything in your company a SaaS app that lives on the Internet via cloud hosting or a proxy.

Nice but not always readily do-able.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#34

Post by api »

fortyfivan wrote: post #24

Great to see them continue this series, and glad that this one touches on what it takes for other companies to achieve something similar. I talk about BeyondCorp a lot as evidence that the Zero Trust model works, and that employees will love it. The most common feedback I get is that it seems like too much of a stretch for companies that don’t operate at Google scale. That may be true if looking at the system as a wh…

The major barrier is really for companies that lack a lot of internal IT expertise. It's really dangerous for people who don't understand security and networking to just open up like this, since most enterprise software is grotesquely insecure out of the box. Everyone assumes LAN = safe = no need to worry about security. This is always false, but it's especially false if you're devolving away from LAN.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#35

Post by manigandham »

devoply wrote: post #6

Yes turn keys over to Google. I am sure if you are an American Fortune 500 company you have no problem with this. Not so if you are a non-American company. Though a lot of people will jump on board despite the huge security implications of doing something like this and turning over all your security over to Google. Meanwhile nation states are exploring how to use quantum encryption to prevent eaves dropping others ar…

It's a way of doing things, nothing specific to Google.

Use any authentication/identity service and publish all internal services as public apps, consolidating access, increasing security, and simplifying maintenance.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#36

Post by manigandham »

This seems so completely obvious that it's surprising how common intranets and internal services locked only by network rules are.

Also highly recommend https://www.scaleft.com/ for anyone who wants beyondcorp-style access to infrastructure.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#37

Post by fulafel »

metalliqaz wrote: post #2

Interesting. This will never happen at my big company, though. Seems hard to imagine most companies being able to manage the complexity.

Trying to secure a traditional corporate "intranet" while enabling productive work is much harder. This is just branded common sense end to end security.

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#39

Post by EGreg »

theDoug wrote: post #17
izacus wrote: post #8

Earlier quoted context omitted.

I thought Google doesn't allow remote work?

This is incorrect! I began as a full-time remote employee and stayed so for 16 months until it made more sense for me to move to HQ. There are hundreds of remote workers, but being local has definitely allowed me to not need to rely on email and video chats so heavily. (Disclosure: Google employee)

How does one request full-time work in the interview? Is it normal to do it during the onboarding process?

Re: How to use BeyondCorp to ditch VPN, improve security and go to the cloud

#40

Post by __jal »

ryanmarsh wrote: post #16
JoshMnem wrote: post #7

Yesterday, I saw an article[1] about Amazon's plans to block websites in their stores (a very bad thing) and was wondering when a company like Google was going to launch a VPN service. I wonder if these things will meet in the long term. If companies that control the network try to limit access to information about their competitors, then their competitors might try to liberate that information. [1] http://gizmodo.co…

This should be seen as a defensive move so they can sue anyone who comes to market with a product that blocks the shopper's ability to search Amazon while in a given store. Showrooming benefits Amazon and will continue to until they have a majority of retail space (never).

Back in the day, the one-click patent was claimed to be defensive, too.

These decisions tend to be opportunistic. Or maybe a holder honestly convinces themselves that this particular offensive use is really a "defensive" move.

I give these sorts of declarations the same value I give crime-law proposals where someone pushing it declares that it would never be used in that way.

Post reply on HN