3 ms·

I'm not sure I understand the argument you're making here. A VPN offers you direct access to all the servers within your internal network. The BeyondCorp model

by johnmaguire2013 9y ago

I'm not sure I understand the argument you're making here. A VPN offers you direct access to all the servers within your internal network. The BeyondCorp model offers you proxied access to only particular applications that have been opened up based on a wide variety of checks on the user and device accessing the application. How is the latter going to be less secure than opening up your entire LAN to everyone who needs to access a single resource?

fortyfivan 9y ago
The point was that fundamentally the Internet is not safe, so companies will do the right things to secure their resources. So yes, in BeyondCorp this means running a proxy service that centralizes the auth workflow through policies that check the user and connecting device against the resource at the time of the request.
- maxsaltonstall 9y ago
  Exactly. And because you can't be sure that the intervening network is safe, you need to encrypt all the traffic, even after checking authorization and authentication. That's the BeyondCorp mission at Google. [Disclaimer: I work for Google, and worked on these papers and blog post]
donalhunt 9y ago
There's a good video on the topic from this year's RSA conference here: https://www.rsaconference.com/events/us17/agenda/sessions/6602-How-Google-Protects-Its-Corporate-Security-Perimeter-without-Firewalls https://www.rsaconference.com/events/us17/agenda/sessions/66...