4 ms·

Google also is running (or claims to be running, I don't work at their IT department) an interesting zero-trust-networking setup involving a lot of on the fly c

by hguant 7y ago

Google also is running (or claims to be running, I don't work at their IT department) an interesting zero-trust-networking setup involving a lot of on the fly certificate generation and revocation, as well as some SDN trickery behind the scenes. I wouldn't be surprised if that had more to do with their no haxx than 2FA or hardware auth keys. Link to their somewhat vague white papers on the matter: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/

nickpsecurity 7y ago
Security by obfuscation of techniques involved. Classic trick. It's the best so long as each security measure and their interactions are fairly secure.
- opportune 7y ago
  I would say obfuscation is a valid strategy if also coupled with good security practices / algorithmic security. You're no less secure than if you were using the common flavors of good security practices (assuming you didn't create a mistake in rolling your own, which is a difficult assumption) but the effort required to target you is much higher than normal, and you are somewhat shielded from blanket-applying zero days.
xenospn 7y ago
Google also does not allow Windows Laptops/PCs anywhere near their campus.
- robocat 7y ago
  Exactly: Google detected they were hacked by the Chinese government a decade ago ("Operation Aurora" affecting a lot of other companies including Adobe, Juniper, Rackspace, Yahoo, Symantec, Northrop Grumman, Morgan Stanley, Dow Chemical). Google stopped allowing Windows to be used within the organisation in 2010 as a response. I think any other organisation that continued to use Windows values features more than they value security (and I believe that is still the case: you can't secure Windows, Office or Microsoft browsers against state level actors).
- amoshi 7y ago
  Source? Looked online and couldn't find anything apart from one or two untrustworthy mentions on quora.
  - xenospn 7y ago
    I doubt anyone from Google is going to publicly comment on their internal security policies, but AFAIK this is a known fact for many years. I'm sure there's plenty of people who work for Google who can comment anonymously.

by hguant 7y ago

nickpsecurity 7y ago

Security by obfuscation of techniques involved. Classic trick. It's the best so long as each security measure and their interactions are fairly secure.

opportune 7y ago
I would say obfuscation is a valid strategy if also coupled with good security practices / algorithmic security. You're no less secure than if you were using the common flavors of good security practices (assuming you didn't create a mistake in rolling your own, which is a difficult assumption) but the effort required to target you is much higher than normal, and you are somewhat shielded from blanket-applying zero days.

xenospn 7y ago

Google also does not allow Windows Laptops/PCs anywhere near their campus.

robocat 7y ago
Exactly: Google detected they were hacked by the Chinese government a decade ago ("Operation Aurora" affecting a lot of other companies including Adobe, Juniper, Rackspace, Yahoo, Symantec, Northrop Grumman, Morgan Stanley, Dow Chemical). Google stopped allowing Windows to be used within the organisation in 2010 as a response. I think any other organisation that continued to use Windows values features more than they value security (and I believe that is still the case: you can't secure Windows, Office or Microsoft browsers against state level actors).
amoshi 7y ago
Source? Looked online and couldn't find anything apart from one or two untrustworthy mentions on quora.
- xenospn 7y ago
  I doubt anyone from Google is going to publicly comment on their internal security policies, but AFAIK this is a known fact for many years. I'm sure there's plenty of people who work for Google who can comment anonymously.