3 ms·

The article mentions MUSCULAR, but neglected the follow-up: shortly after the leaks, Google began encrypting all of its internal traffic over its own fiber link

The article mentions MUSCULAR, but neglected the follow-up: shortly after the leaks, Google began encrypting all of its internal traffic over its own fiber links.[0] First, it's worth pointing out that "encrypt everything in flight always" is not prohibitively expensive on modern hardware; also that your own internal network should not be viewed as an impenetrable bastion where you can let down your guard, just because you keep a close eye on the external routers. [0] https://www.washingtonpost.com/business/technology/google-encrypts-data-amid-backlash-against-nsa-spying/2013/09/06/9acc3c20-1722-11e3-a2ec-b47e45e6f8ef_story.html https://www.washingtonpost.com/business/technology/google-en...

andy_ppp 7y ago
“Security of organisations should be done in layers” and each layer makes breaking into your (whole) organisation harder, but comes with friction for your staff.
- kerkeslager 7y ago
  It should be noted that your staff are a key attack vector.
- e12e 7y ago
  No, I think the new consensus is that all systems are vulnerable (obviously true if all systems have users with access, whom may be compromised) - so not layers: compartments (and need to know;need to access). I believe this is part of eg google/alphabet's new model: no hard wall, soft "inside" (egg model). Just stand alone secure sub-systems with ACL (access control lists) mediating access on a user-by-user, sub-system by sub-system level. No real trust in "location" as proof of authorization (I assume truly, off-grid clean rooms are excepted) - because "everything" needs access to networked resources. Ah, I guess they call it BeyondCorp: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
  - andy_ppp 7y ago
    Sure, I used (or the person I’m quoting used) the wrong term, thanks for the clarification. I did mean and he meant compartmentalising :-)
  - soulofmischief 7y ago
    Virtualization, privilege management, etc. are still another layer.
    - e12e 7y ago
      Not a different organizational layer, just a different techincal layer though.
      - soulofmischief 7y ago
        Both are important in the context of security.

andy_ppp 7y ago

“Security of organisations should be done in layers” and each layer makes breaking into your (whole) organisation harder, but comes with friction for your staff.

kerkeslager 7y ago
It should be noted that your staff are a key attack vector.
e12e 7y ago
No, I think the new consensus is that all systems are vulnerable (obviously true if all systems have users with access, whom may be compromised) - so not layers: compartments (and need to know;need to access). I believe this is part of eg google/alphabet's new model: no hard wall, soft "inside" (egg model). Just stand alone secure sub-systems with ACL (access control lists) mediating access on a user-by-user, sub-system by sub-system level. No real trust in "location" as proof of authorization (I assume truly, off-grid clean rooms are excepted) - because "everything" needs access to networked resources. Ah, I guess they call it BeyondCorp: https://cloud.google.com/beyondcorp/ https://cloud.google.com/beyondcorp/
- andy_ppp 7y ago
  Sure, I used (or the person I’m quoting used) the wrong term, thanks for the clarification. I did mean and he meant compartmentalising :-)
- soulofmischief 7y ago
  Virtualization, privilege management, etc. are still another layer.
  - e12e 7y ago
    Not a different organizational layer, just a different techincal layer though.
    - soulofmischief 7y ago
      Both are important in the context of security.