5 ms·

The entire "BeyondCorp" strategy from Google has probably done more harm then good. Tons of smaller companies and well known startup paid their prices with brea

by kerng 7y ago

The entire "BeyondCorp" strategy from Google has probably done more harm then good. Tons of smaller companies and well known startup paid their prices with breaches left and right. Removing or not deploying basic firewall controls to lock down traffic is ill advised. Tons of exposed s3 buckets and other assets keep showing that. Zero Trust is correct strategy of course, but it doesn't mean you have to open up your network to the entire world- it's in addition to already established best practices. Better to continue those traditional practices and be more thorough via micro-segmenation for instance, and identity on top of it.

detaro 7y ago
Do you have examples of breaches you'd attribute to imitating "BeyondCorp"? What you describe does not sound like that.
- api 7y ago
  One of my biggest gripes with infosec is how un-empirical the field is. Best practices and advice are based on what security people think is the best strategy for preventing breaches, but rarely do I see that backed by actual data about how real world breaches actually happen. This leads to an outsized focus on the latest sexy vulnerabilities (e.g. CPU speculative execution vulnerabilities) and fetishes for things like firewalls. Meanwhile people type 'npm install kitchen-sink' with no worries. In my own anecdotal but real world experience most breaches result from phishing, downloaded malware, phishing to get the user to download malware, and malware-assisted phishing, in no particular order. Firewalls do nothing for that.
  - yoloClin 7y ago
    I hugely agree on a lot of your points. I'll also add that once I'm on a traditional network, ripping through active directory is generally not difficult - my first ever live pentest went from privileged non-AD asset to domain admin within about 4 hours. My average time to compromise has come down significantly since then, too. There's lots of bad/scam security focusing on logging and monitoring, weird antivirus products and securing the wrong things. The last network I compromised dropped an obscene amount of money on a SIEM product that couldn't detect nmap or PtH attacks, I achieved complete compromise with the same chain of attack as my first ever pentest because nobody had looked at the fundamentals of implementation/configuration security. If I could list things that would actually secure traditional networks: - Application Whitelisting (Binary executables, strong macro group policies, browser plugin whitelisting). - Active Directory Hardening (See: ADSecurity, Microsoft AD Hardening Guidelines, ACSC Windows 10 Hardening Guidelines) - Regular Patching and reliance on Microsoft Products (they're actually pretty good!) Dunno if you'd consider these 'zero trust', but unless you've covered the fundamentals nobody is going to waste time figuring out how to abuse your network with speculative execution or drop a huge amount of budget to develop a perimeter breaching RCE 0day. Especially when in most cases sending shitware.docx.exe to a sales staff member (who is almost always going to run whatever you send them if there's a bonus incentive) will suffice.
    - emj 7y ago
      "Application Whitelisting" Does that actually work anywhere except in an boring office? Everyone that has a functioning devshop always has too many holes in their whitelists to effectively protect them. Client machines WITH credentials has to be made untrusted.
      - yoloClin 7y ago
        There's no reason it can't work in say development environments - the simplest approach is to configure whitelisted directories which permit execution in most solutions. It's not perfect but it helps prevent execution of questionable downloads / attachments. > Client machines WITH credentials has to be made untrusted. Network segregation is better if you truly care about security and costs in productivity. I think you'll find higher end environments have a 'trusted box' and a 'development box' which physically sit side-by-side on different networks.
        emj 7y ago
        We might discussing this from different views, network segregation is important even if you build everything as zero trust, firewalling something it's one of the easiest way to not trust it. I think the difference in perspective is that I only really need to work in very narrow an well defined interface to systems that can be hacked, so my view of what the attack surface is affacted by that, I do not care about. For me as long as revealing my password to my client is fine I'm fine. My client can be full of malware without affecting security severly. Clean room; "leave everything connected on the outside", and variants of that is REALLY ineffective. I've measured that the waste from that, back then we spent alot of time classifing what software had to be developed in such an environment. You do not want to work that way.
        yoloClin 7y ago
        I don't disagree that segregation is still important, but it really depends on specific environment technical details and threat models. Firewalling AD networks, for instance, really won't help if the administrative security model is flawed (network admins using privileged account to maintain endpoints, privileged local administrative/maintenance credentials being reused on critical infrastructure, etc). The communication protocols for administration and general use are iirc pretty much require bidirectional traffic to work. If you don't trust the host you develop on then everything produced on that host must be audited by a trusted host. Maybe that works in environments where cost is not an issue, but I would be somewhat skeptical of any environment which attempts that without the appropriate resources. It also doesn't help in situations where source code disclosure is an issue (eg a dev posting too much to pastebin/stackoverflow/inadvertently searching google for paste buffer full of data etc).
  - blondin 7y ago
    > This leads to an outsized focus on the latest sexy vulnerabilities (e.g. CPU speculative execution vulnerabilities) and fetishes for things like firewalls. sounds like a fantastic plot for an anime. i can even see firewall san in my head :) seriously though, maybe phishing and malware are common because firewalls are working?
    - api 7y ago
      Phishing is so popular because the meat sack behind the screen is usually the least secure part of the system. Unless you are running vulnerable unpatched or unprotected services, attacking people is usually easier than attacking systems.
      - blondin 7y ago
        > Phishing is so popular because the meat sack behind the screen is usually the least secure part of the system. am i saying something different in my comment?
  - enneff 7y ago
    The 'BeyondCorp' approach is the opposite to a firewall, and is designed to limit the damage of successful phishing attacks. For example, if you have a 'trusted' network, a successful phishing attack gets you access to that network. If you have a 'zero trust' network, that attack only gets you access to the compromised user.
    - kerng 7y ago
      BeyondCorp != Zero Trust Zero Trust includes heavily leverageing attack surface limitation to prevent lateral movement. This means even if an attacker has stolen passwords, cookies or whatever single factor token that is needed to move laterally, they can't - because no connectivity.
  - kerng 7y ago
    They prevent or limit lateral movement once the malware is running.
    - api 7y ago
      Really? In most deployments the firewall is only outward facing. Local isolation is possible but it breaks a ton of stuff and basically renders the LAN useless. My own opinion is: Secure. The. Endpoint. If your devices, OSes, etc. are not secure then your systems are not secure. A firewall will not save an insecure system, and firewalls and netsec in general gets far too much attention. That attention should be focused on OS-level and application level security.
      - kerng 7y ago
        Exactly, endpoints should not be listening on the network for instance (its not just about outbound connectivity). Company laptops often have RDP or SSH open - and newly added software might expose a remote endpoint in future (or a 0 day, like EternalBlue). And here it comes: then an employee works from home or a coffeeshop and anyone there can attack and try to login! Locking down these things is critical to securing the endpoint.
      - sagichmal 7y ago
        "Endpoint security" in practice translates to full disk encryption (good) but seemingly also corporate-mandated spyware that logs and reports process and network metadata, even traffic and keystrokes (bad). Security isn't the only thing in the optimization equation; endpoint security is only useful — and humane — to a point.
pm90 7y ago
> Tons of exposed s3 buckets and other assets keep showing that. Would firewall rules help alleviate that though? I can only speak for GCS (GCP's s3 equivalent), but firewall rules don't apply to GCS buckets. Like a sibling commentator said, I would like to know more instances of companies getting breached specifically for adopting a zero trust networking philosophy.
- kerng 7y ago
  Zero Trust is the right strategy, but very few have the resources to implement it. So they in spirit do Zero Trust, but end up without basic security controls nor full fledged micro segmentation and identity. If you work at a startup and experience exponential growth, you know that your internal production network likely has no authentication - this is unfortunately not uncommon and can be dangerous. What old school security controls prevent, are the script kiddie attacks (ooops, that database or Elastic Search cluster exposed on Internet) and random automation attacks - which there are plenty of examples.
  - yjftsjthsd-h 7y ago
    > So they in spirit do Zero Trust, but end up without basic security controls nor full fledged micro segmentation and identity. Then they're not doing zero trust, they're doing minimal access controls, which is rather the opposite and the problem.
    - kerng 7y ago
      They have the strategic vision to do zero trust with whatever ships out of box, but not more. Like we use GSuites and have MFA, all our problems are solved because we now are BeyondCorp. That's marketing speak.
closeparen 7y ago
BeyondCorp does not imply opening up your network to the entire world! If anything, it means locking down your network tighter, because not even the office is privileged. Production is a black box that you touch by authenticating through the same reverse proxy tier, no matter where outside of it you are. In effect, nginx is your “VPN” server and everyone has to use it. Plenty of companies paid dearly for trusting every device that merely needed internet access.
- kerng 7y ago
  Internet exposed bastion hosts to production, that have no IP whitelisting are not the best idea, unfortunately not uncommon nowadays.
  - closeparen 7y ago
    That's what a VPN server is.
    - kerng 7y ago
      Organizations that have high value assets would deploy multiple layers of these, not just one, basically depending on value of assets.
      - closeparen 7y ago
        You're gonna get some pretty fun pathological networking behaviors tunneling VPNs on VPNs.
  - xxpor 7y ago
    You need always need multiple layers of security. Using the network itself as one was never necessary, although it has been convenient. Nowadays U2F based 2fa authentication and need to know based authorization are usually superior.
    - kerng 7y ago

by kerng 7y ago

detaro 7y ago

Do you have examples of breaches you'd attribute to imitating "BeyondCorp"? What you describe does not sound like that.

api 7y ago
One of my biggest gripes with infosec is how un-empirical the field is. Best practices and advice are based on what security people think is the best strategy for preventing breaches, but rarely do I see that backed by actual data about how real world breaches actually happen. This leads to an outsized focus on the latest sexy vulnerabilities (e.g. CPU speculative execution vulnerabilities) and fetishes for things like firewalls. Meanwhile people type 'npm install kitchen-sink' with no worries. In my own anecdotal but real world experience most breaches result from phishing, downloaded malware, phishing to get the user to download malware, and malware-assisted phishing, in no particular order. Firewalls do nothing for that.
- yoloClin 7y ago
  I hugely agree on a lot of your points. I'll also add that once I'm on a traditional network, ripping through active directory is generally not difficult - my first ever live pentest went from privileged non-AD asset to domain admin within about 4 hours. My average time to compromise has come down significantly since then, too. There's lots of bad/scam security focusing on logging and monitoring, weird antivirus products and securing the wrong things. The last network I compromised dropped an obscene amount of money on a SIEM product that couldn't detect nmap or PtH attacks, I achieved complete compromise with the same chain of attack as my first ever pentest because nobody had looked at the fundamentals of implementation/configuration security. If I could list things that would actually secure traditional networks: - Application Whitelisting (Binary executables, strong macro group policies, browser plugin whitelisting). - Active Directory Hardening (See: ADSecurity, Microsoft AD Hardening Guidelines, ACSC Windows 10 Hardening Guidelines) - Regular Patching and reliance on Microsoft Products (they're actually pretty good!) Dunno if you'd consider these 'zero trust', but unless you've covered the fundamentals nobody is going to waste time figuring out how to abuse your network with speculative execution or drop a huge amount of budget to develop a perimeter breaching RCE 0day. Especially when in most cases sending shitware.docx.exe to a sales staff member (who is almost always going to run whatever you send them if there's a bonus incentive) will suffice.
  - emj 7y ago
    "Application Whitelisting" Does that actually work anywhere except in an boring office? Everyone that has a functioning devshop always has too many holes in their whitelists to effectively protect them. Client machines WITH credentials has to be made untrusted.
    - yoloClin 7y ago
      There's no reason it can't work in say development environments - the simplest approach is to configure whitelisted directories which permit execution in most solutions. It's not perfect but it helps prevent execution of questionable downloads / attachments. > Client machines WITH credentials has to be made untrusted. Network segregation is better if you truly care about security and costs in productivity. I think you'll find higher end environments have a 'trusted box' and a 'development box' which physically sit side-by-side on different networks.
      - emj 7y ago
        We might discussing this from different views, network segregation is important even if you build everything as zero trust, firewalling something it's one of the easiest way to not trust it. I think the difference in perspective is that I only really need to work in very narrow an well defined interface to systems that can be hacked, so my view of what the attack surface is affacted by that, I do not care about. For me as long as revealing my password to my client is fine I'm fine. My client can be full of malware without affecting security severly. Clean room; "leave everything connected on the outside", and variants of that is REALLY ineffective. I've measured that the waste from that, back then we spent alot of time classifing what software had to be developed in such an environment. You do not want to work that way.
        yoloClin 7y ago
        I don't disagree that segregation is still important, but it really depends on specific environment technical details and threat models. Firewalling AD networks, for instance, really won't help if the administrative security model is flawed (network admins using privileged account to maintain endpoints, privileged local administrative/maintenance credentials being reused on critical infrastructure, etc). The communication protocols for administration and general use are iirc pretty much require bidirectional traffic to work. If you don't trust the host you develop on then everything produced on that host must be audited by a trusted host. Maybe that works in environments where cost is not an issue, but I would be somewhat skeptical of any environment which attempts that without the appropriate resources. It also doesn't help in situations where source code disclosure is an issue (eg a dev posting too much to pastebin/stackoverflow/inadvertently searching google for paste buffer full of data etc).
- blondin 7y ago
  > This leads to an outsized focus on the latest sexy vulnerabilities (e.g. CPU speculative execution vulnerabilities) and fetishes for things like firewalls. sounds like a fantastic plot for an anime. i can even see firewall san in my head :) seriously though, maybe phishing and malware are common because firewalls are working?
  - api 7y ago
    Phishing is so popular because the meat sack behind the screen is usually the least secure part of the system. Unless you are running vulnerable unpatched or unprotected services, attacking people is usually easier than attacking systems.
    - blondin 7y ago
      > Phishing is so popular because the meat sack behind the screen is usually the least secure part of the system. am i saying something different in my comment?
- enneff 7y ago
  The 'BeyondCorp' approach is the opposite to a firewall, and is designed to limit the damage of successful phishing attacks. For example, if you have a 'trusted' network, a successful phishing attack gets you access to that network. If you have a 'zero trust' network, that attack only gets you access to the compromised user.
  - kerng 7y ago
    BeyondCorp != Zero Trust Zero Trust includes heavily leverageing attack surface limitation to prevent lateral movement. This means even if an attacker has stolen passwords, cookies or whatever single factor token that is needed to move laterally, they can't - because no connectivity.
- kerng 7y ago
  They prevent or limit lateral movement once the malware is running.
  - api 7y ago
    Really? In most deployments the firewall is only outward facing. Local isolation is possible but it breaks a ton of stuff and basically renders the LAN useless. My own opinion is: Secure. The. Endpoint. If your devices, OSes, etc. are not secure then your systems are not secure. A firewall will not save an insecure system, and firewalls and netsec in general gets far too much attention. That attention should be focused on OS-level and application level security.
    - kerng 7y ago
      Exactly, endpoints should not be listening on the network for instance (its not just about outbound connectivity). Company laptops often have RDP or SSH open - and newly added software might expose a remote endpoint in future (or a 0 day, like EternalBlue). And here it comes: then an employee works from home or a coffeeshop and anyone there can attack and try to login! Locking down these things is critical to securing the endpoint.
    - sagichmal 7y ago
      "Endpoint security" in practice translates to full disk encryption (good) but seemingly also corporate-mandated spyware that logs and reports process and network metadata, even traffic and keystrokes (bad). Security isn't the only thing in the optimization equation; endpoint security is only useful — and humane — to a point.

pm90 7y ago

> Tons of exposed s3 buckets and other assets keep showing that. Would firewall rules help alleviate that though? I can only speak for GCS (GCP's s3 equivalent), but firewall rules don't apply to GCS buckets. Like a sibling commentator said, I would like to know more instances of companies getting breached specifically for adopting a zero trust networking philosophy.

kerng 7y ago
Zero Trust is the right strategy, but very few have the resources to implement it. So they in spirit do Zero Trust, but end up without basic security controls nor full fledged micro segmentation and identity. If you work at a startup and experience exponential growth, you know that your internal production network likely has no authentication - this is unfortunately not uncommon and can be dangerous. What old school security controls prevent, are the script kiddie attacks (ooops, that database or Elastic Search cluster exposed on Internet) and random automation attacks - which there are plenty of examples.
- yjftsjthsd-h 7y ago
  > So they in spirit do Zero Trust, but end up without basic security controls nor full fledged micro segmentation and identity. Then they're not doing zero trust, they're doing minimal access controls, which is rather the opposite and the problem.
  - kerng 7y ago
    They have the strategic vision to do zero trust with whatever ships out of box, but not more. Like we use GSuites and have MFA, all our problems are solved because we now are BeyondCorp. That's marketing speak.

closeparen 7y ago

BeyondCorp does not imply opening up your network to the entire world! If anything, it means locking down your network tighter, because not even the office is privileged. Production is a black box that you touch by authenticating through the same reverse proxy tier, no matter where outside of it you are. In effect, nginx is your “VPN” server and everyone has to use it. Plenty of companies paid dearly for trusting every device that merely needed internet access.

kerng 7y ago
Internet exposed bastion hosts to production, that have no IP whitelisting are not the best idea, unfortunately not uncommon nowadays.
- closeparen 7y ago
  That's what a VPN server is.
  - kerng 7y ago
    Organizations that have high value assets would deploy multiple layers of these, not just one, basically depending on value of assets.
    - closeparen 7y ago
      You're gonna get some pretty fun pathological networking behaviors tunneling VPNs on VPNs.
- xxpor 7y ago
  You need always need multiple layers of security. Using the network itself as one was never necessary, although it has been convenient. Nowadays U2F based 2fa authentication and need to know based authorization are usually superior.
  - kerng 7y ago