5 ms·

Why are we presenting bigger, badder VPNs as the solution? With core services to employees (e.g., email, calendar, office tools, filesharing, chat, collaborati

Why are we presenting bigger, badder VPNs as the solution? With core services to employees (e.g., email, calendar, office tools, filesharing, chat, collaboration, etc.) either serviced as a SaaS solution (e.g., GSuite, Office365, Slack, etc.) or hosted as VMs in a cloud provider (Exchange Server but on an Azure VM), the security moves to the application and the whole "walled castle" corporate network goes away. Then so do your VPN bandwidth problems.

unfocused 6y ago
Agreed. Split-Tunneling is also a simple solution where you end up using home internet bandwidth for things like MS Teams/Zoom/etc. and the rest goes over the VPN. For generic large corporations or governments, this is a good enough solution. Email and documents are not bandwidth hogs. That should be the first step, and after that, you start getting into detailed analysis as each business has its specific needs.
- blakes 6y ago
  Split-tunnel has solved all of our bandwidth and performance issues, and it's so easy.
  - Fredej 6y ago
    We recently moved _away_ from split tunneling. It's still giving me headaches. Not just performance, but things like docker containers don't always work right.
- xxpor 6y ago
  Split tunneling is only simple if you can control the IPs everything is hosted at. If your SaaS uses generic EC2/Azure IPs, do you want to split tunnel ALL traffic to those providers? Probably not.
  - abfan1127 6y ago
    I thought that all access to EC2/Azure IPs is over HTTPS or SSH so you don't need to tunnel to it. We use split tunnel for my work, all of my work's IPs go through the tunnel. Everything else is the individual HTTPS or SSH connection. If you were within your corporate wall, you'd still need HTTPS to get to Azure from inside, right?
    - droopyEyelids 6y ago
      Aside from accessing intranet resources: Is the corporate VPN for encrypting Internet traffic, or is it for proxying and monitoring employee traffic? Without answering that question, you can't discuss what makes sense.
      - abfan1127 6y ago
        our corp VPN is for accessing internal sensitive documents. I'm sure there is some level of monitoring, but it isn't the first priority. I work for a large US Corp so we have lots of design, specs, reviews and other paperwork to access.
  - gruez 6y ago
    but all the VPNed resources would be under private IPs anyways? In that case you only need your VPN to route traffic to your company's subnet.
    - xxpor 6y ago
      Most companies want all general internet traffic to go through the VPN so they can filter/record/do whatever to it. The sites that are split tunneled are usually trusted internal (in that they're owned by the company, or used for a known service like email) or known high bw but safe (like youtube)
  - c0nsumer 6y ago
    Not always, thankfully... Newer versions of Cisco AnyConnect (for example) can do name-based split tunnel. The client resolves the address then dynamically adds a route for the split tunnel as it's needed. It works excellently for cloud-hosted stuff.
- deleted 6y ago
  [deleted]
- Cthulhu_ 6y ago
  We run our own hardware (due to security concerns, our work is in mobile infrastructure) and have both a split and full VPN; I'm usually on the split one. Our code, task management and dev/test VMs go through the VPN, the rest over the open internets. The security argument we have is a bit hit and miss though, since our e-mail is at a random hosting provider (doesn't even have calendar support) and most of our other comms goes through services like Skype, Zoom, etc.
SpicyLemonZest 6y ago
For a large company, there are all kinds of data security and compliance rules requiring that sensitive data can only be accessed from a secure network. Your lawyers are unlikely to sign off on PCI, HIPAA, GDPR, etc. with only application level security.
- stefan_ 6y ago
  That's nice, but it seems the whole Zoom and Teams hype has done a quick end-run around those. Given that Zoom looks like the interface on the moon lander, I'm sure part of the appeal must be in ignoring all these rules.
  - bsder 6y ago
    > That's nice, but it seems the whole Zoom and Teams hype has done a quick end-run around those. It has. And somebody's going to get the book thrown at them for a breach at some point. At which point businesses will shut down Zoom and Teams post haste. Corporate security is solely driven by perceived legal liability.
- throwaways885 6y ago
  Isn't that the whole point of BeyondCorp though? That application level security can work. Long term, trusting the network is a bad idea anyway.
  - freehunter 6y ago
    Can work, yes. Has the budget (in both money and engineer time), probably not. It’s not as easy as just installing a new appliance and flipping a switch, especially for companies with low risk appetite and strict SLAs around service uptime. Plenty of enterprises have mission-critical applications running on mainframes because either no one understands the software enough to move it to more modern platforms or because the business can’t spare the time/money to have their engineers work on moving it. It’s hard to expect them to adopt zero-trust and BeyondCorp with that kind of culture. I agree “don’t trust the network” and especially the idea that those four walls don’t offer any real protection, but enterprise culture is incredibly slow, inefficient, and risk averse.
dragonwriter 6y ago
> Why are we presenting bigger, badder VPNs as the solution? I'm guessing because this is basically a submarine piece touting bigger, badder VPN providers. Though when I see the problem mentioned, I think of BeyondCorp[0] (the basic model, not the particular technical solutions) more than VPN as the solution approach. [0] https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
Fordec 6y ago
A VPN wouldn't have stopped the recent twitter hack via social engineering for example. Zero trust networks will have to be the way to go instead of the walled castle model.
- raxxorrax 6y ago
  Network segregation is a pretty solid mechanism and authentication is still required in private networks in most cases. Wouldn't make sense to give it up for no reason.
icegreentea2 6y ago
Probably because bigger badder VPNs potentially let you side step tricky political and organizational problems. Bigger badder VPNs might not be the lowest cost solution, or most efficient solution, but it's a relatively easy sell - you're just spending more money on the same type of resource as before because your using more of the resource. Anyone can understand that situation, no one is going to pushback. Switching to SaaS or cloud hosted providers, and especially if it means changing your security model means that you have to... do all those relatively hard and higher risk things to do.
- deleted 6y ago
  [deleted]
blntechie 6y ago
My company and the customer I work for moved many apps and services to be accessible outside the VPN with MFAs mandated for login. Pretty much I don’t even connect to VPN nowadays except for accessing some on-prem servers and stuff nowadays.
m463 6y ago
I should mention that split tunneling allows wholescale collection of data about employees. The difference is that it correlates and merges personal behaviors and data with work. They all come from the same ip address and have the same patterns.
raxxorrax 6y ago
I doubt I could convince anyone to upload our customer and supplier data or technical designs to the cloud. Developers could do that, most industries probably not. There are hackers and then there is industrial espionage. Users choose their passwords themselves, there are also service accounts. It would be a complete security nightmare. We employ quite a few SaaS tools that are mostly marked as "not that important" in case they get compromised.
- minot 6y ago
  If espionage is a concern, you first have to handle the low lying fruits (and I'd assume you already do) like you only allow your own hardware: no employee may use their own computer to connect to work. You should probably also require hardware keys and things like that but really I'd think it all depends on how much an adversary wants your stuff because I'd assume at some point it becomes viable to just send someone to work for you and steal your stuff.
  - raxxorrax 6y ago
    I am not suggesting to be that diligent, but yes, for some industries it might be the way to go. But I don't think these are low hanging fruits compared to using SaaS or cloud services on the net. There are real additional risks when using these.
    - minot 6y ago
      Absolutely. If you go by the marketing, all of aws staff is now potentially working for you when you use aws. You could say this means if any of the aws employees is compromised, so are you. As a contractor, all my code goes through a code review from one of the employees. I only have access to the development environment (even qa is off limits except the publicly available stuff). It is all on azure though. I think it is fine for must work done by peons like me. I once used an application to take a screenshot of the while display every minute (on my own computer) and it amazes me that the application didn't need root at all on Windows. In short, I agree that you should avoid the public cloud for sensitive work but you should probably do a lot more (even regular training?)
trabant00 6y ago
> the security moves to the application The application access should be secured IN ADDITION to network access to it being secured! Security in layers is a thousands years old concept. Castles for example where built with multiple concentric walls that defenders could fall back to if the outer perimeter was compromised. Reasons for corporate IT network are multiple: the application could have an exploit at some point, the employee credentials could be compromised (even dual factor), the application if publicly exposed is vulnerable to denial of service even if it remains completely secured, vulnerabilities can be scanned if public, etc, etc. Please stop repeating bullshit from "zero security" vendor marketing materials.
- pletnes 6y ago
  When the network is so secure I can’t do my job anymore, I suggest to air-gap the power supplies. Ultimate security.
- yodelshady 6y ago
  I'm a bit sceptical - not rubbishing, but sceptical - of the castle walls analogy. If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? I think castles have something of an answer to that question, because physical static defence is just more constrained than computational static defence - the ratio of effort of building a wall : effort to breach is poor compared to even complex passwords. Your REAL physical defence is(are?) your soldiers, and the wall mainly aids their co-ordination: small attacks aren't worth attention, big attacks are SLOW AND VISIBLE. Does infosec have a similar wall to that? Certainly, when attackers breached castle walls via backdoors, it was normally game over, keep or no.
  - curryst 6y ago
    > If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? This whole analogy is bad, but to work in the context of it, each of the castles defenses is impenetrable (Wolverine went back in time and taught them to make adamantium). The only way to get through is to discover and exploit flaws in the design of the defenses. If they breach the walls, they still have to find an exploit a flaw in the keep, _before_ you notice they made it through the first wall, rebuild the first wall without the defect and then send your wolverine-knight automatons to clean up the survivors. In this scenario, IDS/IPS systems are your scouts watching for invaders that breach the first wall. Importantly, the designs of these walls change all the time, so the attackers need a window during which both the keep and the walls have a design flaw. And unless the flaw is in something common to both the keep and walls, it is unlikely to be common to both (OpenSSL is an example of that). > small attacks aren't worth attention, big attacks are SLOW AND VISIBLE This is not true of castles nor infosec. A huge enemy force against a well-defended castle meant they likely mean to lay siege and starve them out of the castle. Not a significant concern so long as you have food and water; especially so if your resources would outlast their supply lines. Small forces on the other hand are exceptionally dangerous, because it's probably a sapper party that's going to try to tunnel under your wall and detonate explosives (or just collapse the tunnel if this is pre-explosives). Sappers are almost infinitely more dangerous. You can see the same pattern repeat in World War I. Trenches with machine guns are nearly impenetrable to attackers, thus No Man's Land. So we went back in time and re-created sappers to dig tunnels under their trenches. Having the other side come over their trenches at you is far less concerning than hearing sappers digging under you. Infosec is the same way. Port scans and attempted DDoS attacks are common, easily noticed, and unlikely to lead to anything threatening. Your real risk is being targeted. Someone interested in you specifically because of the data you have, or money, or whatever. People that will poke around your stuff in ways that are hard to notice, like analyzing your auth flow for vulnerabilities. Those are your digital sappers. Large DDoS attacks are bad, because they can knock you offline, but it's like a seige. All you have to do is outlast them, at the end of the day you lost some productivity but the castle is still intact. If the sappers get in, you go offline _and_ they'll steal your data.
mschuster91 6y ago
> With core services to employees (e.g., email, calendar, office tools, filesharing, chat, collaboration, etc.) either serviced as a SaaS solution (e.g., GSuite, Office365, Slack, etc.) or hosted as VMs in a cloud provider (Exchange Server but on an Azure VM), the security moves to the application and the whole "walled castle" corporate network goes away. Office 365 is still not GDPR compliant (https://www.heise.de/news/Microsoft-Office-365-Die-Gruende-fuer-das-Nein-der-Datenschuetzer-4919847.html https://www.heise.de/news/Microsoft-Office-365-Die-Gruende-f...), and many companies are not exactly a friend of putting their other core services (=Exchange) into the cloud where the US secret services can access it. In fact a lot of German companies outright forbid transferring their data on anything "cloud" and demand storage and processing of their data in on-premises systems, for fear of trade secret theft.
netcan 6y ago
>>"Why are we presenting bigger, badder VPNs as the solution?"... SAAS instead. YOu can think of it as path dependency. Organisations are already structured around a "walled castle." It's possible to run everything differently, but the path from A to B is too rough.

unfocused 6y ago

Agreed. Split-Tunneling is also a simple solution where you end up using home internet bandwidth for things like MS Teams/Zoom/etc. and the rest goes over the VPN. For generic large corporations or governments, this is a good enough solution. Email and documents are not bandwidth hogs. That should be the first step, and after that, you start getting into detailed analysis as each business has its specific needs.

blakes 6y ago
Split-tunnel has solved all of our bandwidth and performance issues, and it's so easy.
- Fredej 6y ago
  We recently moved _away_ from split tunneling. It's still giving me headaches. Not just performance, but things like docker containers don't always work right.
xxpor 6y ago
Split tunneling is only simple if you can control the IPs everything is hosted at. If your SaaS uses generic EC2/Azure IPs, do you want to split tunnel ALL traffic to those providers? Probably not.
- abfan1127 6y ago
  I thought that all access to EC2/Azure IPs is over HTTPS or SSH so you don't need to tunnel to it. We use split tunnel for my work, all of my work's IPs go through the tunnel. Everything else is the individual HTTPS or SSH connection. If you were within your corporate wall, you'd still need HTTPS to get to Azure from inside, right?
  - droopyEyelids 6y ago
    Aside from accessing intranet resources: Is the corporate VPN for encrypting Internet traffic, or is it for proxying and monitoring employee traffic? Without answering that question, you can't discuss what makes sense.
    - abfan1127 6y ago
      our corp VPN is for accessing internal sensitive documents. I'm sure there is some level of monitoring, but it isn't the first priority. I work for a large US Corp so we have lots of design, specs, reviews and other paperwork to access.
- gruez 6y ago
  but all the VPNed resources would be under private IPs anyways? In that case you only need your VPN to route traffic to your company's subnet.
  - xxpor 6y ago
    Most companies want all general internet traffic to go through the VPN so they can filter/record/do whatever to it. The sites that are split tunneled are usually trusted internal (in that they're owned by the company, or used for a known service like email) or known high bw but safe (like youtube)
- c0nsumer 6y ago
  Not always, thankfully... Newer versions of Cisco AnyConnect (for example) can do name-based split tunnel. The client resolves the address then dynamically adds a route for the split tunnel as it's needed. It works excellently for cloud-hosted stuff.
deleted 6y ago
[deleted]
Cthulhu_ 6y ago
We run our own hardware (due to security concerns, our work is in mobile infrastructure) and have both a split and full VPN; I'm usually on the split one. Our code, task management and dev/test VMs go through the VPN, the rest over the open internets. The security argument we have is a bit hit and miss though, since our e-mail is at a random hosting provider (doesn't even have calendar support) and most of our other comms goes through services like Skype, Zoom, etc.

SpicyLemonZest 6y ago

For a large company, there are all kinds of data security and compliance rules requiring that sensitive data can only be accessed from a secure network. Your lawyers are unlikely to sign off on PCI, HIPAA, GDPR, etc. with only application level security.

stefan_ 6y ago
That's nice, but it seems the whole Zoom and Teams hype has done a quick end-run around those. Given that Zoom looks like the interface on the moon lander, I'm sure part of the appeal must be in ignoring all these rules.
- bsder 6y ago
  > That's nice, but it seems the whole Zoom and Teams hype has done a quick end-run around those. It has. And somebody's going to get the book thrown at them for a breach at some point. At which point businesses will shut down Zoom and Teams post haste. Corporate security is solely driven by perceived legal liability.
throwaways885 6y ago
Isn't that the whole point of BeyondCorp though? That application level security can work. Long term, trusting the network is a bad idea anyway.
- freehunter 6y ago
  Can work, yes. Has the budget (in both money and engineer time), probably not. It’s not as easy as just installing a new appliance and flipping a switch, especially for companies with low risk appetite and strict SLAs around service uptime. Plenty of enterprises have mission-critical applications running on mainframes because either no one understands the software enough to move it to more modern platforms or because the business can’t spare the time/money to have their engineers work on moving it. It’s hard to expect them to adopt zero-trust and BeyondCorp with that kind of culture. I agree “don’t trust the network” and especially the idea that those four walls don’t offer any real protection, but enterprise culture is incredibly slow, inefficient, and risk averse.

dragonwriter 6y ago

> Why are we presenting bigger, badder VPNs as the solution? I'm guessing because this is basically a submarine piece touting bigger, badder VPN providers. Though when I see the problem mentioned, I think of BeyondCorp[0] (the basic model, not the particular technical solutions) more than VPN as the solution approach. [0] https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp

Fordec 6y ago

A VPN wouldn't have stopped the recent twitter hack via social engineering for example. Zero trust networks will have to be the way to go instead of the walled castle model.

raxxorrax 6y ago
Network segregation is a pretty solid mechanism and authentication is still required in private networks in most cases. Wouldn't make sense to give it up for no reason.

icegreentea2 6y ago

Probably because bigger badder VPNs potentially let you side step tricky political and organizational problems. Bigger badder VPNs might not be the lowest cost solution, or most efficient solution, but it's a relatively easy sell - you're just spending more money on the same type of resource as before because your using more of the resource. Anyone can understand that situation, no one is going to pushback. Switching to SaaS or cloud hosted providers, and especially if it means changing your security model means that you have to... do all those relatively hard and higher risk things to do.

deleted 6y ago
[deleted]

blntechie 6y ago

My company and the customer I work for moved many apps and services to be accessible outside the VPN with MFAs mandated for login. Pretty much I don’t even connect to VPN nowadays except for accessing some on-prem servers and stuff nowadays.

m463 6y ago

I should mention that split tunneling allows wholescale collection of data about employees. The difference is that it correlates and merges personal behaviors and data with work. They all come from the same ip address and have the same patterns.

raxxorrax 6y ago

I doubt I could convince anyone to upload our customer and supplier data or technical designs to the cloud. Developers could do that, most industries probably not. There are hackers and then there is industrial espionage. Users choose their passwords themselves, there are also service accounts. It would be a complete security nightmare. We employ quite a few SaaS tools that are mostly marked as "not that important" in case they get compromised.

minot 6y ago
If espionage is a concern, you first have to handle the low lying fruits (and I'd assume you already do) like you only allow your own hardware: no employee may use their own computer to connect to work. You should probably also require hardware keys and things like that but really I'd think it all depends on how much an adversary wants your stuff because I'd assume at some point it becomes viable to just send someone to work for you and steal your stuff.
- raxxorrax 6y ago
  I am not suggesting to be that diligent, but yes, for some industries it might be the way to go. But I don't think these are low hanging fruits compared to using SaaS or cloud services on the net. There are real additional risks when using these.
  - minot 6y ago
    Absolutely. If you go by the marketing, all of aws staff is now potentially working for you when you use aws. You could say this means if any of the aws employees is compromised, so are you. As a contractor, all my code goes through a code review from one of the employees. I only have access to the development environment (even qa is off limits except the publicly available stuff). It is all on azure though. I think it is fine for must work done by peons like me. I once used an application to take a screenshot of the while display every minute (on my own computer) and it amazes me that the application didn't need root at all on Windows. In short, I agree that you should avoid the public cloud for sensitive work but you should probably do a lot more (even regular training?)

trabant00 6y ago

> the security moves to the application The application access should be secured IN ADDITION to network access to it being secured! Security in layers is a thousands years old concept. Castles for example where built with multiple concentric walls that defenders could fall back to if the outer perimeter was compromised. Reasons for corporate IT network are multiple: the application could have an exploit at some point, the employee credentials could be compromised (even dual factor), the application if publicly exposed is vulnerable to denial of service even if it remains completely secured, vulnerabilities can be scanned if public, etc, etc. Please stop repeating bullshit from "zero security" vendor marketing materials.

pletnes 6y ago
When the network is so secure I can’t do my job anymore, I suggest to air-gap the power supplies. Ultimate security.
yodelshady 6y ago
I'm a bit sceptical - not rubbishing, but sceptical - of the castle walls analogy. If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? I think castles have something of an answer to that question, because physical static defence is just more constrained than computational static defence - the ratio of effort of building a wall : effort to breach is poor compared to even complex passwords. Your REAL physical defence is(are?) your soldiers, and the wall mainly aids their co-ordination: small attacks aren't worth attention, big attacks are SLOW AND VISIBLE. Does infosec have a similar wall to that? Certainly, when attackers breached castle walls via backdoors, it was normally game over, keep or no.
- curryst 6y ago
  > If an attacker gets through your walls (network access), why do you think you'd stop them at the keep? This whole analogy is bad, but to work in the context of it, each of the castles defenses is impenetrable (Wolverine went back in time and taught them to make adamantium). The only way to get through is to discover and exploit flaws in the design of the defenses. If they breach the walls, they still have to find an exploit a flaw in the keep, _before_ you notice they made it through the first wall, rebuild the first wall without the defect and then send your wolverine-knight automatons to clean up the survivors. In this scenario, IDS/IPS systems are your scouts watching for invaders that breach the first wall. Importantly, the designs of these walls change all the time, so the attackers need a window during which both the keep and the walls have a design flaw. And unless the flaw is in something common to both the keep and walls, it is unlikely to be common to both (OpenSSL is an example of that). > small attacks aren't worth attention, big attacks are SLOW AND VISIBLE This is not true of castles nor infosec. A huge enemy force against a well-defended castle meant they likely mean to lay siege and starve them out of the castle. Not a significant concern so long as you have food and water; especially so if your resources would outlast their supply lines. Small forces on the other hand are exceptionally dangerous, because it's probably a sapper party that's going to try to tunnel under your wall and detonate explosives (or just collapse the tunnel if this is pre-explosives). Sappers are almost infinitely more dangerous. You can see the same pattern repeat in World War I. Trenches with machine guns are nearly impenetrable to attackers, thus No Man's Land. So we went back in time and re-created sappers to dig tunnels under their trenches. Having the other side come over their trenches at you is far less concerning than hearing sappers digging under you. Infosec is the same way. Port scans and attempted DDoS attacks are common, easily noticed, and unlikely to lead to anything threatening. Your real risk is being targeted. Someone interested in you specifically because of the data you have, or money, or whatever. People that will poke around your stuff in ways that are hard to notice, like analyzing your auth flow for vulnerabilities. Those are your digital sappers. Large DDoS attacks are bad, because they can knock you offline, but it's like a seige. All you have to do is outlast them, at the end of the day you lost some productivity but the castle is still intact. If the sappers get in, you go offline _and_ they'll steal your data.

mschuster91 6y ago

> With core services to employees (e.g., email, calendar, office tools, filesharing, chat, collaboration, etc.) either serviced as a SaaS solution (e.g., GSuite, Office365, Slack, etc.) or hosted as VMs in a cloud provider (Exchange Server but on an Azure VM), the security moves to the application and the whole "walled castle" corporate network goes away. Office 365 is still not GDPR compliant (https://www.heise.de/news/Microsoft-Office-365-Die-Gruende-fuer-das-Nein-der-Datenschuetzer-4919847.html https://www.heise.de/news/Microsoft-Office-365-Die-Gruende-f...), and many companies are not exactly a friend of putting their other core services (=Exchange) into the cloud where the US secret services can access it. In fact a lot of German companies outright forbid transferring their data on anything "cloud" and demand storage and processing of their data in on-premises systems, for fear of trade secret theft.

netcan 6y ago

>>"Why are we presenting bigger, badder VPNs as the solution?"... SAAS instead. YOu can think of it as path dependency. Organisations are already structured around a "walled castle." It's possible to run everything differently, but the path from A to B is too rough.