4 ms·

Indeed, and the industry term for this is posture assessment. And many companies take this a step further and permit access only with organization-issued equipm

Indeed, and the industry term for this is posture assessment. And many companies take this a step further and permit access only with organization-issued equipment, even if you possess authentication credentials.

walrus01 6y ago
Having 100% company owned equipment allows you to do other common sense things like: a) full disk encryption with key escrow for recovery by admin team b) storage of crypto public/private key pair on disk of laptop, for instance an openvpn key file that was created on a company owned PKI server, deployed onto the laptop as part of its provisioning process, and is a unique key for both the human and that particular piece of hardware c) you can use the same crypto key pair on client device local storage, if not for something like openvpn, for other authentication purposes identifying that particular user and hardware d) obviously, have the device trust your own internal PKI's root CA for access to purely-intranet resources. getting a company root CA trusted by the browsers in a BYOD device environment is a pain in the ass.
- snazz 6y ago
  What does Google do in this regard? I don't work there, so I'm curious to hear about their solution for endpoint security. From what I've heard, they don't allow sensitive data on laptops in the first place—you mostly SSH into your desktop or a cloud machine. That's probably not enough to solve the issues you described, so I wonder what else they do.
  - walrus01 6y ago
    I would be shocked if they don't have a whole team of people keeping up on the threat models for client workstation windows, macos and linux endpoint devices, and creating the equivalent of windows active directory registry pushes+other software loads to guarantee the condition of an endpoint device. Otherwise how do you know an endpoint device (assuming it's on a network segment with a default route out to the internet, or is somebody in a work-from-home mode) isn't running a persistent video recording session feeding something like a realtime mirror of the screen, VNC-over-SSH tunnel to some third party. At smaller size companies I have even seen stories of a person who was hired as a fully remote developer by $software_corp, and proceeded to set up a remote desktop tool and subcontract their entire job to a person in $developing_country, at a significant profit margin.
    - csande17 6y ago
      I wonder if there are any big companies that require HDCP and some sort of "trustworthy USB devices only" system.
      - marcan_42 6y ago
        DRM is not security. Nevermind the fact that HDCP has been broken for ages and any random Chinese capture card will ignore it and Chinese HDMI splitter will strip it, if the purpose is to cheat the system then you can just point a camera at a screen (perfect video quality isn't a requirement here).
      - closeparen 6y ago
        There are companies where your (airgapped) workstation stays in the office and your phone / any other personal electronics stay outside the office.
  - zerkten 6y ago
    Microsoft documented some of what they do at https://www.microsoft.com/en-us/itshowcase/protecting-high-risk-environments-with-secure-admin-workstations https://www.microsoft.com/en-us/itshowcase/protecting-high-r....
    - jcims 6y ago
      Note this is for operations/privileged access in high risk environments vs. standard issue desktops. Saw a little bit of this up close a few years ago, seemed quite solid and well thought out.
zaphirplane 6y ago
Is posture asking the device to tell you it’s ok ? For the ignorant like me it seems a motivated and capable adversary can have an insecure device send an ok posture
- otterley 6y ago
  Posture assessment is often built into modern VPN clients. The actual procedure varies by organization and can sometimes be updated by pushing new validation procedures to the client. It's unlikely to be as simple as "run this file on disk (which an attacker could trivially replace) and check the exit code."

walrus01 6y ago

Having 100% company owned equipment allows you to do other common sense things like: a) full disk encryption with key escrow for recovery by admin team b) storage of crypto public/private key pair on disk of laptop, for instance an openvpn key file that was created on a company owned PKI server, deployed onto the laptop as part of its provisioning process, and is a unique key for both the human and that particular piece of hardware c) you can use the same crypto key pair on client device local storage, if not for something like openvpn, for other authentication purposes identifying that particular user and hardware d) obviously, have the device trust your own internal PKI's root CA for access to purely-intranet resources. getting a company root CA trusted by the browsers in a BYOD device environment is a pain in the ass.

snazz 6y ago
What does Google do in this regard? I don't work there, so I'm curious to hear about their solution for endpoint security. From what I've heard, they don't allow sensitive data on laptops in the first place—you mostly SSH into your desktop or a cloud machine. That's probably not enough to solve the issues you described, so I wonder what else they do.
- walrus01 6y ago
  I would be shocked if they don't have a whole team of people keeping up on the threat models for client workstation windows, macos and linux endpoint devices, and creating the equivalent of windows active directory registry pushes+other software loads to guarantee the condition of an endpoint device. Otherwise how do you know an endpoint device (assuming it's on a network segment with a default route out to the internet, or is somebody in a work-from-home mode) isn't running a persistent video recording session feeding something like a realtime mirror of the screen, VNC-over-SSH tunnel to some third party. At smaller size companies I have even seen stories of a person who was hired as a fully remote developer by $software_corp, and proceeded to set up a remote desktop tool and subcontract their entire job to a person in $developing_country, at a significant profit margin.
  - csande17 6y ago
    I wonder if there are any big companies that require HDCP and some sort of "trustworthy USB devices only" system.
    - marcan_42 6y ago
      DRM is not security. Nevermind the fact that HDCP has been broken for ages and any random Chinese capture card will ignore it and Chinese HDMI splitter will strip it, if the purpose is to cheat the system then you can just point a camera at a screen (perfect video quality isn't a requirement here).
    - closeparen 6y ago
      There are companies where your (airgapped) workstation stays in the office and your phone / any other personal electronics stay outside the office.
- zerkten 6y ago
  Microsoft documented some of what they do at https://www.microsoft.com/en-us/itshowcase/protecting-high-risk-environments-with-secure-admin-workstations https://www.microsoft.com/en-us/itshowcase/protecting-high-r....
  - jcims 6y ago
    Note this is for operations/privileged access in high risk environments vs. standard issue desktops. Saw a little bit of this up close a few years ago, seemed quite solid and well thought out.

zaphirplane 6y ago

Is posture asking the device to tell you it’s ok ? For the ignorant like me it seems a motivated and capable adversary can have an insecure device send an ok posture

otterley 6y ago
Posture assessment is often built into modern VPN clients. The actual procedure varies by organization and can sometimes be updated by pushing new validation procedures to the client. It's unlikely to be as simple as "run this file on disk (which an attacker could trivially replace) and check the exit code."