11 ms·
Google restricting internet access to some employees for security
- dfee 3y agoNo thank you.
- yeputons 3y ago> In addition, some employees will have no root access, meaning they won’t be able to run administrative commands or do things like install software. Did they _ever_ had root access in the last, I don't know, ten years?
- t90fan 3y agoprobably? Every tech company I've ever worked at, normal devs have had administrator access on their own Mac or Linux workstations, its only usually the sales/product folks who have locked down Windows machines. And most SRE folks have sudo access on production VMs too
- incomplete 3y agofwiw i think the article is talking about root on their lap/desktop machines, not production. and regarding production, pure root access was revoked for everyone YEARS ago and replaced w/user and admin role accounts. admin was severely restricted, and could do most (but not all) things that root could do. this was for a server only, not accessing anything in borg/omega. also, if a rando package was installed on a prod server there are safeguards in place that would detect a change and wipe it immediately. in my time that was called the 'assimilator'. i'm sure that a very, very select few have actual root/sudo. (disclaimer: i worked there 03-11, the role accounts were rolled out in 08 or 09 IIRC. things could be different now, and if so probably even more restrictive)
- dnr 3y agoIt wasn't quite immediately, it would take a few hours to detect+revert. And that was only the root fs, there were other places to hide things if you really wanted. But then there were other detection systems too. (Probably fairly different now, I left in '11 too)
- incomplete 3y agoturtles all the way down...
- MattGaiser 3y agoEven in every non-technical company I have known, except one, has allowed its devs root access on their own machines. I have never needed someone else's password to install software or run Sudo on a work machine.
- bitwize 3y agoWell, lucky you. In the real world, endpoint security is very much a thing, and that means workstations so locked down, you can't even change the screensaver, let alone install unauthorized software. If you work in health, for all intents and purposes you must be HITRUST compliant, and that basically mandates all sorts of lockdowns and network restrictions. ANYTHING that touches PHI must be airgapped.
- hamburglar 3y ago> In the real world, endpoint security is very much a thing, and that means workstations so locked down, you can't even change the screensaver, let alone install unauthorized software. I've been in the software industry since 1989 and I've never worked at a single company that didn't let developers have root/admin on their own PCs. "The real world" is quite a varied place.
- post-it 3y agoYeah, and working in health sucks. I would characterize the "real world" as being outside of the health industry. You could also just do all of your development with fake PHI, but I've learned not to tell health people what to do.
- greiskul 3y ago> You could also just do all of your development with fake PHI, but I've learned not to tell health people what to do. Yeah, software companies like Google also lock user private data like crazy. But you can have root access (or at least you could when I worked there), cause for 99% of development, you couldn't touch actual user data anyway.
- lokar 3y agoEngineers always had root on their desktop and laptops.
- pierat 3y agoMost companies don't permit Linux as a desktop. In most orgs, you'll see Windows and the sysadmins and devs will have LOCAL\administrator, but not LOCAL\SYSTEM. That's usually because developing software(debuggers) or using sysadmin tools is a admin-only thing. As for me, I do prefer Linux on the desktop proper, with appropriate sudo access for root access. But again, I also do want SELinux on as enforcing, and fapolicyd enabled with good setup. If it's a laptop, I definitely want clevis and tang for enforcing attested and encrypted drives. If my shit is stolen, I dont want to be the vector where everything is stolen.
- tylerhou 3y agoThe standard engineering desktop at Google comes with Linux.
- nxx788 3y agoEvery company I've worked at prefers Linux desktops over Windows and Mac.
- jchw 3y ago> Most companies don't permit Linux as a desktop. I've only been at one such place. At Google the desktops mostly run Linux, and you pretty much only get another option if you're actually working on stuff that needs it.
- kevingadd 3y agoYes.
- nova22033 3y agoGoogle is enlisting employees for a pilot program to work without internet access. it's a pilot program..
- inoffensivename 3y agoThese things have a habit of turning into policies. The data will be interpreted to agree with whatever outcome the enactors want.
- tekla 3y agoExamples from Google?
- imchillyb 3y agoNo need for examples. Another term for Pilot Program is: Feasibility Study. The reason for the pilot is to study dynamics in play before rolling out a general policy, or to assess the feasibility of scaling up a program. This is standard operating procedure in the corporate world, and isn't unique to tech-bros or FAANG.
- saagarjha 3y agoCLOE?
- Forge36 3y agoIf I had two computers I'd consider this. I'd probably want a KVM to swap the keyboard and mouse
- backtoyoujim 3y agoAh the ol' 'no internet access but internet access' type of no internet access.
- skybrian 3y agoYou'd still have your phone, I presume? "No internet access" isn't what it used to be.
- galkk 3y agoUsually disposable vm is enough, like windows sandbox. Googlers by default, though, aren’t allowed to run vms (VMware/virtualbox style) on their desktops/workstations.
- xnx 3y agoI thought most Googler's main machine was virtual. Maybe not for developers? https://cloud.google.com/blog/topics/developers-practitioners/googles-virtual-desktop-future https://cloud.google.com/blog/topics/developers-practitioner...
- 3y ago
- oneplane 3y agoThis is not a strange hardening technique at all. You'd obviously weigh the friction vs. added security, but at Google scale you'd probably be engineering on Google sources using Google tools on Google systems anyway, it's not like you're sitting around installing a random binary from reddit on your google server and calling it a day. Perhaps a follow-up program ends up with a Qubes-like configuration, or just separate systems.
- rodgerd 3y ago> This is not a strange hardening technique at all. On the one hand, I agree. SWIFT recommend (in a similar vein) that machines that you do SWIFT tasks with are segregated from your daily driver last time I read the SWIFT standards; Microsoft recommend locked-down, no-access machines for a lot of AD admin tasks. If you do work in "I can tank a bank" roles, this will sound familiar. On the other hand, this will also lead to cargo-cult "but Google programmers don't need Internet access, why do you?" On the gripping hand, perhaps a bunch of Google people being restricted this way will lead to an resurgence in development and documentation practises that don't assume that you can download crap from the Internet all the time. That would be nice.
- dietr1ch 3y agoTBH, I doubt benefits really go outside, "no internet" at $BIGCORP's intranet is not the same as no internet at home. There's internal sites for searching, documentation, code, forums, newsletters, Questions/Answers, chat, calendar, video conferencing, browsing memes, looking at cat pictures and probably more.
- patrakov 3y ago> On the other hand, this will also lead to cargo-cult "but Google programmers don't need Internet access, why do you?" Just a random thought: this coincides with the rollout of Bard. Perhaps the idea is that Bard (or its internal equivalent) is a suitable replacement for sites like StackOverflow?
- greiskul 3y ago
- pierat 3y ago> Google is running the program to reduce the risk of cyberattacks, according to internal materials. “Googlers are frequent targets of attacks,” one internal description viewed by CNBC stated. Fair. The higher the profile you have, the worse and the more numerous the attacks. I found after creating a LinkedIn account, attacks went up on my account 12x. Again, caveat emptor... but this makes a great deal of sense in who to target. When you willingly put "I am Gee Golly Whillikers, Sr Systems Engineer of Really Important Systems that 10m people use", well... you're self-selecting who to hit. > The company has also in recent months been striving harder to contain leaks. Wait WHAT? That's what we cybersec folks call an "Insider Threat". "Leaks" are done by insider employees wishing to harm the org they work for, up to leaking classified data, or secret corporate data. This is a WHOLE DIFFERENT REALM of attacks, and relevant appropriate defense. And this is how you get SCIF's https://en.wikipedia.org/wiki/Sensitive_compartmented_information_facility https://en.wikipedia.org/wiki/Sensitive_compartmented_inform...
- chayesfss 3y agoHa, was a principle for a company for years, the never ending attacks were horrible.
- deleted 3y ago[deleted]
- nneonneo 3y agoLeaks also happen accidentally, e.g. by employees copy-pasting sensitive data or code into ChatGPT or using Copilot. Although that may not result in a breach, it certainly opens up legal and IP concerns for Google.
- jhugo 3y agoI’m not sure those examples should be referred to as “accidents”. If you deliberately give the information to an external company, you leaked it deliberately, even if you thought they wouldn’t do anything bad with it.
- tommiegannert 3y ago
- masto 3y agoMisleading and/or misunderstood.
- smfjaw 3y agopretty common thing, I work in investment banking and it's not uncommon to have no internet access as a dev, not common but not uncommon
- hgsgm 3y agoNo one with technical knowledge contributed to this report.
- cglong 3y agoI remember, during my internship at Microsoft, one of the "perks" everyone loved was being given a beefy machine that we were admins on and an absurdly fast internet connection to go with it. While I do get the security argument, this also seems like yet another signal that Google is tightening their infamous perks.
- kccqzy 3y agoGoogle also gives (gave?) employees root access on the work machines (https://news.ycombinator.com/item?id=32307102 https://news.ycombinator.com/item?id=32307102) and an incredibly fast internet connection. As a non-employee, you only need to walk into the lobby, sit on a couch meant for visitors, connect to the unsecured GoogleGuest Wi-Fi network and enjoy that absurd speed. I live very close to Google offices and I occasionally bring my laptop there since my home internet has terrible upload speeds.
- footlose_3815 3y agoXoogler here. You have to get permission to get root access and it's only temporary.
- bagacrap 3y agoI don't think they're doing this to save money on Comcast bills
- freedude 3y agoNo, but they might be doing it to save on incident response, time wasting, protect IP, and meet a certain security standard in the future.
- cglong 3y agoI don't mean to say it's about cost savings; I meant that they're choosing the most expedient approach to this problem at the expense of employee happiness.
- cebert 3y agoI know it’d be incredibly painful initially, but I’m surprised more firms don’t adopt a policy where they only accept traffic to an approved accept list of IPs/domains instead of permitting traffic unless explicitly denied. With an interface that allows employees to request allowances, this seems like a great added layer of security.
- balls187 3y agoBack in my day with TS clearance working in certain airframes there was no internet access. Also no personal electronics allowed inside the secure area except for a portable cd player, and a single audio disc (had to be pressed).
- thefurdrake 3y agoYeah, this sounds a lot like Google wants to create SIPRnet and SCIFs, restricting external access like that. Probably wise, considering how tasty a target Google is.
- gizmo686 3y agoMy employer does a similar thing for people working on particularly sensitive projects. Those employees are given a second laptop to use for internet.
- dmoy 3y agoI was never allowed in, but at a previous employer we had a scif onsite that had no internet in that room, and nothing was allowed out (except by a very painful process involving a briefcase, handcuffs, multiple people, etc). Needless to say none of the computers in the scif has internet. Keeping them updated was surprisingly simple - we could bring updates in, we just had an increasing stack of USB drives and hdds that never left lol.
- grishka 3y ago> except by a very painful process involving a briefcase, handcuffs, multiple people, etc What the handcuffs were for?
- defrost 3y agoAttaching briefcase to wrist to deter snatch and run thefts.
- advisedwang 3y agoIt prevents someone grabbing the briefcase from you and running off.
- acomjean 3y agoI worked in a place that had separate networks. The one with internet didn’t have our projects on it. It was kinda a pain to not have internet to look stuff up, but it was ada or c++ and we had books…
- 10g1k 3y agoIsolated syetems are very common. I don't know how this even made it into news.
- jeffbee 3y agoWhat goes around? When I joined that company many years ago, people with production access had a completely separate computer for that purpose.
- deleted 3y ago[deleted]
- chevman 3y agoSuprised they don't already do this. In BigCo land there are multiple attack vectors to the top execs. I was literally in a convo today where our CFO and his EA are now virtually unreachable due to this type of stuff. Our IT team gave everyone burner phones above a certain grade level. Strange days!
- zeroCalories 3y agoA company like Google provides critical infrastructure for the internet. They're full of very smart people, but they have had some very sloppy goofs over the years. I'm glad that they're trying to be more dependable.
- housemusicfan 3y ago> They're full of very smart people, but they have had some very sloppy goofs over the years. That's because smart people tend to overestimate their abilities and think they are invincible. In fact the comment posted just below this one is jumping to conclusions that this probably only applies to the inferior-intellect mechanical and electrical engineers.
- zeroCalories 3y agoI don't know if they're really overestimating their abilities. When I see things go wrong, most of the time people knew it was a possibilty, but it got deprioritized and forgotten about. Process helps avoid that and guardrails protect you when an unavoidable error does happen.
- mardifoufs 3y agoStupid question: I thought google was well known for its zero trust security model, is it completely unrelated? I read the article, but it doesn't mention beyondcorp at all. And if it applies at all, what threats are not well covered by zero trust security that would require this? I think I misunderstood a concept (or two lol), since I thought an employee's device was basically "untrusted" by default in google's case. And there wasn't really a lot to gain by simply targeting an employee's device ?
- kccqzy 3y agoI have a feeling* that this is another case where Google's internal politics and promo culture rears its ugly head. I don't think the team behind this effort talks to the team responsible for BeyondCorp. Or maybe they do, but the person who came up with this idea wants a promotion so much that they decide to ignore BeyondCorp with some half-heartedly written doc. *: Just a feeling. I have no proof. Just speculating. Take it with a huge grain of salt.
- advisedwang 3y agoBeyondcorp is not used for access to non Google sites (and even if it was, it could be a WAF but not much more). As for how beyondcorp protects if a employee workstation does get owned: the zero trust means simply being within a network permimeter does not grant access... But employee workstations are trusted to do whatever that employee is authorized to do. So beyondcorp massively reduces what an attacker can do and adds lots of hurdles (e.g. requiring pressing a security key, pervasive monitoring), but doesn't render a hacked employee workstation harmless
- mardifoufs 3y agoAhhh that makes a lot of sense!! Thank you! I guess it is inevitable that an attacker could have access to something, no matter how constrained and limited it is, as long as they can get an employee to authenticate even if it is for a single action. It still sounds miles better than the traditional IT hell that is trying to constrain the devices as much as possible instead of securing the network and implementing auth internally.
- sonicshadow 3y agoProbably not for software engineers, just non tech savvy folks like the mechanical and electrical engineers.
- saagarjha 3y agoSoftware engineers.
- thefurdrake 3y agoHaving worked a job reviewing the coding habits and behaviors of software engineers for a year and a half, I'm gonna just go ahead and say you're wrong, it's probably especially for the software engineers.
- lgleason 3y agoI had to work in an environment like that. It sucked. Then there were the corporate internets the blocked certain sites to prevent employees from surfing the internet too much. Those were annoying as well. Did they really add any security, tough to say because those places I mentioned also didn't tend to hire and retain the best and the brightest. Most of those types of people wanted more autonomy.
- cat_plus_plus 3y agoSo process/VM isolation is not even worth trying anymore? Ideally your web browser can access Internet but only Download directory on your filesystem and you can span VMs that can access particular memory ranges / disk sector ranges / devices. This is very useful for reading online manuals or for developing new Linux apps / device drivers. I am not sure what is proposed alternative is or how its going to be more secure in practice. If side channels are really hopeless, have browser transparently run on another physical machine and tunnel display to your workstation.
- yxre 3y agoI don't think its possible for any platform that allows for arbitrary code execution to be completely safe. The exploits of today are far more sophisticated than they needed to be 20 years ago, but they still exists and are harder to find and fix.
- reportgunner 3y ago> The company will disable internet access on the select desktops, with the exception of internal web-based tools and Google-owned websites like Google Drive and Gmail What they are doing is called a "firewall", we have been doing that for a few decades now. I even use a firewall at home !
- nunez 3y agoLovely to see Google reinventing and decentralizing air-gapped networks. :-)
- andy89 3y agoGoogle's move to restrict internet access for some employees shows the company takes security seriously. It's a proactive step to safeguard sensitive information, but striking a balance between security and productivity will be crucial.