10 ms·
Google tries internet air-gap for some staff PCs
- retrocryptid 3y agoMaybe deploying a train load of commodore 64s would work.
- anotheryou 3y agoIf only it included meetings and messaging. This way is silly
- _8j50 3y agoI hope they also remove USB drives and don't let them connect unauthorized bluetooth and keep their laptops in the office. Most users would just start working on their home pc and then you have their work account compromised on their home laptop. With USBs, you'd be surprised how many air-gap breaching worms there are.
- lozenge 3y agoI work at a bank and I know our security is higher than most, but I'd be shocked if usb drives are allowed in the Google offices.
- OJFord 3y agoAt Arm IME they weren't banned, just training on not picking up from car park etc. - I'd expect the same of Google, at BAE Systems I physically couldn't access the USB (or any) ports on my desktop computer, but that doesn't really work when you're given a Macbook and able to work from home and coffee shop etc.
- lozenge 3y agoYou can block USB mass storage devices through OS policies, it doesn't prevent everything though (people have demoed frying computers using capacitors, or using USB keyboards to open the terminal and execute code)
- rejectfinite 3y ago>but that doesn't really work when you're given a Macbook and able to work from home and coffee shop etc. MDM like jamf and/or EDR/Antivirus like SentinelOne and Carbon Black can disable USB ports/anything in software. If your account is not admin/root you cannot remove them also.
- OJFord 3y agoTrue, I just think it's more likely Google IT provides external hard drives for extra capacity on request than that they block it. (At least for most roles, ones it's not also air-gapping!) I may well be wrong, no insider knowledge, just my outsider impression of the company.
- _8j50 3y agoThey have yubikeys, so unless they only use nfc it is likely. Also, chromebooks and usb-c.
- smueller1234 3y agoThe entire story isn't about laptops. It's about the workstations that may be used to work on code locally (or also build it locally). These machines already aren't allowed outside of premises.
- _Wintermute 3y agoI worked at a pharma company who disabled internet access for most people. Many downloaded things on their phone's 4G and transferred them to their computer with a USB cable, it was pretty pointless. That said, I'm sure Google's IT are far more competent than that horror-show.
- evnix 3y agoWe all know how this will be used in the next firing round.
- nirui 3y ago> Those who choose to participate will have their general internet access removed along with root privileges on their individual boxes if they had that Is it just a software thing? For example IP blocking via iptables? 0-days in OS kernels are not something super surprising in these days, not really sure a software lock would really help that much. Maybe they should just give their employees two computers, one air-gapped for accessing internal systems and must be kept in the company facility issued the computer, and another one fully online for accessing Stack Overflow and must not store any company information.
- politelemon 3y agoMaybe the StackOverflow bit could be replaced with a local LLM assistant?
- actionfromafar 3y agoOr a local copy of SO, there are torrents.
- umeshunni 3y agoIt's conceivable that the Google index has a copy of SO
- amf12 3y ago/> Maybe they should just give their employees two computers, one air-gapped for accessing internal systems And why do you think that may not already be the case? Even other big tech companies already give out two computers.
- smueller1234 3y agoIt is the case at Google and none of them are actually air gapped in the real meaning of "air gapped".
- lloeki 3y ago
- Animats 3y agoCan they still run Windows?[1] [1] https://www.techradar.com/news/upcoming-windows-11-pro-update-will-force-you-to-have-an-internet-connection https://www.techradar.com/news/upcoming-windows-11-pro-updat...
- deleted 3y ago[deleted]
- catsarebetter 3y agoSeems a bit extreme but I suppose they have to try to at least some mitigation strategies. 7th largest DDos attack in history last august, Gmail cyberattack a few hours ago. That's just what we know too.
- t8sr 3y agoIf you take away the word “workstation”, this is what many dev environments already look like: a mini version of the production, which includes restrictive network rules. You use the internet from your laptop, not the workstation. Also, the article is using “air gap” wrong - it refers to an actual physical disconnect, which is not what this is. Only some firewall rules are apparently getting changed. Disclaimer: I have no privileged information, only common sense from working in security and at FAANGs.
- marcosdumay 3y agoYes, but if the headline was "Google plans to firewall build servers outside of the internet" we wouldn't have read the article or done any discussion about it... except maybe for some random "wait, they don't to that?!?"
- deleted 3y ago[deleted]
- karthie_a 3y agothis is historic practise in any secure work environment , like govt departments ,healthcare,financial institutions,pharma and energy. based on level of protection required they lock the access accordingly. allowing USB in work station is not allowed generally by any employer. In most secure environments they disconnect your work station from outside world and is generally connected only to internal network. If you require internet access you can apply for it and get approved,which will be monitored by the network admins.
- formerly_proven 3y agoI thought Google’s security is so impeccable that getting a reproducible RCE on engineering workstations doesn’t matter? https://news.ycombinator.com/item?id=35581532 https://news.ycombinator.com/item?id=35581532
- cavisne 3y agoThis is exactly the sort of attack this change is helpful for, as pip would not work at all on these machines. Probably the only way to stop these “social engineering” (as google characterized it) attacks.
- hgsgm 3y agoThe scariest part of that thread is the many people saying that closing your eyes and yelling "zero-trust" means that you don't need to protect your devices from compromise.
- galkk 3y agoIf bard will provide at least somewhat useful suggestions to quirks of particular language (I'm looking at you, c++) and/or there will be whitelisted or mirrored sites like cppreference/godbolt, then I suspect I won't need actual big internet for work at all. Most of the reference documentation is actually internal project/other google sources and internal docs/guides/design docs.
- weinzierl 3y agoI find that idea fascinating but I doubt it will fly. Todays LLMs are no suitable replacement for documentation, in my experience, because their knowledge is so sparse. You will not notice it immediately because they fill the gaps with plausible nonsense. Also training a model with domain specific knowledge is not a realistic option for most of us as of today. For having all the reference documentation locally (possibly indexed in a vector database and accessible to the LLM) I'm doubtful as well, since it is so hard to determine scope beforehand. A couple of years ago I tried to program off-grid and prepared a MacBook with Dash (an OSX offline doc reader) and all the reference docs I thought I need. It was a nightmare, and that is from a dude who learned programming before the Internet, based on offline docs solely.
- vbezhenar 3y agoI worked in offline environment for a few years. It was not a nightmare. It's less productive, that's for sure, but not by far margin. And it compensates by lack of online distractions.
- wakeupcall 3y agoWorking offline is perfectly doable. I've grown not to rely on connectivity when I was living in a rural area with spotty/slow 3g connectivity at best. Not relying on network connectivity in my entire pipeline is still today a big discriminator in the stack I choose. The biggest downside was, and still is, documentation. I had a script that scavenged the installed packages and downloaded all relevant documentation packages automatically, along with a local indexing service (I'm still using and recommend "recoll"). There is a humongous gap between libc/posix (anything instantly accessible with "man" with stunning quality) and pretty much everything else. Even python, which has a decent "online" (built-in) reference, is not as convenient and easily searchable when looking at the html manual itself. A local search index doesn't have the inference power of something like google to point you to the right example you're looking for something in cppreference. And once you pass the top 10 best documented packages you have on system, you realize how downright bad everything else is documented and how much you rely on the search engine to fill the gaps from unofficial sources. For me at least, documentation was always THE problem.
- jsnell 3y agohttps://news.ycombinator.com/item?id=36780752 https://news.ycombinator.com/item?id=36780752 https://news.ycombinator.com/item?id=36797471 https://news.ycombinator.com/item?id=36797471
- danpalmer 3y agoThis article is missing a key detail: that the expected workflow is that the workstations are basically just build machines. My workstation is just an SSH server that I do builds on, everything else is on my laptop. I can’t remember the last time I used the internet on my workstation. I install packages but those come via a mirror, I scp files back and forth but that’s internal only. Lots of people aren’t on this workflow yet, but I don’t think anyone is suggesting airgapping the main interface people are using.
- strogonoff 3y agoI wonder if more package management tools should adopt the zero-install approach of Yarn Berry. You don’t even need a mirror: everything is right there in the repository. Want to update a dependency? That’s a commit, thank you very much.
- codetrotter 3y agoI imagine parent commenter meant OS-level packages. I.e. things like installing and updating clang, cmake, etc
- danpalmer 3y agoYep. It's one of the few things I'm doing on my workstation that ostensibly needs the internet, except because of the mirror it also doesn't.
- Jenk 3y agowe do the same. Codespaces, gitpod, or coder.dev all provide for this kind of workflow and honestly it just makes so much sense. Corporate desktop for comms and internet, ssh to a devcontainer (or vm if that is desired) for development activity.
- danpalmer 3y agoExactly. It's really just about isolating builds and code that runs from everything else. If you can afford the infrastructure, and can afford to make the infrastructure work well for everyone (arguably much harder), then it's a good idea with few downsides.
- valleyjo 3y agoWhen I worked on azure compute we had dedicated laptops that were basically bricks. All they did was connect to production. No internet no admin rights limited set of software. This is a pretty reasonable security move. This approach from google is basically the opposite. No internet on your workstation but your laptop works like normal.
- konschubert 3y agoThe flip side of this is that you can ease the paranoia on the coding machines. You should probably be ready for 5% of them being compromised at any given time.
- jppittma 3y agoThe workstations are the coding machines. You're not allowed to have google code on your laptop.
- junkjunkaccount 3y agosome staff = most engineers who work with the monorepo
- debarshri 3y agoI remember working in 2010 with Tata consultancy services as BofA as customer, they would make the service provider go through these hoops. The employees of TCS would connect over teamviewer into a VDI that would have access to the actual server where they would code. It used to be a hub model i.e. the VDI was somewhere is east or west cost and employees were in india, experience was crappy as the customer was getting billed per hour, no one cared.
- zvmaz 3y agoWhat's a BofA? What's a VDI? I feel like Hacker News is filled with acronyms that take some effort to parse.
- gavanm 3y agoBofA is like Bank of America. VDI is virtual desktop infrastructure (like Citrix)
- SonOfLilit 3y agoBank of America. Virtual Desktop... Interface or somesuch. I like HN full of acronyms, it teaches me what's important enough in an industry to shorten.
- aloe_falsa 3y agoBofA is Bank of America. VDI is Virtual Desktop Infrastructure. https://en.wikipedia.org/wiki/Desktop_virtualization https://en.wikipedia.org/wiki/Desktop_virtualization
- mrweasel 3y agoThat sounds terrible. I worked as a telco where we experimented with having a development environment on VMware, twelve VMs in total per developer. You'd remote desktop to on of the VMs and use Visual Studio from there, it was absolutely terrible. I can't imagine throwing TeamViewer across oceans into the mix, I'd go absolutely nuts from the lag alone.
- 3y ago
- MarkusWandel 3y agoIf these machines are denied outside internet access, but still connect to an internal network on which other machines have outside internet access, then that's a firewall, not an air gap.
- FirmwareBurner 3y agoExactly. The author doesn't know what an airgap actually means.
- yodelshady 3y agoMultiple times I've seen companies be the originator. Quite simply, it's insurance fraud. They demand an air gap, you say you have one. You can certainly argue that, at a general level, air gaps don't work for the same reason teen abstinence doesn't work. They don't happen. But in specifics, particularly for infosec professionals, it should be your job to call out dishonesty. Not to not along sagely and say "air gaps don't always work". If your airgapped machine is breached, there better be a USB lying around, or a physical configuration change. JFC, my Xbox is not airgapped. (actually it currently is. But you get the point.)
- halJordan 3y agoYou know you're in for a treat when you see a thread wanking itself over some industry term. Usually it's some brittle, partial definition being forced onto an entire industry. Idk if you've worked in a modern air gapped networked (jk) but the vast and overwhelming majority of them do in fact have a physical connection to a network capable of reaching the Internet.
- Firmwarrior 3y agoYeah, this discussion is really weird. An actual air gap would be great for security and a huge pita to work on. This half-assed fake airgap seems like a bunch of security theater that's going to make people's day to day jobs a lot more annoying
- deleted 3y ago
- 1B05H1N 3y ago""" The company will disable internet access on the select desktops, with the exception of internal web-based tools and Google -owned websites like Google Drive and Gmail. Some workers who need the internet to do their job will get exceptions, the company stated in materials. In addition, some employees will have no root access, meaning they won’t be able to run administrative commands or do things like install software. """ -https://www.cnbc.com/2023/07/18/google-restricting-internet-access-to-some-employees-for-security.html https://www.cnbc.com/2023/07/18/google-restricting-internet-... This is pretty standard across the industry for some workstations/build machines.
- mattgreenrocks 3y agoWhere I work restricts admin access. We can request it temporarily and all actions are logged. Works just fine on macOS!
- nickdothutton 3y agoAnyone mentioning is air gap is often scorned these days, because in practice it is rarely used, used for long, or survives “this one workflow we really, really need and is commercially important”. However there are occasions and situations where it can be workable. Air gap is a weapon. Know when to use it.
- AndrewKemendo 3y agoI thought BeyondCorp zero trust was supposed to completely and totally solve all of this such that air-gaps and network compartments are a thing of the past. Air-gapping is creating a system-low zero access enclave. No different architecturally than running a separate access gateway. Or is this a case of "yeah nobody ever actually believed that?" Having run classified networks there's absolutely a need for compartmentalized system-high networks
- TheNewsIsHere 3y agoI always thought BeyondCorp was intended to replace the VPN infrastructure with (effectively) a TLS reverse proxy gated by rules, SSO, device posture inspection, etc. That’s how I always interpreted the marketing and technical documentation anyway. I would be surprised if they’re not already running PAWs for things like administrative access to production GCP primitives and similar, even if they’re also running PAM, hardware authentication, and so on. I know Microsoft does for admin privileges to the Azure fabric.
- AndrewKemendo 3y agoI'm simply responding to Google's own language: "We are removing the requirement for a privileged intranet and moving our corporate applications to the Internet." That's from the original ZT paper and is making a HUGE claim that all access in computing is more secure if you use ZT over physically (not just logically) separated networks.
- anon84873628 3y agoI think "corporate applications" are different from "production infrastructure" and "developer tooling"
- TheNewsIsHere 3y agoI see what you’re saying. I agree.
- konschubert 3y ago
- fsflover 3y agoOr they could use Qubes OS, which in some cases is more secure: https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-using-a-separate-physical-machine https://www.qubes-os.org/faq/#how-does-qubes-os-compare-to-u...
- clhodapp 3y agoWhen your entire business is built around public internet services and public internet enabled devices in the hands of end users, this approach feels like losing the plot. Compare with something like BeyondCorp, which actually advanced the state of practice in corporate security just a few short years ago, in a super internet-positive way. What'll be their next old-school corporate move? Time cards? A ban on phones with cameras? A buggy middlebox that forges TLS certs?
- gunapologist99 3y agoI nearly lol'ed at the mention of time cards, but even though it seems kinda like facebook banning facebook, actually all of these could have some merit.
- clhodapp 3y agoOr like Apple banning smartphones among the people that do iPhone development
- elif 3y agoSeems like Google could just build some routing around their existing archive service and give all of their employees a stale copy of the web for 99% of cases. Use LAN for communication, etc.
- Skunkleton 3y agoWhy is this called an air gap? It’s not. They are just firewalling off workstations most (not all) of the public internet.