14 ms·
Google Moves Its Corporate Applications to the Internet
- Splendor 11y agoI'm not a security expert by any means, but this seems like an intelligent move to me. And it sounds like this process of accessing corporate applications has the potential to be less onerous for employees.
- atlbeer 11y agoThe probably falls in the general category of a Good Thing™ for employees and people developing B2B applications since internal systems are more easily accessible but, this will be a gut check/squeaky bum time for traditional on-premises B2B vendors like PeopleSoft/SAP/IBM and the like. The corporate firewall has always been a bastion of security they have been able to hide their applications behind. As the concept of a corporate firewall begins to fade their security risk increases and previously non-worrisome attack vectors become serious problems for them.
- JTon 11y agoApologies for being off topic.. > squeaky bum time Never heard this expression before. Quick search defines it as "An exciting part of a sporting event, particularly the final minutes of a close game or season". Unfortunately, I still don't really get the reference. Could someone spell this out for me?
- rmac 11y agoInsecure enterprise software and poor security practices mean death to firewalls and to vpns will take a long, long time. People hide behind these things for a reason. Google is right here though, this makes things easier for employees and probably saves them money (no vpn); unfortunately most orgs don't have the staff/expertise to pull something like this off. More importantly though, I think google builds all their enterprise web apps in-house (speculating). Most orgs who do have intranet apps use 3rd party off the shelf software so pulling off Google's BeyondCorp architecture is less likely as they can't control or easily modify how they work. Ergo, VPNs are here to stay. Even for those orgs who write their own internal applications: do you really want to expose your internal analytics dashboard to the internet?! GASP.
- deleted 11y ago[deleted]
- jahewson 11y agoLogin systems are only one small part of the surface area of most applications. Admin backdoors, an absence of SSL, SQL or other injection attacks, protocol vulnerabilities, unpatched code, homegrown/weak crypto, session hijacks, and XSS attacks going to need fixing too. Applying patches in a timely manner will be essential too.
- mikecb 11y agoFinally, the zero trust network has its day. I've been following this for quite a while, especially since this kind of architecture makes even more sense for smaller businesses than large ones that can pay for sophisticated network-edge protection. Edit: Great talk at lisa in 2013: https://www.usenix.org/conference/lisa13/enterprise-architecture-beyond-perimeter https://www.usenix.org/conference/lisa13/enterprise-architec...
- omnibrain 11y agoYes, I submitted this yesterday (instead of the article submitted here, because I found it to be deeper and did not want to submit 2 links at the same time), but sadly it failed to gain traction.
- higherpurpose 11y agoVideos don't usually gain traction on HN.
- rconti 11y agoOTOH, Google is way too big to be able to trust all of their users. And this just happens to be excellent advertising for them.
- jldugger 11y agoOn what planet was that talk "great?"
- deleted 11y ago[deleted]
- evmar 11y agoWhat's left implied but unstated in this post is that a corporate intranet is often in practice as vulnerable as the internet -- from unpatched Windows to old Android versions to people plugging in random USB dongles to a million variations on XSS/XSRF, once you've made your corporate network secure against these attackers it's also secure against the wider internet.
- Splendor 11y agoI felt like that was stated clearly in the second paragraph. > "The new model — called the BeyondCorp initiative — assumes that the internal network is as dangerous as the Internet."
- evmar 11y agoYou are right. I had meant they left out why the internal network is dangerous. They open with assuming it is dangerous and then discuss how to implement it.
- rifung 11y agoI hope this means accessing internal resources will be a lot less painful too
- furyg3 11y agoWe tried this where I worked (with the exception of the evil desktop app financial program)... and had to retract after a zero day defacement in one of our web apps. In the meantime we also learned that keeping all of your web apps 100% up to date at all times is really freaking difficult. The good news is that the (failed) attempt got us off of a few client side applications and made us much more platform agnostic than we were before. If you have the resources of Google it's a bit different, especially if all of the software is custom and developed internally.
- tedchs 11y agoYou can't succeed with this model by just setting your firewall to allow 0.0.0.0/0. This approach still requires defense in depth, and a holistic view of security. If someone was able to deface your web app, then your company wasn't actually using all the components that are required to make this model work (such as authenticated devices, device patch management, and user 2-factor authentication).
- giovannibajo1 11y agoWhat are "authenticated devices"? The closest I can think of are client certificates being installed on the devices and used as a first-level of authentication. It could be anything from TLS client certificates to VPN certificates.
- mdwrigh2 11y agoYep, client certs installed on a device with verified boot and an account authenticated via 2FA would be a good start.
- lukeschlather 11y agoIf you do it right (store the cert in a TPM) the device itself actually is a second factor so you don't need anything other than the device.
- 11y ago
- jreed91 11y agoThe access proxy is somewhat similar to what Cisco is doing with TrustSec. http://www.cisco.com/c/en/us/solutions/enterprise-networks/trustsec/index.html http://www.cisco.com/c/en/us/solutions/enterprise-networks/t...
- jingo 11y agoI wonder which "cloud hosting provider" they will choose. Microsoft? Amazon? Does it make a difference? If my company starts selling cloud hosting and then I announce my company will be hosting its internal applications in "the cloud" (i.e., in my own data centers), what are the security implications for my company? Are they the same if some other company asks me to host their applications in my data centers? Is this article a PR piece (or "submarine" as PG calls it)? What do you think?
- taylorwc 11y ago> I wonder which "cloud hosting provider" they will choose. Meant to be sarcastic? Google is in this market. Doesn't strike me that there is any chance they'd use MSFT or Amazon for infrastructure.
- stephengillie 11y agoIn a way, it seems similar to what Amazon did when they launched AWS.
- dzhiurgis 11y agoThey used Salesforce before for something (probably Adwords). Could be expanding.
- passive 11y agoAs a remote worker, it's delightful to see things move in this direction, as VPNs are a regular thorn in my side. Of course, there's a certain irony that Google isn't fond of remote workers. :)
- munificent 11y agoGoogle doesn't like workers who always work remotely, but periodically working from home (or the bus, or hotel, or coffeeshop, or the lobby at the auto mechanic, etc.) for a day is common for all employees.
- passive 11y agoFair enough, but that still limits potential employees to a certain physical proximity to Google offices. While there are a number of those, and I aim to bring one here eventually, it is still a limitation.
- Touche 11y agoBut why would anyone not be willing to leave their family, friends, and life behind and move to one of the most expensive cities in the world in order to work at Google? Isn't work important to you?
- magicalist 11y agoAccording to his github profile, munificent lives in Seattle, so...
- praneshp 11y agoThat is the same policy that my $BIG_INTERNET_CORP_WITH_FEMALE_CEO copped a lot of flak for because of the news being mis-reported by the media.
- stephengillie 11y agoFew workplaces are fond of remote workers. The major reason a lot of people remain employed is so they have a purpose to wake up, leave their houses, and spend the day occupied by the relative comfort of an office building, surrounded by reasonably-intelligent coworkers, as a faux-family. And it's a slap in their face that you don't want to spend your time basking in their physical proximity.
- zmanian 11y agoSeeing the strength of google migrating all their employees to yubikeys
- serve_yay 11y agoIt's nice to see companies moving towards taking security more seriously, but boy oh boy some of it is a real pain in the ass. Every website you log into now needs to text you, or have a companion app or whatever. Every time you lock your screen to get a cup of water or take a leak, you have to log back in, wait for your flaky vpn connection to come back before you can resume what you were doing (maybe not an issue here if they actually do away with the VPN). "Credentials" often comes down to typing very long cryptic passphrases, on a glass screen, with dots instead of being able to see what you're typing. Et cetera.
- netheril96 11y agoAre you on OS X and have you unchecked the option "Disconnect when switching user accounts"?
- cs702 11y agoI'm so happy to see this. As Bruce Schneier (who runs an open WiFi network at home) explains, "if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1] The same is true for corporate applications (and devices like printers). If they're not secure on a public network, securing the corporate network won't reduce their risk that much: they're still exposed to potential breaches elsewhere in the corporate network. -- [1] https://www.schneier.com/blog/archives/2008/01/my_open_wireles.html https://www.schneier.com/blog/archives/2008/01/my_open_wirel...
- Afforess 11y agoThere are other, valid reasons to not run a public access point. Not wanting neighbors to steal your bandwidth, run a TOR node off it, or host illegal content, for example. All of these activities could get you removed from your ISP, and even taken to court. While you could probably prove your innocence in court, I can not imagine why taking the risk for absolutely no personal benefit is worth the risk. I don't really see how running an open wifi network shows anything other than ignorance of the risks.
- icebraining 11y agoDo you think Schneier is ignorant of the risks?
- bduerst 11y ago>Certainly this does concern ISPs. Running an open wireless network will often violate your terms of service. But despite the occasional cease-and-desist letter and providers getting pissy at people who exceed some secret bandwidth limit, this isn't a big risk either. The worst that will happen to you is that you'll have to find a new ISP. ^ FTA. Not "ignorant", but more flippant. Not everyone has options when it comes to ISPs.
- DrStalker 11y agoOr unlimited bandwidth. There's no way I'd run open WiFi in Australia because I only have a finite amount of downloading I can do, and I pay for the amount I expect to use myself so can't afford other people leeching off my connection.
- rdl 11y agoThis kills BYOD, right, at least for now? "Employees can only access corporate applications with a device that is procured and actively managed by the company"
- dragonwriter 11y agoIt seems to me that any company whose business involves providing secure web apps to external users (who aren't using devices specially trusted by the company providing the service) ought to be able to provide its corporate applications on the same basis.
- mikecb 11y agoI doubt it: https://www.android.com/intl/en_us/work/ https://www.android.com/intl/en_us/work/
- deleted 11y ago[deleted]
- dantiberian 11y agoOne of the biggest reasons for BYOD is so you don't need to deal with the crappy supplied hardware of your employer and you can bring your own. I'm pretty sure that Google employees get their pick of hardware so this would remove at least one big reason for BYOD.
- bduerst 11y agoAndroid Work Profiles has this covered, if you would want to use your own android phone. It also means you allow your device to be managed remotely by the company (i.e. purged if lost/stolen).
- tjohns 11y agoIt's worth reading the original "BeyondCorp" paper that discusses this: http://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/43231.pdf http://static.googleusercontent.com/media/research.google.co... As some other folks have pointed out (and contrary to what the headline implies), there's isn't just setting your firewall to allow 0.0.0.0/0. In particular, pay attention to the Device Identity (client cert) and the Access Proxy parts.
- NovaS1X 11y ago"The Cloud" that they're talking about is their own datacenters (they're certianly not using EC2) and they're hosting their web-apps over a WAN without VPNs or other traditional forms of closing off access. However, this doesn't say much about their datacenters which will still be heavily firewalled. IPMI, SSH, and other access wouldn't be shared over a wide open WAN. The "Cloud" (see: datacenter) LAN will still be protected traditionally. This article doesn't have enough information in my opinion.
- mynameisvlad 11y agoI mean, of course it's their own datacenters. They're not going to be putting their corporate data in a competitor's data center. That said, they could be leveraging new things in their Google App Engine cloud, which would actually make it "the cloud" as people refer to it.
- NovaS1X 11y agoI'm glad you mentioned that. A full scale switch like this, if successful, would be great marketing ammunition and would simplify the administration of their datacenters. No separation of their cloud hosting and internal services would greatly simplify administration at the cost of having to beef up security mentioned in the article.
- ocdtrekkie 11y agoThe funny thing is, they expect everyone else to put their corporate data in their datacenters! Google has an extremely one-sided view of where data should go. (In all cases, directly to their servers.)
- mynameisvlad 11y agoDo they, though? They expect everyone else to put their product in their datacenters. I'm sure they'd like it if others also put their company data in (more revenue, after all), but I wouldn't say that anything they have offered is really pushing for the corporate data in the cloud aspect. I'd say Amazon is more aggressive on that side with things like WorkSpaces and WorkDocs.
- grantlmiller 11y agoThis brings up a few questions: 1) Does Google not use the same publicly hosted version of Google Apps that we all use? 2) Does this only work with privately hosted versions of applications? 3) Are they using the publicly hosted version of Google Auth for the authentication piece? 4) Is the Device Inventory Database hosted on a public machine or is that deployed to a private network? 5) digging into the white paper that provides a bit more information on how they're actually doing this… does anyone care to take a crack at explaining what this means? "BeyondCorp defines and deploys an unprivileged network that very closely resembles an external network, although within a private address space. The unprivileged network only connects to the Internet, limited infrastructure services (e.g., DNS, DHCP, and NTP), and configuration management systems such as Puppet.” (full white paper published by google available here: http://static.googleusercontent.com/media/research.google.com/en/us/pubs/archive/43231.pdf http://static.googleusercontent.com/media/research.google.co...)
- mbreese 11y agoOne interesting question is: how many companies have enough public IP addresses to publish their applications to the internet? If you assume that there are multiple services and each one is hosted on their own server (or server farm), then you'd need many more public IP addresses. When we live in a world that is severely lacking free IPv4 space, how feasible is this? Or is this just a matter of pushing things from 10.0.0.0/8 land to IPv6 addresses? How many locally developed enterprise apps have good enough security to be put on a public facing site and have good IPv6 support? I applaud the idea and the effect of forcing security to be dealt with. But I don't know how feasible it is for corporations without their own B or C blocks.
- colechristensen 11y agoIf it's http, it doesn't matter much. You can put a thousand different sites on one (or probably a few) IP and have a load balancer distribute the requests to the appropriate set of backend servers.
- mbreese 11y agoI'd like to agree, but I think you overestimate the sanity of many Enterprise IT designs... It certainly would be helpful if there was a single point to handle the device-level authorizations, but again, many existing systems aren't necessarily designed to play well with others.
- deleted 11y ago[deleted]
- superuser2 11y agoAny sane design is going to have exactly one ingress/egress for end-user traffic per application. Even an application with a few hundred servers is only going to be available to end-users at 1 IP address (maybe several for load balancing/redundancy). It wouldn't be hard to add a global reverse-proxy/load-balancer HA cluster at the actual network edge forwarding traffic to individual applications' own load balancers.
- sixdimensional 11y agoI wonder how far this really extends into their network and how ipv6 is related. In principal it sounds really good to me. I realize this is mostly about access to corporate applications, but how much further could this approach go? Thinking out loud, if I suddenly removed the firewall perimeter security from my network, moved security to devices/servers directly, dropped my NAT, switched to ipv6 with all publicly routable addresses, my network infrastructure simplifies incredibly. However, I do have to still protect my network to ensure network quality of service/availability and protect my devices/equipment from "public attacks". I guess the principal here is, the surface area that can be attacked is the same if you can penetrate the layered security approach - it all ends in the devices and equipment. The fact that all devices/equipment can now have an publicly routable/addressable IP in ipv6 solves the problem of running out of address space, and would fit hand in glove with such an architecture. Put another way, the network becomes just the network, without the need to discern between the intranet/LAN, the extranet/WAN (or DMZ) and the Internet/WAN.
- superuser2 11y ago>can now have an publicly routable/addressable IP in ipv6 Almost no one can actually route "publicly routable" IPv6. When it becomes a standard feature of DSL/cable, maybe.
- ef4 11y agoYour information is out of date. Every T-Mobile subscriber with a modern Android device on LTE has a fully-working, native ipv6 address. And somewhere between 30% and 50% of Comcast subscribers already have native dual-stack ipv6.
- teraflop 11y agoTime Warner Cable supports IPv6 as well.
- superuser2 11y agoSomewhere between 50 and 80% of Comcast subscribers, then, do not have IPv6. In a couple years, yes this should be viable, but it isn't now.
- smegel 11y agoReally so they are using a 3rd party hosted HR systems etc on the internet, or something on their own services? When you are talking about a company like Google that basically owns a large part of the internet (backbones, CDNs, hosting services) "moving stuff to the internet" it means a lot less than a non IT company like a bank.
- gmrs 11y agoWhat if I plug a pendrive in one of these devices and install an app that reads every network activity? If I have the same sequence of packages required to authenticate, I'm in?
- zobzu 11y agoTldr google no longer use vpns for corp access
- mark_l_watson 11y agoWhat has changed? I worked as a contractor at Google in 2013. Everyone had a securely locked down company laptop. All logins anywhere required a dual auth device. I was really sick one day and I had no problems doing my work from home. Also, one of the great joys of working at Google is the availability of code labs that are individualized instruction to learn different aspects of their infrastructure and technology in general. I spent a ton of time when at home working through code labs that were relevant to my job. No problems with remote access.
- snowwrestler 11y agoThis seems like the sort of thing that can work for Google because Google runs on Google software, which runs on Google hardware. They control the full stack from top to bottom, so they can decide where to put the doors and where to put the monitoring. Most companies run on stuff that is not their own. Microsoft Exchange running on Windows running on VMWare running in some 3rd party datacenter is a fairly modern way to host an email server. In that situation, everything is out of your hands BUT the network edge. You don't audit Microsoft's code bases, you don't specify how Webmail works, you don't control the discovery, disclosure, or patching of critical vulnerabilities. Sure maybe the firewall/IDS/VPN only keeps amateur griefers out, but there are way more of those than APTs. And folks will only have limited insight into the internals of all this 3rd-party software. But if you have a gated network, then you can use a tool like NetWitness to characterize and alert on your traffic--and just your traffic.
- rev_bird 11y agoI think I'm missing something important here. I understand it as far as "internal networks give people a false sense of security," but it's still worth something, isn't it? Why not implement all of these security features AND keep your internal network locked up? Is it really just convenience?
- umonicd 11y agoThe return of capability based security? Couldn't help but notice the phrase "fine grained access", I guess your device acts like a sort of token?
- itaysk 11y agoNothing new here.. I work for Microsoft. we have had most of our tools in the cloud for quite a while. One thing's for sure - every new app is cloud based. We use Azure AD and multi factor auth to allow access from internal and external networks. It's pretty common with small\medium companies I work with, maybe less with large enterprises.
- lessthunk 11y agoif it's crucial for the company, it should not be on a public internet.
- a-dub 11y agoso THAT'S why they bought up the .dev TLD. lame.
- priyajv99 11y agoThe biggest problem with VPNs these days is that they connect a user to the network, not just to the applications they need to access. Any malware on the users device can ride the VPN into the network and start having fun. Sure you can micro-segment the network to limit the damage but at least the Google approach puts all traffic through an "Internet-Facing Access Proxy" limiting exposure to the individual applications in question. However, I completely agree with the previous post that the user devices need to be considered untrusted. This is a huge problem with the Google approach. Certificate distribution and management on thousands of employee owned devices is not practical nor scalable. https://oxter.in https://oxter.in