SoylentNews is people
SoylentNews
Submitted via IRC for chromas
Google may have sent the tired castle analogy of network security's soft center protected by a tough exterior out to pasture for good.
On Tuesday at RSA Conference, Google shared the seven-year journey of its internal BeyondCorp rollout where it affirms trust based on what it knows about its users and devices connecting to its networks. And all of this is done at the expense—or lack thereof—of firewalls and traditional network security gear.
Director of security Heather Adkins said the company's security engineers had their Eureka moment seven years ago, envisioning a world without walls and daring to challenge the assumption that existing walls were working as advertised.
"We acknowledged that we had to identify [users] because of their device, and had to move all authentication to the device," Adkins said.
Google, probably quicker than most enterprises, understood how mobility was going to change productivity and employee satisfaction. It also knew that connecting to corporate resources living behind the firewall via a VPN wasn't a longterm solution, especially for those connecting on low-speed mobile networks where reliability quickly became an issue.
The solution was to flip the problem on its head and treat every network as untrusted, and grant access to services based on what was known about users and their device. All access to services, Adkins said, must then be authenticated, authorized and on encrypted connections.
"This was the mission six years ago, to work successfully from untrusted networks without the use of a VPN," Adkins said.
Source: https://threatpost.com/no-firewalls-no-problem-for-google/123748/
(Score: 1, Insightful) by Anonymous Coward on Friday February 17 2017, @06:20PM
This has been real world thinking since before Y2K, to my certain knowledge: the nets/hosts that you don't believe to be compromised are the ones that are compromised, but you just don't know how, yet.
The first implication: don't put anything on the damn computer you really, really care about. The boss's calendar? Nobody cares. Most of those meetings he'll ditch anyway.
The second implication: defence in depth, sure, but it's meaningless if you have no way of determining whether those defences are in operation, or being tested - otherwise they're about as useful as the healing power of prayer. You need to have reports back, anomaly detection, link analysis and honeypots galore. You need to do your own white hatting, and you need to keep people accountable. Otherwise it's not defence so much as setting up laser tripwires and not wiring them to anything. Decorative, but useless.
Third implication: firewalls are mostly useful if you can see what they stop. What they let through is stuff that you can't easily differentiate, at that step of entry, from normal traffic (especially at a busy site such as a hosting company) but what they stop is a clue to what you should be looking for.
Fourth implication: all your honeypot and firewall and other logs need to be stored in some kind of WORM fashion. If not, they're the first thing that will be raped.
Fifth implication: if you know damn well that your computers are compromised, and you can't prevent that from happening because Cisco is in the pocket of the NSA, Microsoft is bug central and no power on earth will stop the receptionist from downloading trojan horses in the form of kitten calendars, the real job of security becomes reconstruction, i.e. recovery from loss.
Google are probably trying to impress people with how advanced their thinking is on this. Folks who've been in the trenches since the Eternal September aren't really all that impressed.