Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Friday February 17 2017, @03:31AM   Printer-friendly
from the trust-no-one dept.

Submitted via IRC for chromas

Google may have sent the tired castle analogy of network security's soft center protected by a tough exterior out to pasture for good.

On Tuesday at RSA Conference, Google shared the seven-year journey of its internal BeyondCorp rollout where it affirms trust based on what it knows about its users and devices connecting to its networks. And all of this is done at the expense—or lack thereof—of firewalls and traditional network security gear.

Director of security Heather Adkins said the company's security engineers had their Eureka moment seven years ago, envisioning a world without walls and daring to challenge the assumption that existing walls were working as advertised.

"We acknowledged that we had to identify [users] because of their device, and had to move all authentication to the device," Adkins said.

Google, probably quicker than most enterprises, understood how mobility was going to change productivity and employee satisfaction. It also knew that connecting to corporate resources living behind the firewall via a VPN wasn't a longterm solution, especially for those connecting on low-speed mobile networks where reliability quickly became an issue.

The solution was to flip the problem on its head and treat every network as untrusted, and grant access to services based on what was known about users and their device. All access to services, Adkins said, must then be authenticated, authorized and on encrypted connections.

"This was the mission six years ago, to work successfully from untrusted networks without the use of a VPN," Adkins said.

Source: https://threatpost.com/no-firewalls-no-problem-for-google/123748/


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by darkfeline on Friday February 17 2017, @06:33PM

    by darkfeline (1030) on Friday February 17 2017, @06:33PM (#468299) Homepage

    The way I interpreted the summary: Instead of the industry standard practice of having all internal services basically unauthenticated and unsecured, and securing external access via firewall and VPN, all internal services authenticate every single connection. Thus you don't really need the firewall+VPN anymore. Anyone who would have been able to access VPN and thus have full access to all internal services would be able to authenticate to each service individually, and the inverse, converse, and contrapositive holds as well.

    But once you have authentication on every connection, the firewall+VPN combo is kind of redundant, it's not really adding any extra security since anyone who could have authed individually could auth via VPN.

    --
    Join the SDF Public Access UNIX System today!
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2