Google's Plan To Kill the Corporate Network 308
mask.of.sanity writes "Google has revealed details on its Beyond Corp project to scrap the notion of a corporate network and move to a zero-trust model. The company perhaps unsurprisingly considers the traditional notion of perimeter defense and its respective gadgetry as a dead duck, and has moved to authenticate and authorize its 42,000 staff so they can access Google HQ from anywhere (video). Google also revealed it was perhaps the biggest Apple shop in the world, with 43,000 devices deployed and staff only allowed to use Windows with a supporting business case."
Re:Goobuntu (Score:5, Interesting)
that's how my corp network works (Score:5, Interesting)
Re:Genuinely Interested (Score:5, Interesting)
Interestingly, the company I work for is also like that. In our office, the "network" is just a regular consumer grade router (plus an expensive cisco AP). But we don't use VPNs (VPNs suck), all of our services are Internet accessible and protected independantly. So web-stuff is SSL + http authentication, email is IMAP, calendar is caldav. source code is ssh+git, etc. We have an internal SIP service (but that's also Internet connected).
Also, look at how large open source projects operate, Mozilla, Debian, Gentoo, GNOME, KDE, LibreOffice, etc. They're all a bit like big companies, but without a VPN, where everything is Internet accessible.
We don't use any internal application that's not web-based, does anyone else do that?
Re:Wow (Score:5, Interesting)
I don't think you can compare it to a physical situation.
If you had secure operating systems, and encrypted data flows, and weren't listening on a bazillion ports, it would be just as easy to secure the network by securing individual computers as it would to secure the perimeter.
The problem is security is a bolted on afterthought for some operating systems (Windows), printers, storage devices, and software applications.
If we could get past that, we could stop building walls.
Re:Wow (Score:4, Interesting)
I'm no expert in the field, but my understanding is that there are several models of network security based on real-world notions of security.
VPN is a part of your traditional wall security, where your typical authentication and authorization happens at each level of security zone. Once you're in, you can do anything the zone permits you to do. VPN is, as stated by others, placed at the perimeter.
BTW, full internal company-wide encryption just means putting the secure zones under a roof so no one flying overhead can see what's going on from above (e.g. big brother).
Another model of security relies on negative feedback. There are no locks anywhere, and no one has keys, but missteps have consequences. That's the security model most modern governments employ against their citizens. The levels of surveillance, strictness of the deeds, and harshness of the punishment determine the repressiveness of the model. The level of security is proportional to the amount of monitoring (a place like prison being maximum security).
There are other models, I'm certain, but like I said, I'm no expert. These are the two more prevalent ones out there right now.
Zero trust is completely different. It's almost like a double-blind experiment. There's no trust anywhere. Not the users/developers, not the administrators, not the auditors, not anyone. Authentication is fundamentally a trust-building mechanism, and a zero-trust model means authentication is obsolete (remember, encryption is merely erecting a roof over everything). Anyone can get in and do all the same things. The only difference is in the domain knowledge of the actors, which differenciates those able to do more things from less things if anything at all.
A rather dirty analogy of zero trust would be hosting an open project on Github. Anyone can go in and make modifications, but only those who know the code could make modifications that do meaningful work. And then, of the people building the code and running it, only those who who possess the ability to verify the modifications would know that they're not harmful specifically for their use cases.
Another analogy of zero trust would be to have an open e-mail account. There's no guarantees the sender is represented by the name. Every e-mail is assumed to have been read by anyone capable of entering the system. (Changing or deleting e-mails can be universally prohibited.) Such an account would be mostly useful for communications of metadata information, i.e. where and when to meet, and trivial matters.
I don't think Google's gone quite that far with their security model. They may have gotten rid of the VPN (or not...), but there are still SSH keys used for authentication and authorization, and users still need to log in to their machine to use it. After all, zero trust implies that even we the ultimate end users can't trust what's coming out of Google to be accurate (assuming that we could before--that's another debate for another time). And I don't think Google wants to make that impression.
It may be that they started with a zero-trust model, and identified the areas where trust is unnecessary, which they left insecure. At the same time, they also identified where trust is absolutely necessary, as well as the level of trust that's appropriate, and put up the necessary strength of walls to secure them, as well as levels of monitoring to see who's entering different zones. That sounds far more reasonable to me, especially considering the amount of trade and other secrets Google is holding onto.