Slashdot Mirror
Google's Plan To Kill the Corporate Network
mask.of.sanity writes "Google has revealed details on its Beyond Corp project to scrap the notion of a corporate network and move to a zero-trust model. The company perhaps unsurprisingly considers the traditional notion of perimeter defense and its respective gadgetry as a dead duck, and has moved to authenticate and authorize its 42,000 staff so they can access Google HQ from anywhere (video). Google also revealed it was perhaps the biggest Apple shop in the world, with 43,000 devices deployed and staff only allowed to use Windows with a supporting business case."
My dog eats its own poop.
Not a ringing endorsement for the dog food metaphor.
John
Goobuntu runs on Macs just fine.
The rj45 jacks in the office are just plain old dirty connections to the Inet. We each have multiple OpenVPN connections on our localhost giving us access to different parts of the network depending on our roles. It's convenient because our workstations work identically wherever we are ( home, work, coffee shop ) and it's convenient when someone leaves because operations just invalidates the VPN certs and the former employee is cut off no matter where they physically are. A side effect is whenever your VPN credentials don't work you're left wondering is you're about to get fired and ops just jumped the gun haha.
I came to the datacenter drunk with a fake ID, don't you want to be just like me?
Both of my daughters have work issued Macs. One is in education and the other a tech company. When you look at the cost of a computer compared to the salary (and benefits) for an employee over the life of the computer, the cost of even an "expensive" computer is a small rounding error. In addition, the cost of protecting and cleaning up Windows computers is non-trivial and the cost of a data breach can be enormous.
This is not just a VPN, it is a VPN from a known, verified secure computer.
? MS Access... what a joke.
I don't read your sig. Why are you reading mine?
From a security perspective, Google is right about the notion that your internal corporate network being "safe" is dead. Between all the laptops, tablets, smartphones and very portable USB devices, there really isn't a secure perimeter on your network. Security needs to be applied at each entry point to the network, whether that is wired (internal or external doesn't matter), wireless or virtual.
The summary implied that the need for security devices goes away once you give up the idea of a perimeter, but that isn't the case at all. The form that security comes in may change, but you still need it. Authenticated users connecting via secure tunnels doesn't eliminate the risk of malware, so you still need IPS and anti-malware devices (Fidelis, FireEye, etc.) to keep your protect company assets from valid authenticated users.
If you can't trust any of the devices on your network, then you need to inspect 100% of the traffic entering the network.
Interestingly, the company I work for is also like that. In our office, the "network" is just a regular consumer grade router (plus an expensive cisco AP). But we don't use VPNs (VPNs suck), all of our services are Internet accessible and protected independantly. So web-stuff is SSL + http authentication, email is IMAP, calendar is caldav. source code is ssh+git, etc. We have an internal SIP service (but that's also Internet connected).
Also, look at how large open source projects operate, Mozilla, Debian, Gentoo, GNOME, KDE, LibreOffice, etc. They're all a bit like big companies, but without a VPN, where everything is Internet accessible.
We don't use any internal application that's not web-based, does anyone else do that?
I'll answer as best as I can
> Please tell us more about your setup.
We're a Java office in TX with a remote call center in OR and a handful of remote employees ( Chicago ).
> What type of work does the company and you do?
I'm the director of development, we're a j2ee web application development shop with special expertise in Oracle
> Approximately how many users work like this?
All of us ~30
> Does this company operate primarily as a standard physical office environment, or is this a distributed(work from home) startup?
A couple of my developers work from home 3 days a week and most of ops ( the network guys ) work from wherever and, apparently, whenever they want. They're pretty hot shit, published authors, speakers at LISA, etc so they're left alone most of the time.
> Where are the servers, on-site, datacenter, cloud?
We keep our staging and UAT servers on site and colo for production + another colo for failover
> Approximately how many servers?
I have no idea, I know we have some serious SAN gear for the databases. We probably have around 50 virtual servers in our testing setup and maybe 20-25 production server clusters with an average of 3 nodes each. Some physical some virtual.
> What type of applications are used, web, small applications like QB, MS Exchange or SQL systems?
Web applications, we develop/maintain some very large rewards and loyalty programs for the big banks. RDBMS is Oracle, email and IM is handled through Zimbra, project management is handled with Atlassen Jira self hosted.
> What are the negative aspects of this system?
The only problem i've ever faced is the VPN endpoints not staying connected. VPN connectivity becomes mission critical because without it no work can get done. I don't know what they're using for the VPN server, I know ops is a big fan of OpenBSD so it wouldn't surprise me if that's what they are using.
I came to the datacenter drunk with a fake ID, don't you want to be just like me?
What they're saying is that the idea of border security is a bad model. One compromised system on the inside and you're pretty much done. IDS and DPI are good ideas but they aren't effective enough. Breaking in to any corporate network is as easy as spamming it's users with social-engineering-laden email. Get them to click on a link and you own their soft, squishy, zero-day-vulnerable desktops. Keylog and steal their credentials and you've got a jumping off point to worm in to the rest of their network. It's that easy.
What they're saying is once you move to a trust-nothing model.. Why bother investing in a huge corp network when you can't trust it anyway? When you don't have big corp network what's, the advantages of running your own services over purchasing them from someone else? Like Google?
But it's not a bad idea, it's just dumb to rely solely on it.
I can just imagine the military "Fuck the perimeter, if the enemy gets inside the base it's going to be all knives and hand to hand combat anyway. Sell the guns boys, we're all getting HUGE KNIVES!"
Mod me down, my New Earth Global Warmingist friends!
As the senior admin for such an outsourced network, I can tell you what will happen about 2 to 3 years after you migrate to an outsourced service like this.
"We're deprecating the ODBC connection as of January 1... no worries we've got a great new API and it accepts SQL!"
"To reduce system load and improve overall performance of your system we're limiting SQL requests to 100k rows"
"To enhance SLQ efficiency we've written our own proprietary query language called FU-SQL it's fantastic"
"We're aware that some of our customers are not happy with speed of FU-SQL so we've limited the number of joins you can make in a select statement to 1"
"To reduce costs for our customers we now bill our FU-SQL module separately, if you don't use it you don't have to pay for it! If you would like the unneeded additional FU-SQL feature it will bill for $150k/year"
"due to lack of interest FU-SQL has been discontinued, if you need mass access to your data please contact our professional service"
At this point they start doubling the price of their service every time you sign a new contract. Then your boss will ask you why your quote for migrating the network somewhere else was "A Metric Shitton of money"
Have fun with your outsourced network!