Google restricting internet access to some employees for security

https://www.cnbc.com/2023/07/18/google-restricting-internet-access-to-some-employees-for-security.html

by kjhughes • 3 years ago

131 131 3 years ago

dfee• 3 years ago

No thank you.

yeputons• 3 years ago

In addition, some employees will have no root access, meaning they won’t be able to run administrative commands or do things like install software.

Did they _ever_ had root access in the last, I don't know, ten years?

t90fan• 3 years ago

probably?

Every tech company I've ever worked at, normal devs have had administrator access on their own Mac or Linux workstations, its only usually the sales/product folks who have locked down Windows machines.

And most SRE folks have sudo access on production VMs too

incomplete2• 3 years ago

fwiw i think the article is talking about root on their lap/desktop machines, not production.

and regarding production, pure root access was revoked for everyone YEARS ago and replaced w/user and admin role accounts. admin was severely restricted, and could do most (but not all) things that root could do. this was for a server only, not accessing anything in borg/omega.

also, if a rando package was installed on a prod server there are safeguards in place that would detect a change and wipe it immediately. in my time that was called the 'assimilator'.

i'm sure that a very, very select few have actual root/sudo.

(disclaimer: i worked there 03-11, the role accounts were rolled out in 08 or 09 IIRC. things could be different now, and if so probably even more restrictive)

MattGaiser• 3 years ago

Even in every non-technical company I have known, except one, has allowed its devs root access on their own machines. I have never needed someone else's password to install software or run Sudo on a work machine.

bitwize2• 3 years ago

Well, lucky you.

In the real world, endpoint security is very much a thing, and that means workstations so locked down, you can't even change the screensaver, let alone install unauthorized software.

If you work in health, for all intents and purposes you must be HITRUST compliant, and that basically mandates all sorts of lockdowns and network restrictions. ANYTHING that touches PHI must be airgapped.

lokar• 3 years ago

Engineers always had root on their desktop and laptops.

pierat4• 3 years ago

Most companies don't permit Linux as a desktop.

In most orgs, you'll see Windows and the sysadmins and devs will have LOCAL\administrator, but not LOCAL\SYSTEM. That's usually because developing software(debuggers) or using sysadmin tools is a admin-only thing.

As for me, I do prefer Linux on the desktop proper, with appropriate sudo access for root access. But again, I also do want SELinux on as enforcing, and fapolicyd enabled with good setup. If it's a laptop, I definitely want clevis and tang for enforcing attested and encrypted drives. If my shit is stolen, I dont want to be the vector where everything is stolen.

hgsgm2• 3 years ago

But so does Puppet, so it's endless trench warfare.

kevingadd• 3 years ago

Yes.

nova22033• 3 years ago

Google is enlisting employees for a pilot program to work without internet access.

it's a pilot program..

inoffensivename• 3 years ago

These things have a habit of turning into policies. The data will be interpreted to agree with whatever outcome the enactors want.

tekla• 3 years ago

Examples from Google?

Forge36• 3 years ago

If I had two computers I'd consider this. I'd probably want a KVM to swap the keyboard and mouse

skybrian• 3 years ago

You'd still have your phone, I presume? "No internet access" isn't what it used to be.

TillE• 3 years ago

A phone is fine for brief communication, but awful for eg, searching/reading documentation.

backtoyoujim• 3 years ago

Ah the ol' 'no internet access but internet access' type of no internet access.

galkk4• 3 years ago

Usually disposable vm is enough, like windows sandbox.

Googlers by default, though, aren’t allowed to run vms (VMware/virtualbox style) on their desktops/workstations.

xnx• 3 years ago

I thought most Googler's main machine was virtual. Maybe not for developers? https://cloud.google.com/blog/topics/developers-practitioner...

kobalsky• 3 years ago

that's really interesting. is there any public document or manual describing their workstations and policies? like the SRE manual

Maxious• 3 years ago

It's now considered safe enough to use something like a Linux/Xen hypervisor to access multiple security domains https://en.wikipedia.org/wiki/Multiple_Independent_Levels_of... eg. https://www.ainfosec.com/wp-content/uploads/2015/09/AIS-Secu... https://www.ainfosec.com/wp-content/uploads/2015/09/SecureVi...

amf12• 3 years ago

Every Software role employee at Google has two computers, a laptop and a cloudtop. I have no idea what this pilot is about but I suspect it affects the instance you ssh into and not the laptop, which is perfectly acceptable. The VM does not require "internet" access for the work done.

oneplane• 3 years ago

This is not a strange hardening technique at all. You'd obviously weigh the friction vs. added security, but at Google scale you'd probably be engineering on Google sources using Google tools on Google systems anyway, it's not like you're sitting around installing a random binary from reddit on your google server and calling it a day.

Perhaps a follow-up program ends up with a Qubes-like configuration, or just separate systems.

rodgerd• 3 years ago

This is not a strange hardening technique at all.

On the one hand, I agree. SWIFT recommend (in a similar vein) that machines that you do SWIFT tasks with are segregated from your daily driver last time I read the SWIFT standards; Microsoft recommend locked-down, no-access machines for a lot of AD admin tasks. If you do work in "I can tank a bank" roles, this will sound familiar.

On the other hand, this will also lead to cargo-cult "but Google programmers don't need Internet access, why do you?"

On the gripping hand, perhaps a bunch of Google people being restricted this way will lead to an resurgence in development and documentation practises that don't assume that you can download crap from the Internet all the time. That would be nice.

dietr1ch• 3 years ago

TBH, I doubt benefits really go outside, "no internet" at $BIGCORP's intranet is not the same as no internet at home.

There's internal sites for searching, documentation, code, forums, newsletters, Questions/Answers, chat, calendar, video conferencing, browsing memes, looking at cat pictures and probably more.

patrakov• 3 years ago

On the other hand, this will also lead to cargo-cult "but Google programmers don't need Internet access, why do you?"

Just a random thought: this coincides with the rollout of Bard. Perhaps the idea is that Bard (or its internal equivalent) is a suitable replacement for sites like StackOverflow?

kccqzy3• 3 years ago

On the other hand, this will also lead to cargo-cult "but Google programmers don't need Internet access, why do you?"

To which the obvious reply is, Google already has the whole Internet cached and indexed. If they need to Google something they are only accessing the intranet.

pierat4• 3 years ago

Google is running the program to reduce the risk of cyberattacks, according to internal materials. “Googlers are frequent targets of attacks,” one internal description viewed by CNBC stated.

Fair. The higher the profile you have, the worse and the more numerous the attacks.

I found after creating a LinkedIn account, attacks went up on my account 12x. Again, caveat emptor... but this makes a great deal of sense in who to target. When you willingly put "I am Gee Golly Whillikers, Sr Systems Engineer of Really Important Systems that 10m people use", well... you're self-selecting who to hit.

The company has also in recent months been striving harder to contain leaks.

Wait WHAT? That's what we cybersec folks call an "Insider Threat". "Leaks" are done by insider employees wishing to harm the org they work for, up to leaking classified data, or secret corporate data.

This is a WHOLE DIFFERENT REALM of attacks, and relevant appropriate defense. And this is how you get SCIF's https://en.wikipedia.org/wiki/Sensitive_compartmented_inform...

chayesfss• 3 years ago

Ha, was a principle for a company for years, the never ending attacks were horrible.

nneonneo• 3 years ago

Leaks also happen accidentally, e.g. by employees copy-pasting sensitive data or code into ChatGPT or using Copilot. Although that may not result in a breach, it certainly opens up legal and IP concerns for Google.

jhugo• 3 years ago

I’m not sure those examples should be referred to as “accidents”. If you deliberately give the information to an external company, you leaked it deliberately, even if you thought they wouldn’t do anything bad with it.

tommiegannert• 3 years ago

Or leaving an unreleased iPhone in a bar...

gumby• 3 years ago

Leak need not be an insider threat. Install a Trojan or keylogger on an employee’s machine remotely and then exfiltrate data yourself.

function_seven• 3 years ago

That’s not normally referred to as a “leak” though. That’s just “hackers broke into Acme Corp., stole trade secrets”

macNchz• 3 years ago

I found after creating a LinkedIn account, attacks went up on my account 12x.

I'm curious to know more about what you're doing to quantify this as an individual–I think I have a fairly sophisticated personal security posture and have implemented various business infosec measures professionally, but I'm not sure I have a great way of measuring how many attacks are targeted at me day to day, beyond a sort of vague sense of "this month I'm noticing more {frequent|targeted|sophisticated} attention".

water9• 3 years ago

Previously, he had zero now he has one and so he rounded from infinity. Otherwise he did exactly what he’s making fun of I his post.

balls1872• 3 years ago

If I were someone of note who was concerned about increasing likelihood of attacks targeting me, I wouldn’t answer that question, doubly so if I was security conscious.

pierat4• 3 years ago

In my case, my estimation is a simple count.

Prior to using my email, I was getting 2 targeted attacks per week to my email.

After making an acct on LinkedIn with resume, was seeing 25-30 attacks per week.

I didn't make any attempt to determine the classification of attack, or its complexity. It was a simple dumb count.

dhosek• 3 years ago

Most of the attempts that I had were flagged as spam so I didn’t notice.

The one that almost caught me was a simple email allegedly from the CEO asking if I had a minute. I was working at a small enough company that it wouldn’t be out of the question for the CEO to email me and I replied, sure.

The next email was, fortunately, a clumsy attempt at fraud, asking me to buy some Xbox gift cards for a client, which made me look a little closer and notice that the email address hidden by the email client behind the CEO’s name was at a Russian ISP, so I dumped them into spam and posted a warning on Slack. Something less clumsily targeted might have caught someone (e.g., to do a test booking on our site, or open some tech window). That said, LinkedIn is useful enough to me that I’m willing to leave that window open, although it would be nice if company email addresses were less easily guessed.

gizmo6862• 3 years ago

Definitions might very by organization. The training I have received defined both "insider threat" and "leak" to include accidental disclosures by insiders as well.

Incidentally, accidental disclosures are the main thing SCIFs are designed to prevent. Deliberately taking classified data out of a SCIF is not particularly difficult (although it is harder to plead accident if you are caught, which acts as a dissinsentive).

bluepod42• 3 years ago

"Leaks" are done by insider employees wishing to harm the org they work for

This isn’t always the main motivation, and in my experience this isn’t even usually the main motivation.

(But if I’m wrong, please tell me. Don’t downvote me for my opinion/life experience. I have definitely seen the whole “f the company” scenario a number of times. But usually it’s “f a particular person” or it’s a “this violates my principles” kind of thing. Companies are legally entities but not that much psychologically, in my opinion.)

bluepod42• 3 years ago

Re: “But usually…”

It’s a “oops, I’m drunk or forgetful and said or did more than I should have” lol.

I forgot to add that one.

Companies are legally entities but not that much psychologically.

This is my own statement that I can’t edit. I understand that many people think otherwise depending on the context. I do also. In this particular context of “insider threat” (i.e. employee leaks), I still believe the main cause isn’t to “harm a company”.

hazmazlaz• 3 years ago

Totally agreed. Also, now I am going to start using that phrase mashed up with an Archer reference when discussing security controls - "Do you want SCIFs? Because that's how you get SCIF's." LOL.

masto• 3 years ago

Misleading and/or misunderstood.

smfjaw• 3 years ago

pretty common thing, I work in investment banking and it's not uncommon to have no internet access as a dev, not common but not uncommon

hgsgm2• 3 years ago

No one with technical knowledge contributed to this report.

cglong2• 3 years ago

I remember, during my internship at Microsoft, one of the "perks" everyone loved was being given a beefy machine that we were admins on and an absurdly fast internet connection to go with it. While I do get the security argument, this also seems like yet another signal that Google is tightening their infamous perks.

kccqzy3• 3 years ago

Google also gives (gave?) employees root access on the work machines (https://news.ycombinator.com/item?id=32307102) and an incredibly fast internet connection. As a non-employee, you only need to walk into the lobby, sit on a couch meant for visitors, connect to the unsecured GoogleGuest Wi-Fi network and enjoy that absurd speed. I live very close to Google offices and I occasionally bring my laptop there since my home internet has terrible upload speeds.

footlose_3815• 3 years ago

Xoogler here. You have to get permission to get root access and it's only temporary.

bagacrap2• 3 years ago

I don't think they're doing this to save money on Comcast bills

cglong2• 3 years ago

I don't mean to say it's about cost savings; I meant that they're choosing the most expedient approach to this problem at the expense of employee happiness.

freedude• 3 years ago

No, but they might be doing it to save on incident response, time wasting, protect IP, and meet a certain security standard in the future.

cebert• 3 years ago

I know it’d be incredibly painful initially, but I’m surprised more firms don’t adopt a policy where they only accept traffic to an approved accept list of IPs/domains instead of permitting traffic unless explicitly denied. With an interface that allows employees to request allowances, this seems like a great added layer of security.

balls1872• 3 years ago

Back in my day with TS clearance working in certain airframes there was no internet access. Also no personal electronics allowed inside the secure area except for a portable cd player, and a single audio disc (had to be pressed).

thefurdrake2• 3 years ago

Yeah, this sounds a lot like Google wants to create SIPRnet and SCIFs, restricting external access like that. Probably wise, considering how tasty a target Google is.

gizmo6862• 3 years ago

My employer does a similar thing for people working on particularly sensitive projects. Those employees are given a second laptop to use for internet.

dmoy• 3 years ago

I was never allowed in, but at a previous employer we had a scif onsite that had no internet in that room, and nothing was allowed out (except by a very painful process involving a briefcase, handcuffs, multiple people, etc).

Needless to say none of the computers in the scif has internet. Keeping them updated was surprisingly simple - we could bring updates in, we just had an increasing stack of USB drives and hdds that never left lol.

grishka• 3 years ago

except by a very painful process involving a briefcase, handcuffs, multiple people, etc

What the handcuffs were for?

acomjean• 3 years ago

I worked in a place that had separate networks. The one with internet didn’t have our projects on it. It was kinda a pain to not have internet to look stuff up, but it was ada or c++ and we had books…

10g1k• 3 years ago

Isolated syetems are very common. I don't know how this even made it into news.

jeffbee• 3 years ago

What goes around? When I joined that company many years ago, people with production access had a completely separate computer for that purpose.

chevman• 3 years ago

Suprised they don't already do this.

In BigCo land there are multiple attack vectors to the top execs.

I was literally in a convo today where our CFO and his EA are now virtually unreachable due to this type of stuff. Our IT team gave everyone burner phones above a certain grade level.

Strange days!

zeroCalories2• 3 years ago

A company like Google provides critical infrastructure for the internet. They're full of very smart people, but they have had some very sloppy goofs over the years. I'm glad that they're trying to be more dependable.

housemusicfan• 3 years ago

They're full of very smart people, but they have had some very sloppy goofs over the years.

That's because smart people tend to overestimate their abilities and think they are invincible. In fact the comment posted just below this one is jumping to conclusions that this probably only applies to the inferior-intellect mechanical and electrical engineers.

zeroCalories2• 3 years ago

I don't know if they're really overestimating their abilities. When I see things go wrong, most of the time people knew it was a possibilty, but it got deprioritized and forgotten about. Process helps avoid that and guardrails protect you when an unavoidable error does happen.

sonicshadow• 3 years ago

Probably not for software engineers, just non tech savvy folks like the mechanical and electrical engineers.

saagarjha6• 3 years ago

Software engineers.

thefurdrake2• 3 years ago

Having worked a job reviewing the coding habits and behaviors of software engineers for a year and a half, I'm gonna just go ahead and say you're wrong, it's probably especially for the software engineers.

mardifoufs2• 3 years ago

Stupid question: I thought google was well known for its zero trust security model, is it completely unrelated? I read the article, but it doesn't mention beyondcorp at all. And if it applies at all, what threats are not well covered by zero trust security that would require this? I think I misunderstood a concept (or two lol), since I thought an employee's device was basically "untrusted" by default in google's case. And there wasn't really a lot to gain by simply targeting an employee's device ?

kccqzy3• 3 years ago

I have a feeling* that this is another case where Google's internal politics and promo culture rears its ugly head. I don't think the team behind this effort talks to the team responsible for BeyondCorp. Or maybe they do, but the person who came up with this idea wants a promotion so much that they decide to ignore BeyondCorp with some half-heartedly written doc.

*: Just a feeling. I have no proof. Just speculating. Take it with a huge grain of salt.

advisedwang2• 3 years ago

Beyondcorp is not used for access to non Google sites (and even if it was, it could be a WAF but not much more).

As for how beyondcorp protects if a employee workstation does get owned: the zero trust means simply being within a network permimeter does not grant access... But employee workstations are trusted to do whatever that employee is authorized to do. So beyondcorp massively reduces what an attacker can do and adds lots of hurdles (e.g. requiring pressing a security key, pervasive monitoring), but doesn't render a hacked employee workstation harmless

mardifoufs2• 3 years ago

Ahhh that makes a lot of sense!! Thank you! I guess it is inevitable that an attacker could have access to something, no matter how constrained and limited it is, as long as they can get an employee to authenticate even if it is for a single action.

It still sounds miles better than the traditional IT hell that is trying to constrain the devices as much as possible instead of securing the network and implementing auth internally.

UncleMeat4• 3 years ago

Security is an onion. It has layers. You can be motivated to prevent people from running "curl | sh" because a phishing email told them to even if internal systems run their own authentication and authorization.

lgleason• 3 years ago

I had to work in an environment like that. It sucked. Then there were the corporate internets the blocked certain sites to prevent employees from surfing the internet too much. Those were annoying as well. Did they really add any security, tough to say because those places I mentioned also didn't tend to hire and retain the best and the brightest. Most of those types of people wanted more autonomy.

cat_plus_plus• 3 years ago

So process/VM isolation is not even worth trying anymore? Ideally your web browser can access Internet but only Download directory on your filesystem and you can span VMs that can access particular memory ranges / disk sector ranges / devices. This is very useful for reading online manuals or for developing new Linux apps / device drivers. I am not sure what is proposed alternative is or how its going to be more secure in practice. If side channels are really hopeless, have browser transparently run on another physical machine and tunnel display to your workstation.

yxre• 3 years ago

I don't think its possible for any platform that allows for arbitrary code execution to be completely safe. The exploits of today are far more sophisticated than they needed to be 20 years ago, but they still exists and are harder to find and fix.

reportgunner• 3 years ago

The company will disable internet access on the select desktops, with the exception of internal web-based tools and Google-owned websites like Google Drive and Gmail

What they are doing is called a "firewall", we have been doing that for a few decades now.

I even use a firewall at home !

nunez• 3 years ago

Lovely to see Google reinventing and decentralizing air-gapped networks. :-)

andy89• 3 years ago

Google's move to restrict internet access for some employees shows the company takes security seriously. It's a proactive step to safeguard sensitive information, but striking a balance between security and productivity will be crucial.

Google restricting internet access to some employees for security

Related Stories