Google Moves Its Corporate Applications to the Internet

http://blogs.wsj.com/cio/2015/05/11/google-moves-its-corporate-applications-to-the-internet/

by kjhughes • 11 years ago

283 145 11 years ago

blogs.wsj.com

Splendor2• 11 years ago

I'm not a security expert by any means, but this seems like an intelligent move to me. And it sounds like this process of accessing corporate applications has the potential to be less onerous for employees.

atlbeer• 11 years ago

The probably falls in the general category of a Good Thing™ for employees and people developing B2B applications since internal systems are more easily accessible but, this will be a gut check/squeaky bum time for traditional on-premises B2B vendors like PeopleSoft/SAP/IBM and the like. The corporate firewall has always been a bastion of security they have been able to hide their applications behind. As the concept of a corporate firewall begins to fade their security risk increases and previously non-worrisome attack vectors become serious problems for them.

JTon• 11 years ago

Apologies for being off topic..

squeaky bum time

Never heard this expression before. Quick search defines it as "An exciting part of a sporting event, particularly the final minutes of a close game or season". Unfortunately, I still don't really get the reference. Could someone spell this out for me?

IvyMike• 11 years ago

Squirming in your seat.

http://www.phrases.org.uk/meanings/squeaky-bum-time.html

pluma3• 11 years ago

Make people nervous.

rmac• 11 years ago

Insecure enterprise software and poor security practices mean death to firewalls and to vpns will take a long, long time. People hide behind these things for a reason.

Google is right here though, this makes things easier for employees and probably saves them money (no vpn); unfortunately most orgs don't have the staff/expertise to pull something like this off.

More importantly though, I think google builds all their enterprise web apps in-house (speculating). Most orgs who do have intranet apps use 3rd party off the shelf software so pulling off Google's BeyondCorp architecture is less likely as they can't control or easily modify how they work. Ergo, VPNs are here to stay.

Even for those orgs who write their own internal applications: do you really want to expose your internal analytics dashboard to the internet?! GASP.

mikecb2• 11 years ago

Finally, the zero trust network has its day. I've been following this for quite a while, especially since this kind of architecture makes even more sense for smaller businesses than large ones that can pay for sophisticated network-edge protection.

Edit: Great talk at lisa in 2013: https://www.usenix.org/conference/lisa13/enterprise-architec...

omnibrain• 11 years ago

Yes, I submitted this yesterday (instead of the article submitted here, because I found it to be deeper and did not want to submit 2 links at the same time), but sadly it failed to gain traction.

higherpurpose• 11 years ago

Videos don't usually gain traction on HN.

rconti• 11 years ago

OTOH, Google is way too big to be able to trust all of their users. And this just happens to be excellent advertising for them.

jldugger• 11 years ago

On what planet was that talk "great?"

evmar2• 11 years ago

What's left implied but unstated in this post is that a corporate intranet is often in practice as vulnerable as the internet -- from unpatched Windows to old Android versions to people plugging in random USB dongles to a million variations on XSS/XSRF, once you've made your corporate network secure against these attackers it's also secure against the wider internet.

Splendor2• 11 years ago

I felt like that was stated clearly in the second paragraph.

"The new model — called the BeyondCorp initiative — assumes that the internal network is as dangerous as the Internet."

evmar2• 11 years ago

You are right. I had meant they left out why the internal network is dangerous. They open with assuming it is dangerous and then discuss how to implement it.

rifung• 11 years ago

I hope this means accessing internal resources will be a lot less painful too

furyg3• 11 years ago

We tried this where I worked (with the exception of the evil desktop app financial program)... and had to retract after a zero day defacement in one of our web apps. In the meantime we also learned that keeping all of your web apps 100% up to date at all times is really freaking difficult. The good news is that the (failed) attempt got us off of a few client side applications and made us much more platform agnostic than we were before.

If you have the resources of Google it's a bit different, especially if all of the software is custom and developed internally.

tedchs• 11 years ago

You can't succeed with this model by just setting your firewall to allow 0.0.0.0/0. This approach still requires defense in depth, and a holistic view of security. If someone was able to deface your web app, then your company wasn't actually using all the components that are required to make this model work (such as authenticated devices, device patch management, and user 2-factor authentication).

giovannibajo12• 11 years ago

What are "authenticated devices"? The closest I can think of are client certificates being installed on the devices and used as a first-level of authentication. It could be anything from TLS client certificates to VPN certificates.

philipw• 11 years ago

Device patch management only works when there are patches available, ever heard of a 0day?

tootie• 11 years ago

Was this a custom app? My company puts most of our stuff on the internet, but most of it is stuff we've bought from Atlassian and the like.

istvan__3• 11 years ago

The only way to succeed with this is with heavy firewalling or VPNs. There are several unknown zero days in any application so just by opening up your application to 0.0.0.0/0 makes it possible for blackhats to get in. The only question is how much your information is worth for somebody. If you it is less than price of a brand new zero day you might be ok, but there are still the script kiddies and political blackhat organizations who mass deface any site that has a "zero day" vuln, (zero day means in this case: unknown to the operators of the site).

tracker12• 11 years ago

There are different layers of firewall, and VPN isn't really the issue here.

You can still have location-aware servers that can talk to eachother directly. This should be done over an encrypted channel as much as possible.

As to firewalls, on each server only allowing access from those ports applications run on is probably a good start. Better still would be publicly facing machines that act as reverse-proxies to backing servers that run said applications.

As intimated only approved machines (likely with client certificates and pinning to mac addresses, and probably only a limited number of accounts beyond that) can tighten things farther.

Putting your exposed (internal use) applications facing the internet doesn't mean unlocking all the doors. There are ways to mitigate and reduce the effects of a 0-day vulnerability in practice. The fact is that by making it all available anywhere, makes you think of the risks in a way that is actually better in practice than just believing because you are behind a hard shell it isn't easy enough to get to the soft-gooey center.

A hardened system involves more than firewalls and vpn access. A properly hardened system should be able to run over the internet. TLS channels with certificate/mac pinning alone can go a long way in terms of communications, and is far more than a typical firewall/vpn setup would offer for protection. This goes from SSH to your internal services. For that matter not exposing anything beyond SSH, and requiring tunnels for all communications may be simpler still.

Mix in LDAP for access, with accounts, machines and certificates all tied together and you have a pretty good base recipe for a hardenned system. That said, this isn't the only approach, just me rambling on about the ideas. There is overhead in terms of development, operations and management to setup such a system. Not everyone can implement such a system, given what they may be starting from. A smaller company would have an easier time for many cases than a larger company. It may require the use of a windows terminal server behind a secured channel in order to keep some critical applications (likely wrt finance). Other applications may be excessively costly to migrate, and others still may not have the necessary protections.

Given that most internal applications are web based these days it is slightly easier than at any other time in computing history.

rixed• 11 years ago

There are several unknown zero days in any application

I think you want all your applications to authenticate the device and the user before proceeding to anything. This looks indeed impossible with third party closed source apps (if only because you can never be sure there is no backdoor).

Then, even if you authenticate every remote peers using TLS client certificates, you have to follow closely the vulnerabilities of your TLS implementation... But that should not be less manageable than to make sure your firewalls are reliable.

ceejayoz• 11 years ago

There are several unknown zero days in any application

Does this include the firewall and VPN?

jreed91• 11 years ago

The access proxy is somewhat similar to what Cisco is doing with TrustSec. http://www.cisco.com/c/en/us/solutions/enterprise-networks/t...

jingo• 11 years ago

I wonder which "cloud hosting provider" they will choose.

Microsoft? Amazon?

Does it make a difference?

If my company starts selling cloud hosting and then I announce my company will be hosting its internal applications in "the cloud" (i.e., in my own data centers), what are the security implications for my company?

Are they the same if some other company asks me to host their applications in my data centers?

Is this article a PR piece (or "submarine" as PG calls it)?

What do you think?

taylorwc• 11 years ago

I wonder which "cloud hosting provider" they will choose.

Meant to be sarcastic? Google is in this market. Doesn't strike me that there is any chance they'd use MSFT or Amazon for infrastructure.

stephengillie4• 11 years ago

In a way, it seems similar to what Amazon did when they launched AWS.

dzhiurgis6• 11 years ago

They used Salesforce before for something (probably Adwords). Could be expanding.

passive6• 11 years ago

As a remote worker, it's delightful to see things move in this direction, as VPNs are a regular thorn in my side.

Of course, there's a certain irony that Google isn't fond of remote workers. :)

munificent• 11 years ago

Google doesn't like workers who always work remotely, but periodically working from home (or the bus, or hotel, or coffeeshop, or the lobby at the auto mechanic, etc.) for a day is common for all employees.

passive6• 11 years ago

Fair enough, but that still limits potential employees to a certain physical proximity to Google offices. While there are a number of those, and I aim to bring one here eventually, it is still a limitation.

praneshp• 11 years ago

That is the same policy that my $BIG_INTERNET_CORP_WITH_FEMALE_CEO copped a lot of flak for because of the news being mis-reported by the media.

stephengillie4• 11 years ago

Few workplaces are fond of remote workers. The major reason a lot of people remain employed is so they have a purpose to wake up, leave their houses, and spend the day occupied by the relative comfort of an office building, surrounded by reasonably-intelligent coworkers, as a faux-family. And it's a slap in their face that you don't want to spend your time basking in their physical proximity.

passive6• 11 years ago

I think you are mostly right here, sadly enough.

wahsd2• 11 years ago

Interesting way of putting that perspective. I have been trying to put my finger on the whole remote working issue for a while. What you expressed is one aspect to the issue, but I also think that it is probably just an intermediary symptom, a phantom / false cause if you will. Personally I think we would see a lot more remote working and even a social revolution if at very least the incentives for physical office space were removed from tax and accounting policy. Remote working is really a difficult nut to crack that has a significant cleft between it's potential and present reality.

I guarantee that the company that can scale up effective remote working that has severed the tether to co-located organizational structure will be wildly successful. Unfortunately, I think it will also have major social repercussions similar to the impact that autonomous transportation has the potential for causing.

mahyarm3• 11 years ago

Communication and management overhead of remote workers is harder to do right. Like functional programming.

bduerst5• 11 years ago

it's a slap in their face that you don't want to spend your time basking in their physical proximity

That's slightly self-centered. Nobody cares about you or their co-workers so much that they are offended if you don't want to work (or bask) in the team's presence.

People are tribal by nature, and one of the ways humans feel a sense of belonging is through overcoming common conflict (i.e. Tuckman's stages). While not impossible, it's much harder to have common conflicts if you're just not there.

eloisant• 11 years ago

You can wake up, leave your house and go to a confortable office building surrounded by people working in the same industry by going to a coworking space.

As a remote worker I actually want to have this routine, meet people, this is why I go to a coworking space.

The benefit of remote work is that you can have much more choice in the company you work for, without having to move to SF/NY/London/Paris/<some other crowded and overpriced area>.

stephengillie4• 11 years ago

https://i.imgur.com/3K0Zvhb.png

dm2• 11 years ago

Why are VPNs a problem for you?

It's hard to fully trust a person that is remote. Are they keeping your data safe?

Another solution is the idea of Amazons virtual workspaces for remote workers, this allows the company to have more control over the computer that the employee is using.

mahyarm3• 11 years ago

VPNs break down, are filtered out or throttled by ISPs, etc. The office internet is usually significantly more reliable.

passive6• 11 years ago

My work has required daily VPN use over most of the past 7 years, and I have yet to find one that is reliable. I'm certain this has more to do with properly setting them up then an inherent flaw in the concept, but it still means when I can avoid them, I do.

zenbowman• 11 years ago

It isn't just corporations that are not fond of remote work. As a lay-employee, I am not fond of remote work either. I would much rather have all my teammates in the same room.

Tribal? Yes, unapologetically so.

douche2• 11 years ago

Why?

zmanian• 11 years ago

Seeing the strength of google migrating all their employees to yubikeys

serve_yay• 11 years ago

It's nice to see companies moving towards taking security more seriously, but boy oh boy some of it is a real pain in the ass. Every website you log into now needs to text you, or have a companion app or whatever. Every time you lock your screen to get a cup of water or take a leak, you have to log back in, wait for your flaky vpn connection to come back before you can resume what you were doing (maybe not an issue here if they actually do away with the VPN). "Credentials" often comes down to typing very long cryptic passphrases, on a glass screen, with dots instead of being able to see what you're typing. Et cetera.

netheril96• 11 years ago

Are you on OS X and have you unchecked the option "Disconnect when switching user accounts"?

cs702• 11 years ago

I'm so happy to see this. As Bruce Schneier (who runs an open WiFi network at home) explains, "if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1]

The same is true for corporate applications (and devices like printers). If they're not secure on a public network, securing the corporate network won't reduce their risk that much: they're still exposed to potential breaches elsewhere in the corporate network.

[1] https://www.schneier.com/blog/archives/2008/01/my_open_wirel...

Afforess• 11 years ago

There are other, valid reasons to not run a public access point. Not wanting neighbors to steal your bandwidth, run a TOR node off it, or host illegal content, for example. All of these activities could get you removed from your ISP, and even taken to court. While you could probably prove your innocence in court, I can not imagine why taking the risk for absolutely no personal benefit is worth the risk. I don't really see how running an open wifi network shows anything other than ignorance of the risks.

icebraining2• 11 years ago

Do you think Schneier is ignorant of the risks?

minot• 11 years ago

This law needs to change. An Internet connection isn't a gun. Just because somebody uses my Internet connection to do something illegal, I didn't do anything illegal.

marssaxman3• 11 years ago

I am fully aware of the risks and I judge them to be negligible in practice. I've been running open wifi at home since 2002.

andrewchambers2• 11 years ago

I have seen an open router which automatically sends the clients through tor first so the activity of free guests is disassociated from your home ip address.

You can easily limit the bandwidth guests can use so it is not noticeable to you anyway.

Istof• 11 years ago

Does Bruce have his open-wifi clients connections pass through a VPN (in-between him and clients destination) ...

andrewchambers2• 11 years ago

Tor would be good, guests wouldn't appear as your own ip, instead as a tor exit node.

dzhiurgis6• 11 years ago

Private network is just another layer on top.

Google did not just throw away this layer, but replaced with device authentication. They are essentially using two factor authentication.

doctorshady• 11 years ago

For what it's worth, Bruce Schneier also has a machine air gapped from the internet. Different scenario from a huge corporate LAN or even a small network with a wireless access point to be sure, but there's a number of ways to interpret that quote.

rdl• 11 years ago

This kills BYOD, right, at least for now? "Employees can only access corporate applications with a device that is procured and actively managed by the company"

dragonwriter• 11 years ago

It seems to me that any company whose business involves providing secure web apps to external users (who aren't using devices specially trusted by the company providing the service) ought to be able to provide its corporate applications on the same basis.

mikecb2• 11 years ago

I doubt it: https://www.android.com/intl/en_us/work/

dantiberian• 11 years ago

One of the biggest reasons for BYOD is so you don't need to deal with the crappy supplied hardware of your employer and you can bring your own. I'm pretty sure that Google employees get their pick of hardware so this would remove at least one big reason for BYOD.

bduerst5• 11 years ago

Android Work Profiles has this covered, if you would want to use your own android phone.

It also means you allow your device to be managed remotely by the company (i.e. purged if lost/stolen).

tjohns• 11 years ago

It's worth reading the original "BeyondCorp" paper that discusses this:

http://static.googleusercontent.com/media/research.google.co...

As some other folks have pointed out (and contrary to what the headline implies), there's isn't just setting your firewall to allow 0.0.0.0/0. In particular, pay attention to the Device Identity (client cert) and the Access Proxy parts.

NovaS1X2• 11 years ago

"The Cloud" that they're talking about is their own datacenters (they're certianly not using EC2) and they're hosting their web-apps over a WAN without VPNs or other traditional forms of closing off access.

However, this doesn't say much about their datacenters which will still be heavily firewalled. IPMI, SSH, and other access wouldn't be shared over a wide open WAN. The "Cloud" (see: datacenter) LAN will still be protected traditionally.

This article doesn't have enough information in my opinion.

mynameisvlad2• 11 years ago

I mean, of course it's their own datacenters. They're not going to be putting their corporate data in a competitor's data center. That said, they could be leveraging new things in their Google App Engine cloud, which would actually make it "the cloud" as people refer to it.

NovaS1X2• 11 years ago

I'm glad you mentioned that. A full scale switch like this, if successful, would be great marketing ammunition and would simplify the administration of their datacenters.

No separation of their cloud hosting and internal services would greatly simplify administration at the cost of having to beef up security mentioned in the article.

ocdtrekkie2• 11 years ago

The funny thing is, they expect everyone else to put their corporate data in their datacenters! Google has an extremely one-sided view of where data should go. (In all cases, directly to their servers.)

grantlmiller• 11 years ago

This brings up a few questions: 1) Does Google not use the same publicly hosted version of Google Apps that we all use? 2) Does this only work with privately hosted versions of applications? 3) Are they using the publicly hosted version of Google Auth for the authentication piece? 4) Is the Device Inventory Database hosted on a public machine or is that deployed to a private network? 5) digging into the white paper that provides a bit more information on how they're actually doing this… does anyone care to take a crack at explaining what this means? "BeyondCorp defines and deploys an unprivileged network that very closely resembles an external network, although within a private address space. The unprivileged network only connects to the Internet, limited infrastructure services (e.g., DNS, DHCP, and NTP), and configuration management systems such as Puppet.” (full white paper published by google available here: http://static.googleusercontent.com/media/research.google.co...)

mbreese2• 11 years ago

One interesting question is: how many companies have enough public IP addresses to publish their applications to the internet? If you assume that there are multiple services and each one is hosted on their own server (or server farm), then you'd need many more public IP addresses. When we live in a world that is severely lacking free IPv4 space, how feasible is this? Or is this just a matter of pushing things from 10.0.0.0/8 land to IPv6 addresses? How many locally developed enterprise apps have good enough security to be put on a public facing site and have good IPv6 support?

I applaud the idea and the effect of forcing security to be dealt with. But I don't know how feasible it is for corporations without their own B or C blocks.

colechristensen• 11 years ago

If it's http, it doesn't matter much. You can put a thousand different sites on one (or probably a few) IP and have a load balancer distribute the requests to the appropriate set of backend servers.

mbreese2• 11 years ago

I'd like to agree, but I think you overestimate the sanity of many Enterprise IT designs...

It certainly would be helpful if there was a single point to handle the device-level authorizations, but again, many existing systems aren't necessarily designed to play well with others.

superuser23• 11 years ago

Any sane design is going to have exactly one ingress/egress for end-user traffic per application. Even an application with a few hundred servers is only going to be available to end-users at 1 IP address (maybe several for load balancing/redundancy).

It wouldn't be hard to add a global reverse-proxy/load-balancer HA cluster at the actual network edge forwarding traffic to individual applications' own load balancers.

sixdimensional• 11 years ago

I wonder how far this really extends into their network and how ipv6 is related. In principal it sounds really good to me. I realize this is mostly about access to corporate applications, but how much further could this approach go?

Thinking out loud, if I suddenly removed the firewall perimeter security from my network, moved security to devices/servers directly, dropped my NAT, switched to ipv6 with all publicly routable addresses, my network infrastructure simplifies incredibly. However, I do have to still protect my network to ensure network quality of service/availability and protect my devices/equipment from "public attacks". I guess the principal here is, the surface area that can be attacked is the same if you can penetrate the layered security approach - it all ends in the devices and equipment.

The fact that all devices/equipment can now have an publicly routable/addressable IP in ipv6 solves the problem of running out of address space, and would fit hand in glove with such an architecture.

Put another way, the network becomes just the network, without the need to discern between the intranet/LAN, the extranet/WAN (or DMZ) and the Internet/WAN.

superuser23• 11 years ago

can now have an publicly routable/addressable IP in ipv6

Almost no one can actually route "publicly routable" IPv6. When it becomes a standard feature of DSL/cable, maybe.

ef4• 11 years ago

Your information is out of date. Every T-Mobile subscriber with a modern Android device on LTE has a fully-working, native ipv6 address. And somewhere between 30% and 50% of Comcast subscribers already have native dual-stack ipv6.

smegel• 11 years ago

Really so they are using a 3rd party hosted HR systems etc on the internet, or something on their own services?

When you are talking about a company like Google that basically owns a large part of the internet (backbones, CDNs, hosting services) "moving stuff to the internet" it means a lot less than a non IT company like a bank.

gmrs• 11 years ago

What if I plug a pendrive in one of these devices and install an app that reads every network activity? If I have the same sequence of packages required to authenticate, I'm in?

greggyb• 11 years ago

How is this any different than doing the same on a laptop that is accessing a VPN?

eru• 11 years ago

If I have the same sequence of packages required to authenticate, I'm in?

The sequence of packages needed to authenticate is different any time.

zobzu• 11 years ago

Tldr google no longer use vpns for corp access

mark_l_watson• 11 years ago

What has changed? I worked as a contractor at Google in 2013. Everyone had a securely locked down company laptop. All logins anywhere required a dual auth device.

I was really sick one day and I had no problems doing my work from home. Also, one of the great joys of working at Google is the availability of code labs that are individualized instruction to learn different aspects of their infrastructure and technology in general. I spent a ton of time when at home working through code labs that were relevant to my job. No problems with remote access.

snowwrestler2• 11 years ago

This seems like the sort of thing that can work for Google because Google runs on Google software, which runs on Google hardware. They control the full stack from top to bottom, so they can decide where to put the doors and where to put the monitoring.

Most companies run on stuff that is not their own. Microsoft Exchange running on Windows running on VMWare running in some 3rd party datacenter is a fairly modern way to host an email server. In that situation, everything is out of your hands BUT the network edge. You don't audit Microsoft's code bases, you don't specify how Webmail works, you don't control the discovery, disclosure, or patching of critical vulnerabilities.

Sure maybe the firewall/IDS/VPN only keeps amateur griefers out, but there are way more of those than APTs.

And folks will only have limited insight into the internals of all this 3rd-party software. But if you have a gated network, then you can use a tool like NetWitness to characterize and alert on your traffic--and just your traffic.

rev_bird2• 11 years ago

I think I'm missing something important here. I understand it as far as "internal networks give people a false sense of security," but it's still worth something, isn't it? Why not implement all of these security features AND keep your internal network locked up? Is it really just convenience?

umonicd• 11 years ago

The return of capability based security? Couldn't help but notice the phrase "fine grained access", I guess your device acts like a sort of token?

itaysk• 11 years ago

Nothing new here.. I work for Microsoft. we have had most of our tools in the cloud for quite a while. One thing's for sure - every new app is cloud based. We use Azure AD and multi factor auth to allow access from internal and external networks. It's pretty common with small\medium companies I work with, maybe less with large enterprises.

lessthunk• 11 years ago

if it's crucial for the company, it should not be on a public internet.

a-dub• 11 years ago

so THAT'S why they bought up the .dev TLD.

lame.

priyajv99• 11 years ago

The biggest problem with VPNs these days is that they connect a user to the network, not just to the applications they need to access. Any malware on the users device can ride the VPN into the network and start having fun. Sure you can micro-segment the network to limit the damage but at least the Google approach puts all traffic through an "Internet-Facing Access Proxy" limiting exposure to the individual applications in question.

However, I completely agree with the previous post that the user devices need to be considered untrusted. This is a huge problem with the Google approach. Certificate distribution and management on thousands of employee owned devices is not practical nor scalable.

https://oxter.in

Google Moves Its Corporate Applications to the Internet

Related Stories