ba.net private cloud office beyond... · 2020. 3. 22. · beyondcorp: beyond fortress security...
TRANSCRIPT
![Page 1: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/1.jpg)
BeyondCorp: Beyond fortress securityBA.net Private Cloud Office
![Page 2: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/2.jpg)
Open Source SoftwareFreedom, flexibility, low cost, no vendor lock-in, nojumping through monopoly license hoops, byod, localsoftware, hybrid cloud, retire old firewalls, new securitymodel zero trust, corporate access proxy.
![Page 3: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/3.jpg)
New hybrid cloud model:risks and threats
![Page 4: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/4.jpg)
How some enterprisesthink of security
But there are issues with this approach...
![Page 5: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/5.jpg)
Four issues that are wrecking the castle approach
Mobileworkforce
Breaches Plethora ofdevices
Cloud services
5
![Page 6: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/6.jpg)
ERP
SERVER
Access yesterday:On-premises walled gardens
VPN
On Prem
IdentityCRM
SERVER» What about contractors?
6
Employee
![Page 7: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/7.jpg)
On-prem
ERP
SERVER
Evolution:Not just employees with corporate devices
VPN IdentityCRM
SERVERContractor
Unintended CRM accessfor contractor
Employee
» What about the cloud?7
![Page 8: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/8.jpg)
On-prem
Evolution:Infrastructure goeshybrid-cloud
VPN Identity
CRM
VM
ERP
VM
» What about single sign on?8
Contractor
Employee
![Page 9: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/9.jpg)
Evolution:Identity goeshybrid-cloud
IdentityCRM
VM
ERP
VM
Now everything is either local softwareor cloud replicated
» What threats are there in this new cloud world?9
Contractor
Employee
![Page 10: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/10.jpg)
Problems
IdentityCRM
VM
ERP
VM
Phishing? Malware?
Man in theMiddle?
No chokepoint to enforceaccess control?
» What should I do?
XSS/SQL injection?
10
Contractor
Employee
![Page 11: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/11.jpg)
WALLS DON’T WORK
BeyondCorp’s realization
![Page 12: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/12.jpg)
Solutions
IdentityCRM
VM
ERP
VMSecurity
keysDevice
management
TLS
Proxy for accesscontrol, TLS
termination, basedon BeyondCorp
visionAc
cess
prox
y
» So what’s the ideal?
App securityscans
12
Contractor
Employee
![Page 13: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/13.jpg)
I want my Office application service to be:
● Accessed only by employees● From well-managed client devices● In home country● Using strong user authentication● And proper transport encryption and● Hardened against application attacks
13
![Page 14: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/14.jpg)
Implementing BeyondCorp
![Page 15: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/15.jpg)
3Authenticated
AuthorizedEncrypted
Core principles of BeyondCorp:
Any network Context-basedaccess
2v1
15
![Page 16: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/16.jpg)
High level
Access proxy
Single sign on
Accesscontrolengine
Userinventory
Device inventory
Trust repository
Security policy
16
![Page 17: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/17.jpg)
Know your people
User inventoryJob functionchanges
17
![Page 18: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/18.jpg)
Know your devices
Procurement End oflife
Provisioning
Asset tracking Certificates
Device inventory
18
![Page 19: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/19.jpg)
Dynamic trust repository
Policies Deviceinventory
PeopleLevel of trust
Certificates
Trust repository
19
![Page 20: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/20.jpg)
Access policy
Service request
Accesscontrolengine
Userinventory
Device inventory
Trust repository
Security policy
20
![Page 21: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/21.jpg)
Access from anywhere
Access proxy
Single sign on
Accesscontrolengine
21
![Page 22: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/22.jpg)
Migrating to BeyondCorp
![Page 23: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/23.jpg)
New unprivileged network
New VLAN Add devices Deploy
+ +
23
![Page 24: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/24.jpg)
Traffic analysis
24
![Page 25: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/25.jpg)
Safely migrate devices
25
![Page 26: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/26.jpg)
Better loaners
![Page 27: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/27.jpg)
● An overview: A New Approach to Enterprise Security● Front-end infrastructure: The Access Proxy● Migrating to BeyondCorp: Maintaining Productivity
While Improving Security● The Human Element: The User Experience
BeyondCorp Papers
27
![Page 28: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/28.jpg)
Lessons learned:What 7 years taught us aboutmigrating services to the cloud
![Page 29: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/29.jpg)
Lessons learned migrating to hybridcloud
Get, and retain, executive supportEnable painless migrationRun highly reliable systems
29
![Page 30: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/30.jpg)
Lessons learned migrating to hybridcloud
Get, and retain, executive supportEnable painless migrationRun highly reliable systems
30
![Page 31: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/31.jpg)
31
Migrate carefullyso as not to breakexisting users
3Base all access
decisions on what youknow about the user
and their device
2Have zero trustin your network
v1
Remember:
![Page 32: BA.net Private Cloud Office Beyond... · 2020. 3. 22. · BeyondCorp: Beyond fortress security BA.net Private Cloud Office. Open Source Software Freedom, flexibility, low cost, no](https://reader036.vdocuments.net/reader036/viewer/2022071301/60a145eee5f3734d6c2b186b/html5/thumbnails/32.jpg)
Thank you