We also talk about implementing the BeyondCorp model–why enterprises should consider it, and how to do it. In this episode, we talk about enterprise security–from remote employee access to zero-trust networks. Max Saltonstall is the technical director of information technology in the office of the CTO at Google, where he has helped to facilitate the widespread adoption of the BeyondCorp program. Google has also productized its BeyondCorp system with an identity-aware proxy that is tied into their Google Cloud product. Since the release of these papers, an ecosystem of security providers has sprung up to provide implementation services for companies that want BeyondCorp security in their enterprise. These papers describe the network architecture, and the security philosophies of BeyondCorp. Several papers have come out of Google discussing the BeyondCorp security model. The firewall model assumes that all of these servers within the firewall can trust each other.

The zero-trust model is in contrast to an outdated model of enterprise security–that of the hard outer defense of a firewall, that purports to prevent attackers from ever making their way into the vulnerable inside of a network. If you are writing an internal application, your default assumption should be to distrust an incoming request from someone else on the network. Zero-trust networks assume that the network has already been breached. A zero-trust network is a modern enterprise security architecture where internal servers do not trust each other. The BeyondCorp architecture is also built around the assumption of a zero-trust network. Whether you are an engineer logging in from a Starbucks or a human resources employee logging in from your desk, the BeyondCorp system uses the same access proxy to determine your permissions. Google developed a fine-grained, adaptive security model called BeyondCorp to allow for a wide variety of use cases. If you are accessing the proprietary codebase of your company’s search engine, your workload is more sensitive.Īs Google grew in headcount, the different cases of employees logging in from different places grew as well. If you are using a corporate application that shows the menu of your company’s cafe on your smartphone, your workload is less sensitive. Employees often find themselves needing to do work outside of the office.ĭepending on the sensitivity of your task, accessing internal systems from a remote location may or may not be OK.

Beyondcorp open source software