BeyondCorp Weekly 11
Ivan Dwyer - March 14, 2017
Last week was the Google Cloud Next conference in San Francisco, which just by eyeballing, I’d say was 10x the size as it was last year. They are clearly investing heavily into their Cloud business, making a strong play for the Enterprise. As mentioned in last week’s newsletter, Google has hinted about commercializing components of BeyondCorp, which they now have with their Cloud Identity-Aware Proxy. It’s my view that this is part of their play in the Identity governance space more than anything, competing with Microsoft and Active Directory. The IAP is currently in beta, and works with Google’s Identity service and resources running in Google Cloud. The demo shown during one of the keynotes is up on Youtube for a glimpse into how it works.
During the conference, we held another BeyondCorp SF Meetup just down the street at Heavybit Industries. It was a strong showing, and we had the pleasure of watching a presentation from Evan Gilman and Doug Barth, who are currently writing an O’Reilly book about Zero Trust Networks. They shared their experiences designing a fault tolerant Zero Trust network while at PagerDuty. Then I followed up with a presentation about how Zero Trust is changing Identity & Access. My session was recorded, which I will share once ready. In the meantime, I posted my slides on Slideshare.
https://www.slideshare.net/fortyfivan/how-zero-trust-changes-identity-access
Here are a few additional things that caught my eye this past week.
Home Depot to pay $25M in breach settlement [SC Magazine]
Following a 2014 breach, where hackers were able to infiltrate store self-checkout terminals, Home Depot has agreed to a settlement. The terms include a security overhaul, including better vendor management. The dollar figure is just another data point towards the cost of a breach, which we can use as evidence in our own risk analysis & prevention efforts.
SMB IT Pros Give Themselves an “F” on Prevention, Detection [InfoSecurity Magazine]
Barkly conducted a survey with IT professionals which overwhelmingly found that they believe their security posture is lacking. Much of this is due to outdated, static technologies such as firewalls and AV. I see BeyondCorp as an IT movement first and foremost, putting forth the right architecture that will enable better security measures across the board.
Exploring The Gap Between Cybersecurity Perception And Reality [Forbes]
On the flipside, Tom Bradley shares insight from a panel at RSA Conference, where a study by Arctic Wolf found that nine out of ten respondents believe that perimeter security tools are capable of combatting all cybersecurity threats. This contrasting viewpoint clearly shows that there’s a disconnect between our day-to-day efforts and the actual outcomes.
Trust, Cloud & the Quest for a Glass Wall around Security [DarkReading]
A path towards closing that gap is placing more emphasis into cloud native technologies, where the architecture and associated security practices are more aligned with how modern organizations operate. This is where I see a strong shift in thinking, moving away from the traditional methods of stacking the perimeter towards a new model centered around Zero Trust.
Don’t Forget People and Process in Your Digital Transformation [TheNewStack]
On a semi-related note, Abby Kearns from the Cloud Foundry Foundation puts forth a needed reminder that people and processes are just as important as technology when going through any form of digital transformation. I would argue that BeyondCorp is the beginning of a security transformation, as companies look to design a new Zero Trust architecture from the inside out, much like Google did.
Upcoming Events
For those at SREcon in SF today, I highly recommend attending Evan and Doug’s talk about Zero Trust Networks. Great to hear about real world implementations.
We’re back in Austin next month for the InfoSec Southwest conference. We may host another BeyondCorp Meetup happy hour, so stay tuned if you’re in the area.
That does it for this week. Check back this time next week for another set of relevant news, articles, and events. Cheers,
Ivan at ScaleFT
Ivan Dwyer
Ivan Dwyer is the VP of Product Marketing at ScaleFT, working with the community to raise awareness around BeyondCorp and Zero Trust for organizations of all kinds looking to modernize their security architecture.
