There's no reason that these tools cannot be hosted on the company's own servers and made accessible remotely via VPN. However, that's a decision every company has to make for itself.

A classic company nowadays will have their code in Github, their e-mail and documents over at Google, even more documents in office 365 cloud, critical company files in Dropbox etc.

All for the sake of convenience. For me the important thing is to keep a work machine which is solely dedicated to work, which is only connected to the necessary services.

Really? That sounds very unusual to me. I've never worked at a company where critical, confidential business information was permitted to be hosted on an external service. Critical company files on Dropbox?? That sounds to me like a fire-able offense. Maybe fine for a start-up, but for a "classic" company?

Fair point about the startups, indeed that is what I was talking about. I do not see it as much of a problem, personally. (side note: I do not have access to critical company information, however I know it is hosted on Dropbox)

Our code, which is probably the most critical part, is on Github and that is definitely the case for many, many companies.

> For me the important thing is to keep a work machine which is solely dedicated to work, which is only connected to the necessary services.

VMs do wonders for this. A work VM with only work things makes it easy to keep work and life separate, but at the same time way more convenient than two computers.

How would you suggest dealing with shared passwords? I would rather have a much better solution than having a vault in a closed source app (even though it promises encryption) on Dropbox which pretty much have to release information to for example NSA if I'm not mistaken. It's by far the easiest solution I've found but would very much want a more secure and more private solution.

The best way to deal with shared passwords is to not have them. If you find yourself needing to share a single account with multiple users, then you're doing something wrong.

This simply is not conducive to a modern team. There are better ways to ensure security while still allowing some ease of use.

Not saying that you should store private keys in not-so-private places, but if you need to access any non-critical accounts as a team, what you propose is simply not reasonable.

What kind of non-critical services would a team need to share an account for?