News for hackers. Stuff that matters.

A comment on BeyondCorp: How Google Ditched VPNs for Remote Employee Access. Parent comment

Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by fulafel on Monday January 22, 2018 @10:44AM (#16205193)
Android and x86 at least have no credible assurance about that. Boot chain integrity does nothing to stop you from gaining access through local privilege escalation vulnerabilities.
[ Parent | on HN ]
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by mikelward on Monday January 22, 2018 @11:16AM (#16205495)
But it means you can whitelist trusted OS releases. And ensure devices have all the security updates they claim to.

You'd still have intrusion detection, firewall, user presence detection, monitoring at the proxy, etc. to guard against threats posed by local exploits.

[ Parent | on HN ]
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by fulafel on Monday January 22, 2018 @12:57PM (#16206371)
After the user (or malware) gets code execution in ring 0, the whitelists and detection mechanisms are no longer effective.
[ Parent | on HN ]
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by mikelward on Monday January 22, 2018 @11:36PM (#16211033)
They're a necessary condition, not a sufficient condition. (Good signal if present, bad signal if absent.)
[ Parent | on HN ]