Hacker News Reader

Comment by tptacek | Hacker News Reader

For organizations with extremely sophisticated security teams, pretty far beyond the industry norm for "unicorn" startups (which themselves tend to have security teams with 10+ people on them, meaning millions of dollars of annual spend on security), this makes sense.

But for other companies, when they haven't been architected from the beginning to carefully support this access model, this is terrible advice. Just awful. Converting a company with a VPN/private deployment environment model directly to a "YOLO BeyondCorp" model will get that company owned up.

Further: if the primary things people need to get into private IP space for are (1) developer access and (2) access for non-technical staff to admin interfaces, the win just isn't there, even if done correctly, for most companies with the BeyondCorp model. It costs more to keep that model secure than it does to set up a system of VPNs for private access.

View on HN

You and others here are assuming that VPN provides you with at least some security. In reality, VPNs grow large and open and someone will inevitably bring malware in. Furthermore, people run untrusted software in browsers and VMs that is capable of scanning the VPN and exploiting vulnerabilities. There is no security in a VPN. It's as naked as public IPs.

As for the cost of host security, you have to consider the cost of VPNs too:

- VPNs complicate everything, because all computers inside them are effectively on a crippled, partitioned Internet. Staff that could normally just login via web interface has to fiddle with network settings. High-bandwidth apps need custom configuration to bypass the VPN in select cases.

- VPNs block cheap cloud services. They encourage deployment of poorly secured self-hosted services with on-going administration costs.

- And then there's the latency. People will setup star topology for VPNs, because it's simple and easy to control, but then everyone spends time compensating for the increased latency.

Sure, migration between security models is tricky, but migration to anything is always tricky.

I'm certainly comfortable with WireGuard for machine to machine connections, but I don't see how it would replace traditional VPN w/ 2FA (e.g OVPN w/ Duo) for non-technical staff to access internal apps (at least without something similar to PAM)

When non-technical people get VPN access, it's almost always to access a small selection of specific applications. Lock their VPN connections down and implement 2FA (or, more realistically, 2FA-enabled SSO) for the applications rather than the VPN connection.

The 2FA VPN thing is, I think, a consequence of how hard it is to set up VPNs. Companies share VPN infrastructure between developers (who need relatively unfettered access) and non-technical staff, because maintaining multiple VPN configurations is so painful. WireGuard fixes that problem.

This is what I'm talking about when I say that WireGuard is a big deal. The current situation, with 2FA logins to very powerful VPN connections, is deeply suboptimal, and is what BeyondCorp was a response to in the first place.

If I was asked by a client today to design a remote access solution for customer support people to access an internal admin app, I might try to devise a site-to-site system (in which case I'd happily use WireGuard) --- deploying host-based VPN for support staff seems like a nightmare. But even if I couldn't, what I could do now that WireGuard is available is retain OpenVPN but drastically ratchet down what it has access to, SAML-ize the admin applications, and migrate developers to WireGuard environments.

Indeed.. There's no way at "OlderCorp" where I work would be able to move to this "YOLO BeyondCorp" public ip everything, we would be owned in seconds.

Reply on news.ycombinator.com