Be Ready for BeyondCorp: enterprise identity, perimeters and your application

No ratings

Presented at lascon 2016 by

Aaron Zollman

Publishing an application inside an enterprise used to be easy: stick it behind the firewall and log in with LDAP; in this simplistic view of the world, that's enough to grant access to insiders and prevent access by outsiders. Even if that were true then (it wasn't), it's untenable now: half of your collaborators are remote, VPNs are blunt and risky, and many of the applications your insiders need access to are hosted elsewhere. A better pattern is to separate out the functionality once provided by a single, hard outer perimeter into smaller units that can be wrapped around your application but still centrally controlled by your security team: strong user authentication tied to risk (for example, requiring MFA for road warriors but permitting direct access internally), paired with device authentication that restricts access to corporate-owned devices. Although Google wasn't the first to do this, they laid out a roadmap in 2014, calling it BeyondCorp. In their model, they built for themselves proxy-like access gateways and network authentication to enforce authentication that grants different kinds of access based on person, device and location. I will demonstrate this pattern and how you can implement it in open-source web applications: not only separating out authentication from the application's business functionality through tools like SAML, but what has to change in webapp frameworks like django to make permissions conditional not just on the user's groups but on metadata about the session itself.