That is an extremely naïve perspective. Imagine you run IT for 10,000 PCs across the US. For one, maybe 10% of these would need to be upgraded to get to an OS with modern security. Then there's the servers for internal applications which can't be upgraded without breaking things. And then you'll need to deal with all the support, explaining to employees why, yes, although they have tasks which need to run overnight, no, they can't disable automatic update, because it would put the corporation at risk. Not to mention the amount of work it takes to keep computers up to date even when the user isn't a problem.
And even with all of that, one day one of the computers gets a backdoor installed, and the attacker is able to copy everything off your network drive, because you didn't have any sort of IDS or firewall to prevent it.
Smarter people than you have thought about this. There's a reason the idea of an internal network exists at all; NAT certainly wasn't something people were considering right from the start.
There are 7 billion people alive today. It's silly to assume otherwise.
What's more is that it prevents learning. I was talking with friend of mine the other day about an idea to set up a sqlite database with a html/css/javascript front end in order to organize all the word documents and spreadsheets that currently are haphazardly tossed onto a shared drive at work.
He pointed out that that's basically a content management system, and I realized that up until that point I assumed I was the first person to ever think about this problem. Now I have a bunch of people's code to read and learn from.
It may be true but it's also rude, just like calling a fat person "fat" is probably truthful but rude and not very helpful to say in most conversations. tylermenezes used the phrase as an appeal to authority in order to demean the notatoad's argument. I don't think your example compares to that case (shutting down trains of thought vs. re-inventing wheels).
I disagree that it is naive. At the recently finished RSA conference it was a common theme in many of the discussions. Basically operations is going to 'lose the war' of trying to control every device that is inside your network because there are phones, and tablets, and personal computers etc. which all want to be 'connected' at some level. So creating an infrastructure that is tolerant of that may ultimately become the norm.
Apparently in some sensitive facilities there are networks keyed off by MAC address, and then 802.1x key, so you need to have both the right MAC and the right key for that MAC to get an address and to send and receive packets. Connecting to the network switch with a 'non-authorized' MAC puts you on a different VPN than the if you connect with an authorized machine.
One of the attendees at the show told me they assumed that their network was 'unsafe' all the time and planned accordingly.
Now its probably naive to think we would go there in a year or two but it does seem to be a road we're being inexorably forced down.
How does an intranet/VPN help with avoiding malware on end user computers? I don't see the connection, isn't that entirely orthogonal? The OP wasn't arguing that you shouldn't control end user's devices, just that having an intranet of some sorts is not helpful.
If you run a large network, you'll have to deal with malware on users devices, and you'll have to deal with people gaining access to your network in other ways, such as this white box.
Having an "internal" network that isn't actually internal only gives you a false sense of security. Having access to an internal network should never give anyone higher access levels, but the whole idea of a "corporate intranet" pushes you in that direction.
Comments
That is an extremely naïve perspective. Imagine you run IT for 10,000 PCs across the US. For one, maybe 10% of these would need to be upgraded to get to an OS with modern security. Then there's the servers for internal applications which can't be upgraded without breaking things. And then you'll need to deal with all the support, explaining to employees why, yes, although they have tasks which need to run overnight, no, they can't disable automatic update, because it would put the corporation at risk. Not to mention the amount of work it takes to keep computers up to date even when the user isn't a problem.
And even with all of that, one day one of the computers gets a backdoor installed, and the attacker is able to copy everything off your network drive, because you didn't have any sort of IDS or firewall to prevent it.
Smarter people than you have thought about this. There's a reason the idea of an internal network exists at all; NAT certainly wasn't something people were considering right from the start.
>Smarter people than you have thought about this.
That is very rude.
There are 7 billion people alive today. It's silly to assume otherwise.
What's more is that it prevents learning. I was talking with friend of mine the other day about an idea to set up a sqlite database with a html/css/javascript front end in order to organize all the word documents and spreadsheets that currently are haphazardly tossed onto a shared drive at work.
He pointed out that that's basically a content management system, and I realized that up until that point I assumed I was the first person to ever think about this problem. Now I have a bunch of people's code to read and learn from.
It may be true but it's also rude, just like calling a fat person "fat" is probably truthful but rude and not very helpful to say in most conversations. tylermenezes used the phrase as an appeal to authority in order to demean the notatoad's argument. I don't think your example compares to that case (shutting down trains of thought vs. re-inventing wheels).
I disagree that it is naive. At the recently finished RSA conference it was a common theme in many of the discussions. Basically operations is going to 'lose the war' of trying to control every device that is inside your network because there are phones, and tablets, and personal computers etc. which all want to be 'connected' at some level. So creating an infrastructure that is tolerant of that may ultimately become the norm.
Apparently in some sensitive facilities there are networks keyed off by MAC address, and then 802.1x key, so you need to have both the right MAC and the right key for that MAC to get an address and to send and receive packets. Connecting to the network switch with a 'non-authorized' MAC puts you on a different VPN than the if you connect with an authorized machine.
One of the attendees at the show told me they assumed that their network was 'unsafe' all the time and planned accordingly.
Now its probably naive to think we would go there in a year or two but it does seem to be a road we're being inexorably forced down.
How does an intranet/VPN help with avoiding malware on end user computers? I don't see the connection, isn't that entirely orthogonal? The OP wasn't arguing that you shouldn't control end user's devices, just that having an intranet of some sorts is not helpful.
If you run a large network, you'll have to deal with malware on users devices, and you'll have to deal with people gaining access to your network in other ways, such as this white box.
Having an "internal" network that isn't actually internal only gives you a false sense of security. Having access to an internal network should never give anyone higher access levels, but the whole idea of a "corporate intranet" pushes you in that direction.
Is it acceptable to run a VPN over the internet?
That's the whole point of a VPN: A Virtual, Private Network which runs on a Physical, Public Network, i.e., the Internet.