6 ms·

How are these relevant in a datacenter context? If you are the sole tenant of a machine then you will disable all the mitigations.

by mktmkr 7y ago

dgacmu 7y ago
Whether or not you consider it an important part of insider threat prevention depends on too many other factors (i.e., have you already prevented other, easier avenues of attack) to generalize, but it's not unreasonable to want isolation of jobs even within a single-tenant datacenter. You may also do things like run external code in sandboxes, and you'd like that sandboxing to be safe and effective.
ma2rten 7y ago
Google is not the sole tenant. It's running a cloud.
- mktmkr 7y ago
  Sure, on a handful of their machines. But they have a lot of private and dedicated hosts, too.
  - barkingcat 7y ago
    Yes, but even internally, separation between departments in a company is extremely important. Google cannot have a breach between the services running gmail and the services running adwords for example, even if those are running in the same server on an internal cloud that has strict permissions being enforced by software. This is especially even more relevant in any kind of datacenter application, even if the company is the sole tenant, because they are working with Client Data - which is data that does not belong to Google, but to their customers.
  - mrep 7y ago
    "Google's Borg system is a cluster manager that runs hundreds of thousands of jobs, from many thousands of different applications, across a number of clusters each with up to tens of thousands of machines. It achieves high utilization by combining admission control, efficient task-packing, over-commitment, and machine sharing with process-level performance isolation" [0]. All of their processes run together on the same machines so you wouldn't want to risk one compromised process access data on possibly any other process. [0]: https://ai.google/research/pubs/pub43438 https://ai.google/research/pubs/pub43438
undersuit 7y ago
You're going to make someone's life very special by having them deploy to a completely different environment than their secure workstation or build server and telling them that the security mitigations(or lack of) are causing an issue.

How are these relevant in a datacenter context? If you are the sole tenant of a machine then you will disable all the mitigations.

by mktmkr 7y ago

How are these relevant in a datacenter context? If you are the sole tenant of a machine then you will disable all the mitigations.

dgacmu 7y ago

Whether or not you consider it an important part of insider threat prevention depends on too many other factors (i.e., have you already prevented other, easier avenues of attack) to generalize, but it's not unreasonable to want isolation of jobs even within a single-tenant datacenter. You may also do things like run external code in sandboxes, and you'd like that sandboxing to be safe and effective.

ma2rten 7y ago

Google is not the sole tenant. It's running a cloud.

mktmkr 7y ago
Sure, on a handful of their machines. But they have a lot of private and dedicated hosts, too.
- barkingcat 7y ago
  Yes, but even internally, separation between departments in a company is extremely important. Google cannot have a breach between the services running gmail and the services running adwords for example, even if those are running in the same server on an internal cloud that has strict permissions being enforced by software. This is especially even more relevant in any kind of datacenter application, even if the company is the sole tenant, because they are working with Client Data - which is data that does not belong to Google, but to their customers.
- mrep 7y ago
  "Google's Borg system is a cluster manager that runs hundreds of thousands of jobs, from many thousands of different applications, across a number of clusters each with up to tens of thousands of machines. It achieves high utilization by combining admission control, efficient task-packing, over-commitment, and machine sharing with process-level performance isolation" [0]. All of their processes run together on the same machines so you wouldn't want to risk one compromised process access data on possibly any other process. [0]: https://ai.google/research/pubs/pub43438 https://ai.google/research/pubs/pub43438

undersuit 7y ago

You're going to make someone's life very special by having them deploy to a completely different environment than their secure workstation or build server and telling them that the security mitigations(or lack of) are causing an issue.