NIKHIL SINHA: Welcome, everyone.
Good morning, good afternoon, good evening,
depending on the zone you may be in.
I am Nikhil Sinha.
I'm a Product Manager at Google Workspace,
and I'm joined here today with Luke Camery.
Hey, Luke.
LUKE CAMERY: Hey, Nikhil.
Great to be here.
NIKHIL SINHA: Thanks, Luke, for joining.
Luke is also a Product Manager in the Workspace Product
Portfolio.
And together we are going to talk
about trusted collaboration for a hybrid work world.
Now a quick logistical item.
As we go through the presentation,
we will be talking about specific new capabilities
that we are announcing today.
If you are interested, you can sign up
for those using the Forms link below.
Don't worry about the Forms link on the screen.
It will be shared as a part of the video description,
and also be sprinkled towards the later part
of the presentation.
Before we dive deep into trusted collaboration,
we want to spend a moment on what
is at the core of the recent attacks
that you may have heard about.
If you notice, most of these attacks
arise as a part of phishing emails, where a malware is
installed either through the email itself,
or through one of the attachments that
may be within the email, which essentially
is an indicator that bad actors are targeting
the limitations of some of the legacy systems
that are existing in today's world.
And these attacks are getting sophisticated by the day.
You might have heard about SolarWinds,
which was a supply chain attack that impacted 18,000 customers.
Similarly, WannaCry and Hafnium are
others that created such a big mess for some of our customers.
And what we want to share here is these bad actors
are really good in what they do.
And they will find ways of infiltrating and getting
to your data, which is why we think about security very
seriously.
And we have built up security from the ground up.
There are four key pillars to our philosophy for securing
Workspace by design.
The first is that we are a cloud-first application, which
essentially means that you are not
running any on-premise servers in your environment.
All your infrastructure is being managed by Google
in the globally distributed data centers.
It's really beneficial, especially
when it comes to applying patches
that Google can apply on-the-fly without waiting for your system
admin to do the job.
The second is that we try to detect everything
at our global scale inbuilt into the product.
We call it being built from within,
rather than being bolted on as a third-party plug-in
or an add-on.
We do not require any of that, because we
believe that security is fundamental
and needs to be baked into the product itself.
The third important pillar is to make sure
that we are protecting everyone.
Examples within this category are the use of account security
keys, or the millions of endpoints, both Windows
machines or mobile devices, that you can
manage using Google Workspace.
Last but not the least, we were the pioneers
of BeyondCorp, which is essentially
the philosophy of not trusting anything by itself.
Within Workspace, you get an offering
called Context-Aware Access, which
allows you to use the user's identity and the context
of their request to make sure that they can get access
to the required application.
I'll give you an example.
If you are a user, or one of your employees
is trying to access Gmail or Drive from a coffee
shop in Thailand, it represents a different security posture,
as opposed to someone who is trying
to access Gmail, or Calendar, or any of the other apps
from one of your offices.
Similarly, we can also look into the device state, the device
health, and use those as vectors before providing access
to a given application.
What we want to talk about a little bit more today is,
how does zero trust extend beyond the applications
to your data itself?
And step one in that journey is really
articulating some of the trust boundaries
that exist around your data.
We think about the trust boundaries
across three different pillars.
The first one is the Cloud service itself--
in this case, Google.
The second is your employees, who
we deem to be great employees who
are trying to do their job on a given day,
but at the same time, may trip into some of the unknown.
And lastly, no matter how secure your internal systems are,
you'll always have the threat of outsiders
trying to access your data.
What we'll walk you through today
is the Cloud employees and outsiders trust boundaries,
and give you some indicators and some tools
of how Google Workspace can help in trusted collaboration.
Let me start with Cloud first.
The notion here is to make sure that the Cloud service issued
is inherently trustworthy.
Is the Cloud service provider doing the right thing
with your data?
Are you sure, and do you trust the Cloud
with all the confidential information
to be hosted within the Cloud service?
And the way we think about it is really twofold.
Step one is to make sure that we can provide you
with control of your data storage and access.
What does that really mean?
It means that you as a customer can
choose to locate your data within US
or other European regions based on a given [INAUDIBLE] group.
Now this is the 100% same experience
for all commercial customers.
No GovCloud is needed.
And more recently we have launched the fundamental data
regions, which is essentially a tool
to cover all your primary data at rest across eligible cities.
The next layer in terms of making sure
that you have trust in your Cloud provider
comes through what we call as Assured Controls.
It's really made out of two parts--
Access Management and Access Transparency.
Access Transparency allows you to view logs about any access
by your Google staff.
And Access Management takes it a step further by making sure
that customers can actually limit the Google staff
support to actions from US persons only.
These controls are baked into your product today,
and it's generally available for you
to use and consume to make sure that you
can rely on the services provided by the Cloud provider
itself.
Recently, we took this a step further
by introducing what we call as client-side encryption.
Client-side encryption is a tool which
allows you to have direct control over your encryption
keys.
And more importantly, any data is encrypted by the browser
prior to upload through the Google servers,
which means that Google cannot decipher this data without
explicit access control provided by the customer themselves.
You may choose to use one of our partners
in order to drive the segregation between Google that
is performing encryption, and key management, which
is being done by yourselves.
And some of the partners that we have in our ecosystem
are listed here in the slide.
Now with that concept in mind, we
wanted to relay that we are on a journey of making sure
that client-side encryption can be made available
for a multitude of applications, which is why today we
are announcing three new betas for the product portfolio.
First is Drive for desktop.
As you know, Drive CSC, our client-side encryption,
was launched for the Drive web interface.
And now we are extending it to desktop as well.
Next, and excitingly, we are announcing the beta
for Google Meet, which is a notion of performing
encrypted calls, encrypted video messages that you can start
using in a beta environment.
And lastly, if the choice of our partners
is not something that fits the bill,
or if you want to build your own key service,
we are publishing the API specs so that for customers
who are interested in having full control over the build
of the key service may choose to do.
All of this is available if you sign up
through the link at the bottom right.
But what's important to recognize here
is, while we are announcing our journey
across different applications, our vision
is to take it much further, and to make sure
that we can provide consistent experience across Workspace.
Let us show you a quick demo of what that really means.
[VIDEO PLAYBACK]
[MUSIC PLAYING]
- Managing compliance needs for Cloud products
can be very challenging.
Let's take a look at how end-user collaboration
can work with customer control encryption key.
A user shares the design documents for a US Navy
contract with their partner.
The email is encrypted by the client.
While the discussion started as an email,
the collaboration continues.
The partner decides to set up time to review the materials
and go through the slides together.
And with a single click, the calendar description
and attachments are encrypted.
Now when it is time for users to join the meeting,
they can hop on the call with a clear notification
of the additional privacy that's offered as a part of the call.
The media stream is client-side encrypted,
utilizing the same centralized keys that are
managed by the administrator.
The settings are managed to a unified UI,
and administrators can set up the functionality
for each of the products on a per [INAUDIBLE] basis,
and a rich set of telemetry to help them understand
the usage of client-side encryption
within their organization.
That's just one quick example of native end-user experience
powered by customer-controlled keys.
[END PLAYBACK]
NIKHIL SINHA: We hope that this demo gave you
a sense of where we are headed.
Let me hand it over to Luke, who is
going to talk to you about our vision,
and the rest of the areas within the trust
boundaries for your data.
Luke, over to you.
LUKE CAMERY: Thanks so much, Nikhil.
So the video that you just saw is a picture
into the unified vision that we're
planning to bring to client-side encryption.
We're looking to bring it to all Workspace apps,
and support all key user journeys across our product
suite.
And remember that no matter where we bring the experience,
we're going to maintain the same world-class user experience,
even when you're utilizing client-side encryption.
So stay tuned for updates over the coming quarters
as we march along towards the vision that you just saw.
And we wanted to point out that there are already
hundreds of customers using Workspace client-side
encryption in production every day
for their most sensitive data.
Airbus, for example, who was a key partner in the development
of client-side encryption, is using it every day
for their most critical business data at their offices
in Europe and across the globe.
So now that we've talked a little bit about how
you can control your trust boundary with the Cloud,
let's move on to talking about how
you can control trust within and across your employee base.
One of our recent innovations here
is trust rules for Drive, which enables granular sharing
controls so that you can set specific trust relationships,
even within your organization.
You can set up internal firewalls, external firewalls,
and always ensure that collaboration occurs
on a trusted channel with users who should be able to share
information back and forth.
And that it doesn't happen when users shouldn't.
We're also excited to announce today trusted domains for Chat,
which will bring a similar level of granular control
to the Chat boundary so that you can continue
to maintain these consistent access controls
across the Workspace apps.
On top of that, we're also really
excited to announce enhanced information security
with data loss prevention for Google Chat.
This is bringing our latest Workspace DLP platform
to the Google Chat app.
So just like with trust rules and trusted domains,
you can set the same admin policies across your suite,
whether in Drive, or Chat, or Chrome.
And for Chat, you will actually get real time
synchronous protection so that we can stop data loss before it
even occurs.
We're also really excited to announce
our enhanced classification and data loss prevention product
with Google Drive labels.
Over the summer, you may remember
that we launched badge labels for Drive
to support customer sensitivity label classification systems.
But we know that manual classification is cumbersome,
so we're excited to also announce automated
classification, so that we can automate the complexity away
from users.
This is just another way that we want to push complexity
under the hood and optimize for the ultimate user
experience at Google Workspace, while maintaining
our reputation as the most secure cloud.
Now for our last section today, we
want to talk about how you can manage trust with outsiders,
both genuine outside external partners that you need
your employees to collaborate with every day, but also,
potentially malicious actors who are
seeking to exfiltrate your data and do your organization harm.
The reason that we're able to provide
best-of-breed protections for anti-abuse,
and stop phishing and malware at a global scale
is because we have the largest data set in the world
to learn and prevent these attacks from your organization.
Every day we're processing billions of data points
to stop, in flight, hundreds of millions
of potential attacks every day, whether against our consumers,
or the organizations that trust us
with their most important data.
So that's why we're excited to build on these protections
and announce a few new opportunities today
where you can utilize our best-in-class anti-phishing
and malware protections to protect all of your content
in Google Workspace.
So in June we announced that we're allowing users
to block each other so that your employees can
stop bad actors from even sharing with them at the onset.
And we also announced that we've brought phishing and malware
protection to all external shares,
no matter who they're coming from,
so that every piece of data that gets shared
with your organization from the outside
gets checked with our latest protections
for phishing and malware.
We're also excited now that we're
elevating those protections before the user even
sees the content.
If there's a file that links out to suspicious content,
to a dangerous website, or to somewhere that's
hosting phishing or malware, we will warn them before they even
click on this link.
If they do end up clicking on the link,
Chrome will, of course, be there to protect them,
and our other protections will kick in.
But now this is one of the ways that we try and prevent
users from even seeing bad content at the start.
We're also excited that will enable
you to turn on those same phishing
and malware protections that we launch
this summer for externally shared content for all
the content in your corpus.
That way you can prevent against both insider threat and user
error, and make sure that no matter
where the malware comes in that Google will catch it for you.
All of these are reasons why millions of customers
trust us every day at Google Workspace to help them
enable secure collaboration.
And we're really excited for you to potentially join
these millions of customers.
So if you're interested in learning more
about what we do to help you manage, protect, and govern
your data, check out Workspace session 205 for a deeper
dive on some of these security and privacy features,
like client-side encryption, data-loss prevention, Vault,
data regions, labels, and more.
And again, if you're excited about any of the betas
that you saw today, sign up for the beta
form here at this link, or check it out
in the description of the YouTube video for easy access.
Well, unfortunately that brings us
to the end of our presentation today.
So I want to thank Nikhil for joining me.
NIKHIL SINHA: Thanks, Luke.
And thank you for putting all the content together.
We want to thank our audience.
We hope that you found the video useful.
And we hope that you continue to enjoy the rest of the session
as a part of next 2021.
Thank you, everyone.