[MUSIC PLAYING]
MK PALMORE: Welcome to the session.
As we all know, launching a new enterprise
can be a daunting task.
Among the hundreds of both large and small requirements
and taskings in enterprise risk, cybersecurity and the need
to protect an organization's digital assets looms large.
When done safely and securely, cloud adoption
can help to answer many of the cybersecurity risk challenges
for new organizations.
During this session, we have the opportunity
to hear directly from Dr. Steve Arendt, Director and Principal
Architect of the Advanced Technology Group
from CableLabs.
Steve has had a crucial role in the launch of Gridmetrics.
And we will spend the next several minutes
exploring some challenges and provide some practical advice
to new startups on how to evaluate the use of the cloud
and what benefits may occur through cloud adoption.
So, Steve, welcome to the stage.
Welcome to the session.
How about you introduce yourself for a couple of minutes
here to the audience?
STEVE ARENDT: Thanks, MK.
I'm glad to be here.
So as you mentioned, I'm a director and principal
architect at CableLabs.
Prior to that, I was a physicist many years ago,
and then started a software consulting company,
and then about five years ago joined CableLabs.
More recently, I've been involved
in a very exciting venture called Gridmetrics, which
is essentially a startup within CableLabs
that I would like to talk to you about today.
MK PALMORE: Sure.
Why don't we start there?
Tell us a little bit about Gridmetrics.
STEVE ARENDT: Sure.
Might be easiest to show you.
So let me show you a map.
It turns out, as we're recording this,
it's the day after Hurricane Ian has hit Florida.
And what you're looking at is a map
of power outages throughout Florida
as a result of the hurricane.
The red areas indicate a power outage.
The green areas indicate no power outage.
So this is the sort of thing we do at Gridmetrics.
We collect information about the electric power grid,
both the status and voltage.
And we display it and analyze it for various consumers.
Let me show you a few more examples
of how we disseminate our data.
Suppose you're a county manager, and you
want to know the status of power outages in your county.
What you're looking at now is an email map
that we automatically produce every time power
outages within a county exceed a certain level.
You sign up for this service.
This map gets emailed to you automatically
so that you can monitor the state of your county.
One more example-- we produce a daily report
that we call the GridCON Report, which essentially measures
the health of the grid throughout the nation
and subregions of the nation for the previous day.
It details the number of outages in regions, the stability,
the quality of the power.
And then we give it an overall metric from one to five.
So this way, you can get a nice snapshot
of the overall situation in the nation.
And this sort of thing would be useful
if you are monitoring different subregions of the nation
or you're involved in emergency response teams, something
like that.
So that's just kind of a flavor of what we do.
MK PALMORE: Excellent.
So I can clearly see the value of the resource
that you're providing.
What got you and the team started on the pathway of grid
measurement?
STEVE ARENDT: Yeah, that's an interesting question.
Several years ago, we realized that--
so I should back up before I answer that.
CableLabs is an R&D lab for the cable television industry.
So our members are the cable television companies
of the United States and other countries.
So, essentially, we spend a lot of time
studying the broadband internet and wired and wireless
networks.
So a few years ago, we realized that much
of the hardware that's out in the field
to support the cable network has UPSes, Uninterruptible Power
Supplies.
These power supplies have the ability
to measure incoming grid power.
And they also have a network connection.
So we could query them and ask them, hey,
what's the voltage and the grid status where you are?
We started down this path.
We found that it worked.
And here we are, four years later.
Let me show you this slide.
Four years later, we have 300,000 of these sensors
that we monitor every one to five minutes out in the nation.
And roughly half the population of the US
is within a kilometer of one of our sensors.
So it's been quite a ride, and we've
been just growing like crazy.
And we'll continue to grow.
MK PALMORE: So you mentioned one of the use cases
that's pretty viable in terms of emergency response
for this kind of information.
What other kinds of use cases might employ or look
for and seek this kind of information and data?
STEVE ARENDT: Yeah.
So anyone who wants situational awareness
would be a potential user of the data.
Suppose you're a corporation that has
outlets throughout the country.
You would want to measure--
or rather, monitor-- the status of the power grid
where your outlets are.
Suppose you're an insurance company,
and you want to verify that power outages that
were represented in claims actually occurred,
things like that.
So there's lots of sorts of applications where
regional power data is useful.
MK PALMORE: Excellent.
So one of the reasons that we invited
you guys to be a part of this effort
was that you seemed to get some use out of a program
that we call Google for Startups Cloud Program.
Tell us a little bit about how that program aided in helping
to launch this endeavor.
STEVE ARENDT: When we first started down this path,
everything was homegrown.
We ran off servers that were within our building.
That worked until it didn't.
So now that we have 300,000 sensors,
that's obviously far too many to do a homegrown solution.
So a few years ago, we switched to GCP.
And we became a member of the Google Cloud
for Startups Program.
When we started that effort, none of us
were really cloud people.
We're software engineers and network people.
And so Google provided us with a great deal of help--
access to support engineers to get us going,
advice, things like that, really got us off the ground.
And here we are.
At this point, it's a very mature cloud setup.
We've got everything highly automated.
It practically runs itself at this point.
MK PALMORE: So one of the things that I do here
in my role at Google is I have conversations
with lots of our customers around cybersecurity risk
to enterprise and also concerns that organizations
may have in terms of moving their enterprise workloads
and processes to the cloud.
So one of the challenges is just the continually changing
environment around cybersecurity.
We know that many organizations today
are growing exponentially.
So you touched upon one of the clear benefits of cloud
adoption, the ability to scale robustly and resiliently
in terms of business operations as things
change in the business environment.
And so that's part of the conversation.
Part of the thing, I think, that initiates
those conversations is organizations
are looking at ways to scale while at the same time
protect their digital assets.
And so cybersecurity is a part of nearly every conversation
that we have with our customers as they look at cloud adoption
from an infrastructure standpoint.
But there's also some clear benefits-- in fact,
many clear benefits in the cybersecurity lanes--
of looking at adoption as a place
to create or, as we say now, born
in the cloud new organizations and how
they should look at cloud adoption as a potential option.
Steve, did you and the team have security concerns
around the data that you were collecting,
how you were going to store it and then subsequently present
the data?
STEVE ARENDT: Oh, absolutely.
In fact, we're required by our data suppliers
to go through security audits and implement
various cybersecurity measures.
For us, though, to be clear, cybersecurity
is somewhat of a distraction.
We're interested in electric grid data.
Cybersecurity is a necessary evil.
We have to implement it.
And so it's the sort of thing we just
want to go and have it done and be on our way
and on to our mission of electric power data.
So, luckily, using GCP, we get many of the security
features as part of the setup.
So, for example, we're required to encrypt our data
both at rest and on the fly.
And GCP gives us tools to do that.
We use gsutil to transfer data.
It's encrypted on the fly.
And we use storage buckets and BigQuery to store it,
where it's encrypted at rest.
Other things we take advantage of-- we're
required to use the principle of least access
for access to the data.
And so GCP's identity and access management
allows us in a very granular way to dial in access
to individual subsets of the data
so that we can satisfy the principle of least access.
Those are just a few examples.
MK PALMORE: Yeah.
I'm glad you hit on those.
Much of what you identified or mentioned
are components of things that we call security by default,
or security that's built into the feature sets
for the customers who onboard and do GCP.
But you also touched upon a granular issue
like identity and access management,
which is a core component of any cybersecurity apparatus,
at least a functioning one, of a large-scale enterprise.
And so the ability to provide IAM features
at a granular level for organizations and enterprises
that onboard into GCP are some of the clear benefits.
The other thing that I'll add to this
is that one of the challenges organizations
have as they begin to scale and grow
is this idea of creating organizational policies,
security policies, that they want
to flow through the rest of the organization.
And so one of the clear benefits is the idea
that as an organization on GCP, once you
build in those policies at the top organizational level, all
of the subsequent organizations, projects, and workloads
that fall under that main organizational folder
subsequently adopt the additional features that
have been identified as policy for the wider enterprise.
This can be extremely helpful in terms of organizations
that then stand up separate business units internally
as they begin to scale and grow.
And you don't want those new units creating
their own policies that then somehow
contradict what's been established by the larger
enterprise.
So there's a ton involved there.
Steve, can you talk a little bit about maybe some
of the cost factors that were involved in selection of GCP?
STEVE ARENDT: Yeah, absolutely.
As part of a startup, the two things
that are always in short supply are time and money.
And so anything that could save cash or save time
is a useful thing.
So the security aspects of GCP do both.
Because most of the security is built in,
there's no need for us to hire special security engineers.
It's already there.
And because it's already there, we also
don't have to spend any time implementing it.
We just get it automatically by default.
So off we go on to our main mission of electric power data.
And, as you said, once we've built it in,
which we did very early in our process,
there's no more to think about.
We've got our security policy written.
We've got it all implemented.
And we're done.
We can go on without being distracted by cybersecurity
but still secure in the knowledge
that we're protected from risks.
MK PALMORE: So, Steve, what you're describing here, I
think, is part of the challenge and lift as new organizations
build themselves out.
Oftentimes, there's a hesitation to bring onboard security
practitioners and security professionals
to help scale and grow along with the organization.
And then the founders are left determining and building out
a security footprint that essentially begins
to grow with the organization.
And so leaning on and leaning in on a cloud service
provider like Google Cloud in this instance
is actually helping the organization
to scale its security apparatus in a pace that's
commensurate with the growth of the enterprise.
And so Steve, I think, indicated that it was really
super easy for them.
There is certainly a period of enablement
that happens with our customers where,
as long as they're exposed to and understand
the granular controls and the capabilities that
are available to them, and we are as an organization
putting our customers in the best position possible to avail
themselves of these tools, products, and features,
it really makes the journey a good one as long as it's
done safely and securely.
And I think that the examples that Steve has provided
were exceptional in terms of outlining
how an organization can get clear benefit that
allows the organization to scale,
grow, and then change over time.
Steve, what final piece of advice
might you have for others in the startup
lane in terms of looking at cloud adoption
as they create these new and burgeoning enterprises?
STEVE ARENDT: I would say, even as a software engineer,
the cloud can be a complicated and daunting place to go.
So I would say, first, carefully consider
the benefits you want to get out of moving into the cloud.
It could be the security aspects we've talked about today.
It could be saving money on IT administration.
It could be easy data storage in the cloud.
Once you've gotten clear on what it is you're after, be brave.
Go ahead.
Jump in.
Start simple, and then refine and iterate from there.
MK PALMORE: I love those final words-- be brave and jump in.
To wrap up, in modern-day business,
the protection of your digital assets and your digital wealth
is a major area of risk management for the enterprise.
In this session, we've presented you
with some of the ways organizations are relying
on Google Cloud to take new and innovative approaches
to the management of their data and cybersecurity risk.
I want to thank my guest, Dr. Steve Arendt,
for joining us for this important discussion
and thank each of you for joining
in on this session of Next '22.
We hope that you've enjoyed it.
[MUSIC PLAYING]