CYRUS MISTRY: Hello.
My name is Cyrus Mistry and I'm a Group Product
Manager on Chrome Enterprise.
I'm really excited today to do a deep dive into the modern OS
architecture that was built for the cloud.
This is especially relevant right now
given the challenging times that we're in.
You know, cloud-based technology-- and we all
know this-- has changed how we work.
It has meant that we can work securely
from any device, any location, anytime.
You can be on a tablet, a phone, a laptop, a desktop,
and you get to your work.
You can collaborate with others in a really seamless way.
This is something, for those of you that will remember,
you know, there was version 12 of the document
and you'd send it out to eight people
and they'd all give you different revisions
and you'd have to somehow merge them together.
Or you'd have to say, I'm only giving this to Julie right now
and wait and then send it to--
But now, because it's in the cloud,
and there's a central place, you can all
be collaborating at the same time.
This has really fundamentally changed how fast we work
and what happens in challenging times
like we've been facing for the last several months
where working from home didn't all of a sudden
mean you couldn't do anything.
An enormous number of people could continue working,
if the applications were built for the cloud
from the very beginning.
At the same time, it's made life fun for IT departments.
How do I secure these end points?
What exactly are they accessing the cloud application from?
What's the user experience like?
Are they able to get to everything?
How does authentication and authorization
work in this world?
Do they have access to all the applications
that they need for their work, right?
Oh shoot, some are legacy applications.
Maybe I should use Citrix or VM ware to get it to them.
Those types of things are what we're
going to talk about today.
And how can a modern operating system help you with that.
So I have the benefit of, at the time,
I think I'm now the longest running product
manager in Chrome OS.
I've been on the team since the founding team 10 years ago.
And that's a long time since Chrome OS has been out there.
The nice thing about Chrome OS being built 10 years ago
versus 30 is, we got to invent the operating system built
for the new world.
We got to build it for a cloud worker.
Whether they're a user at home or whether they're
at work or school.
You know, if you look back at operating systems,
you may wonder why exactly did Google come into the picture,
right?
Google is a search company.
Why did they decide to build an operating system?
Our goal is to give people the absolute best web experience
that we can.
We had started building great web applications.
But then bandwidth was becoming a big problem, right?
People just couldn't-- they didn't have good enough
bandwidth.
And so we had a lot of work that we did worldwide
to help improve bandwidth.
We got that to a really good place.
Now, again, bandwidth proliferation,
there's still a lot of places that
don't have great bandwidth.
But it's definitely getting much better.
So we had bandwidth, and we had web applications.
But then the browsers were just--
they were, you know, you probably
remember when multiple tabs came out and one of your tabs
crashed and they would crash all the time.
It would take down your entire browser.
Or there would be pop ups non-stop taking up your screen.
And so we wanted to come up with a fast-- and they were slow--
we wanted to come up with a fast browser that
was secure that was built on a modern web architecture.
So now we had a great web browsing experience.
We had great about applications.
We had much better bandwidth.
There was still one problem: to get to that browser.
And that's all people wanted to get to.
To get to that browser, you had to boot your computer.
And you'd boot it and then you'd go out for breakfast.
And maybe 20 minutes later, you'd come back,
and you know, some loud noises going on
and it was still doing something.
You know, when we built Chrome OS--
a lot of people don't realize this--
the cheapest laptop at the time was $450.
And the fastest booting laptop was one full minute.
And now here enters an operating system that says,
we can boot in six seconds.
And we are built in a completely fundamentally different way,
so that we can actually run on a $200 piece of hardware.
A full size laptop, not a netbook, right?
A full size laptop, full pitch.
And so that's really what we did.
And I'm going to go through and tell you
some of these little under-the-hood secrets
of what's going on.
What have we been up to over the last 10
years is not just building this amazing operating system.
But my team specifically-- the Chrome Enterprise team--
focuses on making sure that this works in enterprise
environments, right?
For schools, governments, businesses.
For instance, you need some kind of admin
console to manage what's going on these devices, right?
Every admin cares about two things: visibility and control.
They need to see what's going on.
They need to see how the devices are being used, which
ones are having a problem.
You can lock it down with lost and stolen mode.
You wanted to make sure you have the right device selection
that you need.
You wanted to have all kinds of different modes.
For instance, you can turn a Chromebook into a sign.
You can have a kiosk mode.
You can have it be a managed guest session where you don't
even need a log in, right?
There's no identity at all.
You can just get straight to a website or an application.
We brought the entire mobile application ecosystem,
the largest mobile application ecosystem in the world,
to Chromebooks.
And so on and so on.
And so, this is kind of--
there's an entire team just focused
on making sure this works phenomenally well
in an enterprise setting.
What we're going to go through now is,
what are all the benefits of a cloud native operating
system for end users?
And what are the benefits for businesses?
Let's go into end users.
The first interesting thing is, it's really, really fast
to boot.
Booting in six seconds is incredibly difficult to do.
And making certain you don't regress over time, right?
This is-- a six second boot is what
we started with 10 years ago when we first
unveiled a Chromebook.
And it is still there, given everything else
we do on a Chromebook.
Making sure that you get the 12 hours of battery life,
that's enormous given laptop batteries used to last an hour
or so.
And having the full productive environment that you expect,
having applications run seamlessly side by side
next to a mobile application next to 15 tabs running
and multiple virtual desks so you can consolidate
and coordinate your work.
Talking a little bit about what happens in those six seconds.
It's actually interesting.
The boot would be faster.
But we take a few of those seconds every single time
we boot to verify every single bit of the operating system,
right?
For those of you that are security geeks out there,
we have a route of trust burned into the hardware
of every single Chromebook that is out there.
And from that route of trust, we actually
go and check every single level of the operating system
to make sure that it hasn't been tampered with
or hasn't become modified in any way.
It may not even have been malicious.
But if the operating system is not exactly what we expect,
we not only don't boot you into that operating system,
but we have a backup dormant operating system at all times
that we just flip to, restart, and boot you
into a clean new operating system
while we are repairing the other operating system.
This is an extremely unique and interesting characteristic
of Chromebook.
And it's something called Verified Boot, which means,
imagine what this means.
This means every single Chromebook
that turns on a Monday morning, you
know that they're in a verified state,
that those operating systems are clean.
And it really is a really great feeling.
The other thing that we did that is, I think,
really, really unique to Chromebooks
is, we have the benefit of working directly
with all of the major OEMs that are making Chromebooks.
There are dozens and dozens of different models
of Chromebooks, every range, like I mentioned.
$200 Chromebooks, a $1,500 super thin,
super light, super high end performance devices, styluses,
touch convertibles, detachable.
Every type of devices there.
But we made them adhere to Google's design requirements
down to the reference design, the wiring schematics
have to be approved by us.
And this is so important because what we can do,
then again, down to the hardware layer, what
we can do if we have a fully vertically integrated solution,
is we are able to centrally update every single Chromebook
in the world from us directly.
There's no intermediary.
There's no images that are in some local place
that I'm pushing out that can be modified.
There's no OEMs modifying the OS image.
No one gets any ability to modify an OS image,
except Google when we send it out.
And, that gives you the best of both worlds.
If you think about a vertically integrated hardware software
experience, there's only two other players that do that.
But you're limited to a handful of devices
that they have for you.
Here, you get the benefits of a fully integrated solution.
But the benefits of the market competing
against each other, all of the major
OEMs playing with each other.
So what that means is, every single Chromebook you pick up,
you know you're running the latest OS.
You're not wondering, what did this company have versus this?
And, when you boot that operating system,
you know that there's going to be a bare minimum that we're
going to make sure that it has that exact same keyboard,
that it's not been modified the layout,
that it has a front facing camera.
This means you kind of have this confidence level whenever
you pick up a Chromebook on how it works,
which is really, really interesting.
And lastly, we've made sure that the Enterprise features
are there in these Chromebooks.
Like cloud telemetry, so that you can--
supportability of these Chromebooks,
all of the types of things that the OEMs want so that you
can get a packaged Enterprise OS with the device,
all of those types of things.
There's another really interesting point, which
is this untethered access.
No matter what Chromebook you pick up in the world, right,
you get the benefits of Chromebooks are stateless.
A lot of people ask, do they even have hard drives?
Well, you have to have hard drives so you can work offline
if you need to, et cetera.
But they are much more stateless.
Which means generally speaking, the data's
probably not going to be on that device, which is great.
You know, you leave it in a taxi, yeah,
you've unfortunately lost the hardware.
But you don't have that sickening feeling
of, oh gosh, what are they getting access to, right?
100% of the data on every Chromebook anywhere user data
is encrypted.
So, but most likely, it's not even on the local device.
And that big benefit means you could pick up any Chromebook
and be exactly where you left off, right?
Your extensions, your applications, everything
is back where you left off.
But that provides not only this great stateless experience,
but a personalized experience, right?
It's the only type of device out there
that can be as stateless, and yet as fully personal
as a Chromebook, which is actually really,
really an interesting, unique combination of factors.
And, further to that, you get access
to every one of your applications back, right?
They're pre-installed when you sign into any Chromebook,
right?
And the application may be, in this case,
you can see there's the ability to run Linux.
There's the ability to run-- we already talked
about the full, largest mobile application
ecosystem in the world.
They may be Chrome apps.
They may be PWAs or websites.
You can even run now Windows application
through BBI solutions, server side, local.
We also make sure that we sandbox
every single application.
This is also very, very unique, right?
Every application cannot modify anything that another
application is doing.
This is actually, if you remember how applications
used to be installed into an operating system,
they would be installed and there would be, you know,
stuff left everywhere, stuff modified in the registry.
And this is how operating systems-- this
is why you needed antivirus, why you still
do on many operating systems.
Because the operating system can be modified, right?
We do not allow that on a Chromebook.
Let's talk now briefly about the benefits to IT administrators
by having this modern operating systems, this cloud based
operating system.
So we talked a little bit about applications
not trusting each other.
But every layer doesn't trust the other layer, right?
The way the firmware was designed,
what the operating system can do,
what the applications or browser can do to the operating system,
you know, spoiler alert: nothing.
How the applications interact with user data.
We have done-- and for those of you that are in security,
you'll know this concept called defense in depth.
We've made sure that we add these layers
so that if something is in a website tab,
it would have to break out of the website tab,
out of its sandbox to even get access
to the next website next to it.
Then the entire browser is sandboxed.
Then the OS is sandboxed separately.
So somebody would have to break four levels out
to even modify the OS.
And even if it does, during verified boot,
we would notice that, right?
And so you think about the levels that we've gone to.
It's the benefit of having security engineers
at the table when you're designing the operating
system is, they weren't just an afterthought of oh,
let's check and have the security people look
through this code.
It's, no.
You tell us how we should design this from the start
so that we won't have to deal with this.
So that there will be no such thing as an antivirus running
on a Chromebook.
Another key thing that we did, again, the only operating
system that launched from day one,
we required a TPM in every single Chromebook.
And those of you that are in security
will know what a TPM is, right?
The Trusted Platform Module.
It's super important.
For us, we make sure that this was
going to be important for protecting user data,
for protecting the identity, for protecting the encryption keys,
for protecting enrollment status,
for protecting all of the key aspects.
We made sure passwords, of course,
we made sure that every device had one.
But one of the things that we ran into with TPMs
was, we were beholden to the TPM manufacturers, right?
We'd find vulnerabilities many times faster
than anyone in TPM.
We would notify them.
We'd have to wait, et cetera.
And we said, this is just too important.
And so we literally designed our own type of C chip.
And that is now what chip's in every Chromebook.
And it is the route of trust of so many of these things, what
we called the nucleus of trust.
And it's not only designed by us.
But it's updated entirely by us, right?
You get all of those other benefits of being
able to update that Titan C.
I mentioned this briefly, but one
of the other benefits of having a second dormant operating
system on there is that the second operating system can
be updated while you're working, and you don't even
know about it, right?
Gone are the days when it's, well, there's a new version.
It's going to take about 35 minutes.
Please go take a long break.
That doesn't happen here.
The operating system is updated in the background.
And when you reboot, you're not running the new version.
And most of the time, the end users don't even know.
That's how seamless it is.
And this happens every six weeks, just imagine.
By the way, there's a little interesting tidbit
that goes on.
When you sign out of a Chromebook
and you get back to the sign in screen, right?
It goes dark for a second and you're back
to the log in screen.
If you have a new update that's ready, when we sign you out,
we'll actually do a quick boot and take you back
to the log in screen so that you actually when you sign out,
when you get back to the log in screen,
you're actually running a new version of the operating
system.
And the end user doesn't even know.
It's actually a really interesting thing.
Again, a combination of so many interesting things.
Having two versions of the operating
system plus a super fast boot, plus the updating
in the background lets you do these kind
of really magical experiences.
There's no concept of imaging, right?
There's no concept of, what is the image
that I have to set up here?
It's, for this set of users in this group
or this organizational unit, what applications do they have?
What networks should they be connected to?
What printer should they have?
That's what you have to worry about.
Just literally, what policies do you want?
And then you enroll the device.
And that's all you have to do.
Enrolling the device, which is our equivalent of imaging,
is literally hitting Control Alt E
and signing in into your domain.
That's it.
It takes about four seconds on the device
to permanently enroll it into your domain so that it works,
you can track it, lost and stolen prevention, all of that.
Of course, you have to be running the Enterprise
operating system that's on there so that you
can get the OS features that are there, like kiosk owned
and all those types of things that we talked about.
Lost and stolen protection and all that is in there.
There's no antivirus to push in your image
because there's no such thing, right, on a Chromebook,
as we talked about.
And this is the console where you set all that up,
as we talked about.
It's entirely cloud based.
You go to admin.google.com.
Of course, you can also run your favorite EMM if you want.
And this is where you can push applications and do
all of those things really, really easily.
Thank you for bearing with me as we went through all of that.
It was quite a lot.
We covered how the operating system
was built, why we architected it the way we did,
what the benefits were to the end users, what
the benefits were to IT admins.
It's a free trial to start it out,
if you'd like to go try it.
Please see the URL here to go check it out for yourself.
If you are struggling with secure ways,
the reason people have been flocking to Chrome Enterprise--
and we are sold out in most places--
for remote work, there's a great remote work toolkit here
that you can go look at.
And of course, you can see the link there
to contact your friendly local sales team.
And I'm sure they can answer any questions you have.
With that, I want to thank you again so much
for taking the time today.
And I hope you learned quite a bit
about this modern operating system.
Thank you so much.