RETO MEIER: I'm Reto Meier.
STEPHANIE WONG: And I'm Stephanie Wong.
Joining us now, Rae Wang, Security Product Manager
for Google Cloud.
Thanks so much for joining us.
RAE WANG: Thank you.
It's great to be here.
STEPHANIE WONG: So, security is such a vital part of everything
we do online and in the cloud.
Let's talk about Security At Scale.
As our environments grow larger, security simply must keep up.
How is network security changing as we
move from brittle environments built on static IPs,
to microservices?
RAE WANG: The traditional IP-based networking policy
is required to have very detailed knowledge
on the nitty-gritty parts of your networking configurations.
They don't really offer you a concept of which service
can talk to what, unless you segregate them by IP addresses
and subnets ahead of time.
And this quickly becomes unwieldy as you
scale your infrastructure, especially as you introduce
the concept of microservices.
And this is where a cloud-native platform
like SGO, Automanage, version CSM,
give a very different kind of experience.
They allow the admins to define high-level policies that
focus on application requirements of business logic.
The microservices are backed by [INAUDIBLE],, which give you
a natural isolation boundaries, and each service
is also given a unique [INAUDIBLE]
of service identity.
Then you can set policies leveraging these identities
and boundaries.
For example, you can set to be zero trust by default
between the services, so that any communication will require
explicit policies, and then mutual TRS is enforced
by default. And once you have configured the policies,
CSM can allow you to centrally manage and monitor and control
Service-to-Service traffic, and alert any policy violation.
So this is how with a microservice-focused platform
CSM, it's much simpler to both create
and do ongoing monitoring of network security policies.
RETO MEIER: So how does moving into a hybrid cloud environment
impact security?
RAE WANG: So moving to hybrid environment, especially
with protocol Anthos, means you now
have a consistent control plane between on-prem and cloud.
It gives you a single admin experience
in a single pane of glass, which makes it much simpler to have
central visibility and control across hybrid deployments.
And then you can also start using
some of the Google Security capabilities
even for on-prem workloads.
For example, products like Binary Authorization
or Anthos Config Management now work for on-prem as well.
And, of course, another benefit of using hybrid platform
is that helps your workloads to get cloud ready,
because containers are portable and the admin may experience
the same.
So when it comes time to migrate,
it's a very straightforward process.
And, of course, once your workloads migrate to cloud,
we offer you additional security values, things like [INAUDIBLE]
VMs or zero downtime patching through light migration,
even when there are really big hardware vulnerabilities,
like Spectre and Meltdown.
STEPHANIE WONG: You mentioned security consistency.
What are some of the best practices
to ensure a security baseline with consistency
and reproducibility for all of your resources in the cloud?
RAE WANG: Great question.
We know that security is kind of a shared responsibility.
We do our part and customers do their parts.
So, in a platform, we offer a lot of security capability
so that customers can start on a much higher baseline.
But at the same time, we also make sure
that your part of responsibility becomes easy as well,
and that's often down through templatized deployments,
central config and policy management, and ongoing
monitoring and learning.
So in terms of deployments, by using community-style API,
you can express your configurations
as declarative templates.
Then Anthos Config Management gives you
a central source of truth for these templates
and allow you to deploy the config and policy
updates by GitOps and [INAUDIBLE] best practices.
These changes then get deployed to across RFA Clusters
and measures an environment to ensure consistency.
And when it comes to constraints, a couple
frameworks, Gatekeeper, policy controller, and facility config
validators that we're actually developing the open source
with communities.
They allow admins to standardize configurations
across your entire organization.
You can, for example, set guardrails by presubmit checks
in your release pipeline so that misconfiguration cannot get
into the deployment process.
And then, in case drift happens in production,
you can also set alerts so they can get notified.
For monitoring, we also have Cloud [INAUDIBLE] and Cloud
Security Command Center.
They give you a central view of the state
of RFA resources in production and then
can notify you of changes and risks and security findings
as well.
So, together, these tools help you
through the lifecycle of managing your security config
settings.
RETO MEIER: That's fantastic.
Can you talk a little bit about declarative configs
to make security controls consistent across scale
diverse environments.
RAE WANG: We all know one of the most costly mistakes an admin
can make is misconfiguration.
It's almost far too easy to accidentally set your IM
controls to be to be public or make your network configuration
to be way too permissive.
And when you do that, you open up your sensitive resource
to attacks and data leaks.
So this is where the declarative config makes a difference.
Because it helps the admin to focus on the end goal,
the end state.
And then allow you to offload the intermediate orchestration
and workflows and keeping up consistencies, really,
to the platform.
And then when we do that across a lot of resources,
across many clusters and measures,
we basically achieve reproducibility and recovery
from drift.
And therefore they reduce the complexity
of applying security controls.
And they also make it much easier
to share security best practices because you can deploy
template solutions.
STEPHANIE WONG: And not only is it
important to declare the security
configs across your environments,
but also monitor inevitable risks.
So we have a big launch, as you mentioned,
Cloud Security Command Center.
How do we help customers get visibility
into risk in their environments?
RAE WANG: We're very excited about Cloud Security Command
Center, because it kind of unifies the security detections
from Google together with a lot of the key third party
detections for the main central place
and really help the admins to build them, analyze them,
and take actions in place.
For example, one of the capabilities
is security house analytics.
It scans and detects over 20 common vulnerabilities,
from publicly exposed storage buckets,
to talk about overly permissive firewall rules,
to misconfigured Kubernetes clusters, and so on.
And similarly, you have Cloud anomaly detection.
It automatically detects some of the key threats
from cryptojacking to exposed service credentials,
to outbound DDoS.
And then with this GA release, another benefit you get
is now Cloud SEC unifies security findings
from a variety of Google Cloud products,
from event threat detection to binary authorization,
to cloud asset inventory, to [INAUDIBLE] and so on.
How you can use it, well, if you're in a [INAUDIBLE] company
and you have a finance department, for example that
stores credit card information and sensitive personal data,
you can use Cloud SEC to scan the infrastructure used
for storing these sensitive information, identifying
your vulnerabilities, as well as finding active threats that
are targeting these vulnerabilities.
And then there's a lot of findings.
So we give you a way to manage and organize these findings
by attaching business context to the findings and resources
by our code security marks.
And then we all know that getting the data
is the first step.
What you really want to do is to improve your security poster
validator.
So Cloud SEC also allows you to actually respond to take
actions by, for example, triggering alerts or creating
[INAUDIBLE] incidents, or directly executing remediation
operations by cloud functions, .
STEPHANIE WONG: Great, thanks, Rae.
Your insights into security will continue
to be vital to any company that wants to build and grow
quickly.
RAE WANG: Thank you.
[MUSIC PLAYING]