[MUSIC PLAYING]
SHREE REDDY: Welcome to Google Cloud Next '22.
I hope you've had a chance to check out
some interesting sessions.
This is a joint session between Google Cloud, Palo Alto
Networks, and Deloitte.
We'll be discussing Deloitte's approach for enterprises
to secure SAP workloads on Google Cloud
by adopting a framework that includes
security capabilities supported by Google Cloud and Palo Alto
Networks.
I'm Shree Reddy, Security Customer Engineer
with Google Cloud.
And I'm excited to introduce my co-presenters--
Pradeep Sandhu from Deloitte and Matt
Mclimans from Palo Alto Networks.
So our session will cover some key topics.
One, what does security mean in the context of SAP workloads?
Two, why Google Cloud for SAP?
What sets us apart?
Three, how can you think about augmenting
the security of your SAP deployments
with Palo Alto Network?
And finally, we'll bring it together
and walk through Deloitte's SAP on Cloud security framework,
and then provide you with a quick summary.
So the decision is final.
You're considering migrating your SAP systems to the cloud.
Let's go to Pradeep to walk us through what is top of mind,
typically, for enterprises who've made this decision?
Take, it away Pradeep.
PRADEEP SANDHU: Thank you, Shree.
So quick introduction-- Pradeep Sandhu.
And I'm a cloud security practitioner with Deloitte.
And my passion is to simplify the cloud adoption journey.
And in this case, we are talking about SAP migrations
to the cloud.
So in general, there is an acceleration
across the organization to move the SAP workloads to the cloud.
Now the big question is, what is driving that acceleration?
So there are two reasons I want to talk about.
Quickly, here, is one--
the scalability and the agility to reap
the benefits of the cloud by migrating SAP ERP to the Cloud.
And the second reason is the magic date
of 2027, which is the date when the SAP
ECC, or legacy versions support, would be ended by SAP--
though that date may change.
But there is the onset stress which enterprise leaders
do have today to migrate the SAP workers to the cloud
before that support ends.
So what is changing?
So there are three things which are changing.
One, customers will get more agility
as they migrate their workloads to the cloud.
They will get scalability and the cost optimisation.
But additionally, there would be increased
[? security ?] of attack surface, which would expand.
And understanding of shared responsibility
is of prime importance for security teams
and the engineers on the ground who would
be performing these migrations.
And the last, but not the least--
do organizations prepare for those security considerations
already?
And we will be talking about that
as part of the Deloitte framework in one
of the sections today.
Now if we go back a couple of years,
there was an inherent risk with cybersecurity leaders, SAP
leaders, or the business leaders were considering
before they were ready to migrate those SAP
applications to the cloud.
Now a couple of areas which already have demystified
is proliferation of sensitive data.
Leaders were not ready to migrate their applications
because they were concerned about the data security
of various applications.
Second, the core cloud security wasn't
ready at that point of time.
And cloud service providers like Google Cloud
have done great job in bringing those security services that
can solve for those cloud security concerns.
Compliance challenge was another concern,
because how cloud would be solving for compliance
and regulatory requirements, and if cloud can solve for that.
And Shree would be talking about compliance challenges
in the next couple of slides.
I will pass it on to Shree to talk
about how Google Cloud satisfies those security
requirements as you migrate your applications to the cloud.
Shree.
SHREE REDDY: Thanks, Pradeep.
So Pradeep talked about SAP being the crown
jewel for a lot of enterprises.
Why should you trust Google Cloud with your crown jewel?
There are some main areas of differentiation
that help SAP customers with migrating
the workloads to the cloud.
One, our modern infrastructure.
It's enterprise class ready.
It provides customers resiliency and flexibility.
Two, customers can easily integrate their SAP
applications with Google Cloud Services
to accelerate the pace of innovation
with our smart analytics capabilities.
Three, we bring the best of Google
to SAP customers with our industry leading
machine learning extensions.
And four, the foundation of it all
is everything runs on our global, secure, high
performance network.
Let's double click and deep dive into each of these.
Our first area of differentiation
is our platform--
think performance, reliability, and security.
All of these are necessary to ensure a smooth migration
and a consistent user experience,
no matter where the users are in the world.
We have our own privately owned global network.
We keep our customers' internet traffic on our highly reliable
network until it is as close as possible to the end consumer.
Our platform helps customers meet their stringent data
security and privacy controls.
We automatically encrypt data in transit and at rest by default.
Our second area of differentiation,
when it comes to running SAP, some of the things we help
customers with-- how to realize higher uptime for SAP systems,
how to quickly scale SAP at the speed
and need of their business, how to provide performance
that meets the needs of their critical business applications.
And finally, our focus is on operating a clean cloud.
Our third area of differentiation, smart
analytics.
Google Cloud offers the right platform
to build, deploy, and manage models that streamline
SAP-based analytics outcomes.
The BigQuery connector for SAP gives our customers
an easy solution to make their SAP data fully accessible
within our data warehouse solution, BigQuery.
Our platform can help you maximize the insights
you need to derive from your SAP data
with Google Cloud's AI, ML, and advanced analytics.
So to summarize, we have a platform
that helps customers with intelligent insights,
reduced risk, agile deployments, and sustainable operations--
all of which are necessary to ensure a smooth migration
to the cloud.
But when it comes to security, we've
already talked about some of the features built
into Google Cloud.
We took an approach to partner with Palo Alto Networks,
one of the leaders in security, to augment our security
capabilities.
Matt will walk us through how our security solutions come
together to address customer needs Matt, over to you.
MATT MCLIMANS: Thanks, Shree.
So I'm Matt Mclimans.
I'm a Field CTO at Palo Alto Networks.
And I'm a part of our Google Cloud alliance team.
And the team I'm a part of focuses
on creating technical integrations between Google
Cloud and Palo Alto Networks.
So I would be remiss if I didn't briefly
discuss the Google Cloud and Palo Alto Networks partnership.
And for the last half decade or so,
Palo Alto Networks has been given a variety of awards,
including Google Cloud's Global Technology Partner of the Year.
And now, we're obviously very proud and grateful
for the partnership, because the award is really
given on our mutual commitment to delivering a shared
vision for the evolution of cybersecurity to our customers.
And internally, we call our model, our strategic model
Better Together.
And at the core of this is really just the acknowledgment
that we are far more complementary
than we are competitive.
And when we collaborate on the strengths of our products,
it's our customers who are the ones who
receive the net benefit.
So over the years, we've completed over 50 integrations,
and we're always trying to set the bar a little bit higher
with each one.
Recently we've integrated our advanced endpoint protection,
Cortex XDR, with Google Cloud BeyondCorp
to deliver zero trust security between the endpoint and SaaS
applications.
Or we've developed really deep integrations
that have taken months and years of planning and development
across our product management engineering teams,
like Google Cloud IDS--
which combines our industry-leading threat
detection technologies, but with the simplicity and scale
that you receive when you use a native Google Cloud service.
All these integrations over the years
have certainly played a role in making Palo Alto Networks
the security partner of choice across enterprises
within every vertical.
So this brings us to the Palo Alto Networks platform
offerings that provide best of breed cybersecurity
across network, endpoint, and cloud, where each platform can
be easily consumed and delivered to any location
within the enterprise.
Now, we don't have time to discuss
each platform in detail, but to go over them at a high level,
we first have PRISMA CLOUD, which
is our cloud native security platform that
enables you to secure cloud infrastructure and native cloud
applications to gain centralized visibility
and detect threats across the entire cloud estate.
It also provides this visibility through technologies
like code and cloud workload protections, IAM security,
and identity-based microsegmentation.
Then we have CORTEX, which integrates
across all of our platforms.
And it provides advanced endpoint protection,
attack surface management, and security automation
capabilities that really enables you
to build a highly efficient SOC that
can spend time focusing on the highest severity security
events.
And then this is followed by our STRATA platform, which
consists of our machine learning next-generation firewalls,
or NGFW.
And they provide complete network security
by safely enabling applications with layer 7 controls,
control which users are using those applications
and then inspect the content across the applications using
our threat security services.
So now let's quickly walk through
a couple of examples of how we can
use different parts of our platform to secure ASAP
environment and Google Cloud.
First, we have our next generation firewalls,
which come in a variety of form factors.
And this gives you the choice on how
you want to consume our network security capabilities.
The first is the PA series, which is our physical firewall.
This can secure the data center itself
and can also secure traffic between your data
center and your Google SAP environment.
Given the PA series's high performance benchmark,
it's really common to see it directly
in line with your interconnect connection as well.
Then, we have the virtualized form factor
of this with the VM series, which
can be deployed and scaled on Compute Engine
to secure internet traffic to and from the SAP environment
and also prevent lateral threats moving among your VPC networks.
And if your organization is in the process of refactoring
and rebuilding your applications to run as containers using GKE
or Google Anthos, the CN series is our containerized form
factor that can be deployed as a pod in order
to secure cluster traffic.
And then, lastly and certainly not
least, with about a half dozen clicks,
you can turn on Google Cloud IDS, which
enables you to see all different applications
and detect threats that are moving
among your connected cloud networks.
We can then extend our capabilities to the edge
with Prisma Saasi, which combines our next generation
firewall prevention and SD-WAN capabilities
into a single cloud-delivered platform, which
enables you to reliably connect remote networks
and remote users securely around the globe
to your SAP environment.
Then we can use Prisma Cloud.
And unlike the next generation firewalls,
Prisma Cloud does not sit in line with traffic,
but instead ingests data via API calls
to display the configuration and compliance
status of the SAP tenant.
And then lastly, we can deploy Cortex XDR agents
to safeguard SAP endpoints from malware, exploits,
and even BIOS attacks.
Cortex uses machine learning models
and behavioral analytics, which is fed with information
from the network, the endpoint, and third party services,
like Google Chronicle.
And this enables you to automatically identify
unknown threats and even highly evasive
threats from targeting the network.
And here's a list of some of our products.
We'll have links at the end for more information.
Here I'll pass it back to Pradeep
to talk about Deloitte's cyber risk framework for SAP.
Pradeep?
PRADEEP SANDHU: Thank you, Matt.
On the next couple of slides, we will
be talking about the framework.
But before we dive into the framework,
I want to talk about what it looks like to secure
SAP workload in the cloud.
And the journey starts from strategy, development, testing,
and through operate.
And in summary, we can call it a secure-by-design concept,
which we really need to bring it to life, leveraging Palo Alto
services and Google Cloud native services, all
the native capabilities on the ground.
So to start with, I would touch upon quickly about strategy.
As you're defining the strategy for SAP,
you need to consider what kind of data protection and privacy
plan you have, how you would be implementing the threat
modeling, and the further secure development
using Google services repositories, and then
static and dynamic application testing,
and securely deploying the code for the protection.
And last but not the least, how would we
implementing the detect and response capabilities
in general to start managing your SAP
workloads in the Cloud?
Overall I would call it out here as,
this is an opportunity for SAP and the technology leaders
to implement secure-by-design principle to the real life,
leveraging the various services which could be the cloud native
services as well.
To simplify this complexity, we have eight cyber risk domains
that would solve for the overall complexity of SAP ERP security
in the cloud.
It starts with governance, risk, and compliance,
where we would look into what kind of controls,
or what kind of additional security controls you need,
what kind of regulatory compliance
you need to consider as you're prepping your secure landing
zone-- or you can call it the cloud foundation for your SAP
workloads.
Then goes into the application security--
how you would be writing the code securely,
how you would be integrating infrastructure as code,
attribute based access controls, and so on and so forth.
And then, touching upon identity and access--
network security, which Matt explained it at a deeper level,
both for [? later ?] detection as well
as how you would be securing the perimeter for any time,
anywhere access.
Going into the data privacy and protection,
that needs additional considerations
on data security from the key management standpoint
or the Certificate Management, including the DLP, which
can mask your sensitive data for those to save the data
from those threat actors there.
And last but not the least, monitoring and response
business continuity and DR are additional considerations
because once you are running 100% in the cloud, how
you would be detecting proactively
those issues and concerns with your SAP workloads?
Additionally, leveraging some capabilities,
we would be talking about in a bit on the next slide
as part of the leading practices--
how we can get there.
So as I mentioned, as at Deloitte,
leveraging the framework, which we spoke on the previous slide,
we implemented-- or we have been implementing
SAP on Google Cloud for our multiple customers.
As we did that, or as we are doing it,
there are some leading practices which
we captured for you, which we thought
it would be helpful as you are taking on this journey.
So the first leading practice is have a security roadmap
and a framework which you can count upon
to stay your teams on course.
That is one.
Second is have a reference architecture which can give you
the bigger picture in mind, but at the same time,
would provide you the ability to execute
on tactical implementation.
Leading practice number three, opportunity
to start or implement your zero trust architecture
with Palo Alto services.
And the practice number four is have upfront consideration
for compliance and regulatory, because this
is an opportunity where you can identify the security
controls, regulatory requirements,
and how you would be testing, tracking, and reporting
on those requirements upfront, rather than later
on catching up on those.
Leading practice number five is shift left security, which
we spoke on one of the slides earlier--
like, right from strategy to operations,
you have an opportunity to leverage Google Cloud native
services and Palo Alto security services stack
to implement the security shift left.
And last, but not the least is predictive detect and respond
capabilities.
We have been deploying Chronicle, [? SSE ?] Premium
and Simplify for our SAP clients.
That is enabling the implementation
of predictive detect and response capabilities
as enterprise clients are moving their SAP
workloads on the cloud.
So to summarize it, I will pass it back to Shree.
And Shree can talk us through overall key takeaways
from this session.
Shree, after you.
SHREE REDDY: Thanks, Pradeep.
Thanks, Matt.
Thank you for your insights today.
And thanks to Palo Alto Networks and Deloitte
for the collaboration.
So to summarize here, some of the key takeaways.
What are some of the key factors to keep in mind when migrating
your workloads to the Cloud?
Assess the security threat exposure in your environment.
Adopt a zero trust framework.
Leverage the native capabilities offered through Google Cloud
and Palo Alto Networks.
Define the right security governance and compliance
processes for your environment.
Implement predictive analytics and integrated solutions.
That's all we have for you today.
Thank you so much for joining us today.
And have a wonderful Next '22.
[MUSIC PLAYING]