MAX SALTONSTALL: With almost 500 sessions at Next 2018,
it's understandable that you couldn't get to them all.
So if you didn't see Implementing Fintech
Security in the Cloud, then stay tuned
because here's the rewind.
[MUSIC PLAYING]
Moving your company's workloads to the public cloud
can be scary.
It feels like a huge security risk,
and often, you're dealing with your most closely
guarded intellectual property.
To succeed at migrating, you need to figure out
how to protect your IP from theft or attack,
while also making sure your stakeholders
can get access to the data they need.
Let's see how Two Sigma did it, start to finish.
Based in New York, Two Sigma is a tech-driven investment
company that's moving to the cloud,
while also juggling the needs of internal modelers, developers,
and security teams, alongside external communities of users
and developers.
We'll walk through how they created a secure Google Cloud
Platform architecture, opening up new opportunities for scale
that they could not achieve with on-premise solutions.
They begin, like any of us, with a brand new GCP
account and a super admin identity or two.
Of course, they have existing on premise resources,
including their authoritative identity provider,
in this case, Active Directory.
Then, they create a few compute and storage resources.
Securing those cloud assets requires good policies.
In this case, we'll use identity and access management policies
to restrict who can access storage buckets,
compute instances, and both front and back end
applications, even before we create any substantive content.
As we continue to build and secure this architecture,
we repeatedly ask ourselves, what have we secured
and what are the existing concerns?
What's still vulnerable, or what could be abused?
Where do we have opportunities to improve our ability
to audit?
And how can we make things easier for our stakeholders?
Let's take your super admin accounts.
These are very, very powerful and need strong protections
because they could do almost anything with your data, which
is why leveraging security keys is
essential for these high value accounts.
Or maybe all accounts?
Security keys guard against phishing more effectively
than alternate second factors.
That's because you can't fool a security key with a fake domain
or a fake certificate.
We've seen tremendous benefits at Google from using them,
and many clients utilize this open standard
to safeguard their accounts too.
Even when accounts are very secure,
people can leak your company's data accidentally.
You can prevent this with org-wide policies,
in this case, preventing any resource
from be accessed by anybody outside the domain.
Going even further, we've created a virtual private cloud
construct inside our GCP architecture
so that no app data inside the VPC
can be accessed from anything outside.
This creates a strong network boundary
and prevents data from going to another GCP project which
could leak it.
Keeping your data safe also requires preventing employees
from exfiltrating data.
To prevent a malicious insider from moving data from one GCP
resource to another, you can restrict all resources
inside your VPC to be accessible only to other resources
inside the same VPC.
On top of this, you can use Identity-Aware Proxy
to allow specific people to access the VPC
resources from anywhere on the internet,
especially useful for contractors or remote workers
who need to connect to these systems
from outside your office environment.
IAP restricts access based on identity,
so you choose who gets access, rather than getting access
based on where someone sits.
Now that you've got a great security setup,
you're done, right?
If things do go wrong, and they probably will sometime,
you'll need to find out what happened and when.
We'll use Stackdriver to manage logs, tracking
what happened every step of the way
so you can investigate after an incident.
To get a view of your overall security status,
we'll use Cloud Security Command Center
to aggregate your security metrics
into a single dashboard.
And we'll use Forseti to increase your automation
around security policy application and monitoring
so new projects will adhere to the same security standards.
Securing your GCP resources relies
on layering policies and good architecture practices
and is possible even if you're starting from scratch,
as you've seen here.
Thanks for watching.
You can see the full talk link in the description below.
Subscribe to the Cloud YouTube channel for more Next Rewind
videos.
[MUSIC PLAYING]