[MUSIC PLAYING]
ANDY WEN: Welcome.
I'm excited to talk to you today about how
you can make zero trust a reality with Google Workspace
security.
Hi.
I'm Andy Wen, director of product management
for workspace security compliance and privacy,
and I'm thrilled to be here today with you all.
My background and passions lie in security.
A huge part of my career has been
devoted to protecting all of our end users on the internet
and around the world from abuse and attacks.
Prior to my time in Google Workspace,
I led a team at Google that would use threat intelligence
from the over 300 products in our Google ecosystem
to protect over 3 billion consumers and enterprise users
from malware, phishing, and other common cybersecurity
attacks.
And today, I dedicate all my time
on helping enterprises keep their corporation, their data,
and their end users safe and productive
as they work on Workspace and other cloud-based applications
on the internet.
From my background in keeping 3 billion plus end users
safe as they work, collaborate, and use the internet,
Google is experienced and has invented new ways
for our advanced security to automatically protect
organizations and end users' user products.
New threats and bad actors are constantly evolving,
yet protecting our massive 3 billion
user user base gives us insights into the trends that
are present in the landscape and what's coming.
With that, we can get ahead of them.
We aggregate billions of signals in an anonymized way
and apply our advanced AI to train our machine
learning models for threat protection capabilities.
No one else has the combination of signals and experience in AI
to protect you and your organization.
That's why we do things like stop
99.9% of phishing and malware attempts in Gmail,
or block over 100 million spam messages in Gmail from reading
reaching customers.
Google keeps more people safe online
than anyone else in the world, and we use this capability
to protect your enterprise from malware, phishing, spam,
and many other kinds of cyberattacks.
And so now, we can turn a bit more
toward the new normal style of working.
At Google, we wanted to secure our own way of being
productive with collaborative applications for our own use,
and this allowed us to pioneer the development of what
is now called zero trust.
We believe zero trust is the best
model to protect our new normal style of working
in a hybrid and distributed workforce.
There are really three key principles.
The first is to eliminate privileged networks.
Just because you're on a certain network
should not give you access to a specific resource.
The second is ensuring you know who all the users
and devices on your network are and who can access resource,
and doing so with continuous authorization
and authentication.
The way we've constructed our zero-trust framework
within Google Workspace is very much aligned
with the NIST and CISA framework around zero trust
to eliminate implicit trust and continuously validate
interactions at every step.
It all starts with these four key pillars.
The first is around users.
And what we want to do with this is really set up security zones
where you can enable higher strength
protections for your riskiest users and your data.
So with users, you can create high risk groups
that you require increased credential strength.
This might be users who typically access
sensitive data, and you want them
to have a higher level of credential strength
and authentication.
The next would be devices.
You may want to make sure that any sensitive data that's
being accessed is only done so from a managed
device or browser with the correct configuration.
So our posture control enables you to do that.
We can even allow you to set certain certificates
as required before access is allowed.
The third is around security context.
The environment, the threat landscape around us
is always changing, and as phishing and malware
impact your users, we can enable increased credential protection
that we'll get into in just a few minutes, all
automatically, without you needing to take a step.
And then, we provide increased visibility and analytics
around what's happening to your users all the time.
And the last one is very important around setting
the boundary around your applications and your data.
This really enables you, as an administrator and company
owner, to set boundaries around your sensitive data via DLP
and labels.
It's a bit like a bank.
Sometimes, you put the most sensitive things in the vault.
In the same way, you can define what's
the most sensitive data in your enterprise
and put it in a vault and ensure that it requires
additional verification, authentication,
and other security controls before it can be accessed.
This enables you to have an incredibly
dynamic and effective means to protect your sensitive data.
And just to give you a sense of Google's journey on this,
Google started this journey in 2011
when we saw the need to approach security
in a completely new way, to protect ourselves from attacks.
We built BeyondCorp as a zero-trust model
over a decade ago, and since then, we've
embedded zero-trust principles into how
we build all of our products, including Google Workspace.
And this has enabled us to be able to launch
a platform called BeyondCorp Enterprise so
that every company can work like Google.
In Google Workspace, our security
is anchored around three core zero-trust principles.
First is ensuring you have secure collaboration by design.
It doesn't require additional steps
and doesn't require bolt-on products.
The second is real-time, advanced threat protection.
You need to ensure you have the very best threat protection
built into your products.
And the third is having enterprise-grade data
protection and privacy for all.
So let's start on the first one, secure collaboration by design.
The first is ensuring that you can
be productive from anywhere, whether you're
at home or in the office, but also what devices you're
using, particularly around mobile devices like iOS
and Android.
Second is ensuring you have persistent data control.
You want to make sure that your sensitive data stays where
it should, rather than floating around
in attachments or third party storage applications.
We offer comprehensive end-to-end data control,
so that the point that the data is created, shared, accessed,
and even after it's been accessed,
you have flexible access management and data control
capabilities.
And the third is about ensuring security is easy for your end
users to access.
IT has to work incredibly hard to avoid
disrupting their end users' productivity,
but sometimes you have to make policy changes,
and you have to provide additional training.
So it's great when the end user product
offers nudges to help educate your users on how
to do the right thing.
Now we're going to talk about that
with Chat DLP in just a moment.
So as we turn to some of our major product announcements,
we want to announce that DLP for Google Chat
is going generally available.
And this is really attractive from a number of perspectives,
for both our IT and end users.
For IT, you now know DLP is baked into the Chat
infrastructure, so it covers all the messages
that are happening, and it happens at very low latency.
So it doesn't disrupt end user productivity.
Then, we have over 100 out-of-the-box detectors that
detect different kinds of sensitive information,
and we even included the ability to do OCR--
optical character recognition-- to detect
images that have sensitive data inside them.
Then, for our end users, we want to provide the opportunity
to educate end users so they would understand, what is PII,
and what is credit card information,
and provide them warning messages
so they can understand why certain data is being blocked.
And they can be partners with you in your security journey.
In another aspect of secure collaboration,
we're making it easier than ever to control
your internal and external collaboration
and sharing with Trust Rules for Drive.
That is also going generally available.
You may have scenarios where you have
to control private information from being
shared within the company, as well as outside the company.
You may need to do this for compliance
with public company requirements,
as well as protecting your brand reputation
and avoiding potential fines.
So here's two scenarios.
The first is a finance team that controls data
like financials that needs to be kept within that team,
or to a few other companion teams like executives.
But you don't want that shared across the company.
With Trust Rules, you can create a boundary within your company.
Then, you may have external sharing that you actually
do want to allow.
If you have a marketing team that's
working with entrusted agency, and you
want to enable external sharing between those two teams,
but you don't want to allow broad external sharing
between all of your users, and so Trust Rules
can enable you to do that as well.
Whatever your needs are, Trust Rules
enables you to define the trust-sharing boundaries
that you need to meet your business needs
as well as protect your reputation
and your sensitive data.
The next one is very exciting as well,
in terms of how we're advancing data loss protection,
and we're doing this with Google's leading
artificial intelligence.
The problem that our AI approach is solving
is that DLP traditionally has only
identified specific patterns that
are known, like Social Security numbers, credit card
numbers, and other content that has clear patterns.
But within each company, you may have large classes of data
that doesn't fit a pattern.
This could be something like confidential data,
need to know, or proprietary.
And this is actually unique to each company,
and it's very difficult to write rules for these.
So now, starting in Q1, you can build your own models
with Google's A's latest innovations.
We call this the Few-Shot Text Classification Model.
What this enables you to do is, with a limited training data
set, without a data scientist, to be
able to create your own models that
identify what's confidential, what's need to know,
or what is a certain label of your own
making unique to your enterprise.
And it's private only for your company.
This has the potential to really widen your DLP program
to new levels without creating unnecessary user friction,
and we're very excited about bringing the best of Google AI
to help your company control your sensitive information.
And also, as part of real-time alerting,
we're consolidating all our audit logs in one place
so they're easy to use, and we're
adding real-time capability for Gmail detections, which
enables you to stay on top of security threats
as they happen.
In our device pillar, we are making it easier than ever
for you to ensure sensitive data stays in your Workspace
instance, rather than leaking to employee devices.
When that happens, lost devices can also
lead to lost sensitive customer data.
We can also prevent insiders from mass downloading customer
data with multiple mobile devices.
For iOS, we've added copy, paste, and download controls.
For Android, which has already had these capabilities,
we're adding much easier enrollment experiences that
include zero-trust enrollment, as well as customizations
around password complexity.
And with our real-time advanced threat protection,
we're always innovating on the newest and latest ways
to find threats.
When we find these, these are automatically
updated in your Workspace instance.
You don't need to do anything, and you're
safe from emerging threats.
These threats even include attacks
that can come from other Cloud platforms,
even Google Cloud platform as an attack vector.
So we're always looking at every route
that your users and your company could be attacked.
And we use all of these real-time threat protections
to protect you automatically.
In this case, with our secure authentication,
we can identify risky events based on suspicious login
patterns and re authenticate with 2-step verification,
or additional forms of authentication.
An example of this is hijackers often
want to set up an email filter to send themselves information
from a user's account.
This is a key sensitive action that
is protected with our automated risk-based re-authentication.
And we want you to know that our rigorous compliance is built
into the core of Workspace.
It doesn't have to be in a separate gov cloud that
limits your collaboration, in which users
you can collaborate with.
And it doesn't have--
and Workspace has the latest features.
If you'd like to learn more about this,
you can watch our talk on sovereign controls
for Workspace, and there you can learn about
our access controls, our regional storage,
and processing, as well as client-side encryption.
And just to highlight on client-side encryption,
this makes you the ultimate arbiter
of all access to your data.
It helps data stay as private as private
gets, with a private key that only you get and Google never
sees.
We are offering client-side encryption capabilities
across our suite, from Drive, Docs, Sheets, Slides, and Meet,
which are already generally available,
and we have Gmail and Calendar coming soon.
This enables you to control your data.
So from device to device, you are
assured that, with your private key,
no one else-- not even Google-- can see your data.
Now we have Mark Eimer, who's the CTO of Hackensack Meridian
Health, and he's going to come share
with us about his zero-trust journey
and how Google Workspace and Google Cloud are part of this.
Mark, love to hear about your journey.
MARK EIMER: Hey, thanks, Andy.
Thanks for having me on.
Yeah.
As you can imagine, Hackensack Meridian Health
is the largest health care provider in New Jersey,
and because of that, we deal with a lot
of restricted and confidential data.
So in March of 2021, when we moved over to Google Workspace,
and we had 30% reduction in spam because of the AI in Gmail,
and we had reduced phishing attacks coming across,
it was a great surprise to all of us,
just based on the additional security capabilities
that the platform brought us.
Now, Workspace was a great start for us,
but we're also focusing on identity governance,
like you talked about with users.
So trying to make sure that our 36,000 employees and our 7,000
physicians have access to the right data
at the right time with the right privilege is very key to us.
Nobody wants a breach, and so being able
and ensuring that we have a zero trust-- and to your point,
it is a journey.
We're not there yet.
It's more of a dimmer switch for us.
But Google Workspace was a great part
of our beginning of our journey to get to zero trust.
ANDY WEN: Thanks so much, Mark.
And could you share more about how BeyondCorp Enterprise is
part of your journey as well?
MARK EIMER: Yes.
So BeyondCorp Enterprise is going
to be a great asset in the toolbox for us.
Again, because we are health care
and we deal with confidential and restricted data--
and I do have a large research organization
that does do business outside of the continental US.
Because we've taken a very draconian process
and geo-blocked over 240 countries,
we'll now be able to use the advanced firewall
features of BeyondCorp and move to a much more modern way
of giving our researchers and our employees
the right access to the right data at the right time,
in whichever country they need to do business with.
So it's going to be a great enabler for us
as we move forward in our zero-trust journey.
ANDY WEN: Mark, it's so great to be here how zero trust is both
keeping your enterprise to be more safe as well as more
flexible and productive.
Thanks so much for sharing.
MARK EIMER: No, thank you.
ANDY WEN: And as we recap our time together,
we want to emphasize the way that you
can secure the way you work with Google Workspace Security.
And you can also extend your protection in zero trust
to other apps using BeyondCorp Enterprise.
It enables you to easily extend your protections
to other parts of your apps, like SaaS and private apps.
And third, as we address broader security challenges
through our Work Safer program, that
enables other Google products and third-party
best of breed products to enhance your security.
From Chronicle, which does security event management,
as well as CrowdStrike, Netskope,
and Palo Alto networks.
And just to give you a sense, you
can start building your zero-trust program
on Google Workspace today with a number of the controls
that you see here on the left.
And then you can easily extend them
with Beyond Corp Enterprise into the rest of your IT
infrastructure.
We're so excited that you joined us here to learn more
about zero trust and Workspace.
We encourage you to come and watch our Beyond Corp
Enterprise session, where you can
learn how you can extend that.
You can also learn more about digital sovereignty
and client-side encryption in our digital sovereignty
session.
And finally, you can start your journey today
with Google Workspace on zero trust.
Thank you.
[MUSIC PLAYING]