[MUSIC PLAYING]
SUNIL POTTI: Hello, everyone.
Thank you for joining me and the entire Google Cloud team today.
And a special welcome for what's next for security
professionals.
My name is Sunil Potti, and I'm the VP and General Manager
for Google Cloud Security.
As many of you know, organizations large and small
are realizing that digital transformation and the changing
threat landscape requires a ground-up security
transformation.
Attacker's tactics, techniques, and procedures
have evolved as their targets have shifted
and their desired outcomes have changed.
So long gone are the days of a limited number
of malicious nation state actors only targeting
specific governments or critical infrastructure.
These days, the new normal is persistent attacks
and off-the-shelf attack tooling leveraged
by sophisticated threat actor gangs and nation states.
And these folks are primarily focused on financial gain
and business disruption across the mainstream enterprise,
from the mid-market credit union bank to a very large enterprise
in the Fortune 500.
And to tell us more, directly from the front lines,
I would like to welcome Sandra Joyce,
Mandiant's EVP of Intelligence and Government Affairs.
And it's my great honor to introduce her
and the entire Mandiant family to Google
since the recent acquisition.
Sandra.
SANDRA JOYCE: Thank you, Sunil, and greetings
to our audience at Google Next.
As a new member of Google Cloud family,
Mandiant brings expertise and threat
intelligence and consulting to double down
on Google's commitment to security.
At Mandiant Threat Intelligence, we're always vigilant,
tracking threat actors across the cyber domain
as they seek to spy, steal, and sabotage
the networks of organizations around the world.
While cyber attacks used to play out completely
behind closed doors, the threat has changed.
And we're seeing an enormous amount of activity
in full public view.
State and criminal adversaries aren't just quietly
hacking victims.
They're creating public spectacles,
which are designed to undermine the credibility of institutions
and companies.
Despite rumors to the contrary, ransomware is not dead.
Those actors are still going strong,
but the nature of their activity is always changing.
Criminals simply need to find some way, any way,
to compel victims to pay.
These actors know they're undermining
the businesses they target, and they will not just
stop at leaks.
We've seen these criminals reach out to partners or customers
or even to the media to garner interest in the leak
and create public pressure for the victim.
Unfortunately, many businesses find themselves
in the impossible position of having
to make a decision about preserving their data
and/or acquiescing to threat actors.
Nation state actors are playing a very similar game.
A recent major attack on Albania included network disruption
and leaked information similar to what you might
see in many criminal cases.
These governments are taking a page out
of the cybercriminal playbook.
But not all cyber activities are as straightforward.
Information operations seek to target the hearts and minds
of their audience, and threat actors
use the cyber domain to carry out these types of campaigns.
The information operations we see
are designed to attack institutions
like governments, alliances, or even democracy itself.
We're now even seeing these nation states
use information operations to target competing companies.
For instance, an information operations
we call Dragon Bridge has been posting on social media
as residents living near a mineral processing facility.
These fabricated online personas complain about the facility
in order to stop competition of their countries' activities.
They use influence operations to bolster their countries' market
share while attacking competitors with influence
operations.
There are a lot of things driving threat actors
to their targets.
Some victims are targets of opportunity
that are compromised by actors.
Our supply chain has already proven
to be an effective means of gaining access
to downstream victims, and aggregated access
has been abused by both criminals and nation states
to great effect.
APT 29 is targeting technology companies
to gain access to their customers.
In Ukraine, broad access has been
abused to great effect in a destructive attack.
What kind of big data might interest an adversary?
Data that might be used to track people, for instance.
We've seen threat actors compromise hospitality,
airlines, and other travel resources
to track people of interest.
APT 39, one threat actor that we track,
has a history of targeting people directly
with spear phishing attempts, but they also
target organizations with data on their victims,
a potentially more fruitful and efficient means
of doing business.
Another threat actor, APT 42, targets dissidents, activists,
journalists, and academics who are critical of that country's
activities.
It is our mission to ensure that these activities are called out
and provide defenders the tools and intelligence
that they need to detect, block, prioritize,
and respond to threats.
Mandiant and Google Cloud share a strong commitment to security
and will work together to keep our customers, defenders,
and the entire global community safe.
Back to you, Sunil.
Thank you so much.
SUNIL POTTI: Thanks, Sandra.
I'm so excited that you and the Mandiant
team alongside the threat intel team are joining Google Cloud.
Now, as many of you know, Mandiant clearly
shares our mission to reinvent how
enterprises detect and respond to threats and incidents.
Mandiant's products, services, and expertise
will all combine to enhance our Google Cloud security portfolio
and amplify our joint vision to keep customers safe.
Now, here at Google Cloud, we continue
to champion invisible security to help
you move from today's reality, where security is bolted on
as an afterthought, to a future where Cloud security is
engineered and operations are simplified and shared
responsibility evolves to a model of shared fate
where the Cloud provider has true skin in the game.
Now, you might be asking, why invisible security now?
As you heard from Sandra, mitigating advanced and
persistent threats can be difficult for enterprises
if they don't have the resources.
The talent or the security engineering capabilities
of a Google or a handful of other cutting-edge
organizations is ultimately what keeps
some of these actors at bay.
So that begets the question, are these mainstream enterprises--
can they ever be protected unless they can be like Google?
And imagine if enterprises of all sizes
could re-platform on the same Cloud, use the same tools,
and use the same best practices that protect Google.
That's essentially what we're doing with Google Cloud.
And so, first, we are helping enterprises become Google
by providing the industry's most trusted Cloud.
And at the same time, knowing that most enterprises will
take a while before they fully adopt Cloud,
we are bringing the best of Google
to enterprises with security solutions
for your on-prem, private, or multi-cloud environments.
And we are helping organizations address
these top of mind security initiatives across a variety
of dimensions, starting with Cloud governance
and digital sovereignty.
Now, as most of you know, digital sovereignty
has become top of mind for many of you internationally.
Governance and sovereignty are global issues with regulations
and many unique compliance requirements
across a wide set of regions.
So the core of Google's and Google Cloud's approach
is putting our Clood controls in your hands.
So this goes above and beyond data location and protection
from external access.
It includes predefined residency controls as well as
a shared workloads.
And as most of you know, we have been
focused on strengthening our Sovereign Cloud with trusted
partnerships.
And in addition to T-Systems for Germany,
we have now embarked on deep and strategic alliances
with Thales from France, Telecom Italia for Italy,
and Minsait for Spain and many more to come.
So now, while sovereignty is key,
managing and understanding Cloud posture and risk
is essential to a wholesome experience in Cloud.
Now, we help teams understand their Google Cloud security
posture and risk profile by incorporating world class
innovations starting with foreseeti,
a recent groundbreaking technology and an acquisition
into security command center.
With this new addition, you can now fully understand
your attack posture.
You can prioritize and contextualize
vulnerability findings.
But that's not all because you can now step ahead,
and, with foreseeti built into SCC,
it allows us to provide advanced attack path simulations so you
can apply targeted actions before attackers
can take advantage of high risk vulnerabilities.
So in addition to governance and Cloud risk management on GCP,
another area that needs to be reimagined
by the CISO and the entire security team
is security operations all up-- across all your environments,
Cloud and on-premise.
And on this journey, instead of having
siloed SIEM and SOAR and threat intel solutions,
our new Google Cloud Security Operations solution
converges security operations capabilities
so that security teams can now pivot faster and manage alerts
more effectively between Chronicle SIEM, SOAR,
and our best-in-class threat Intel.
And with the addition of Mandiant's leading incident
response services, in-depth threat intelligence
gained from the front lines, and Mandiant's Advantage platform,
all of these will collectively help
us accelerate your security operations transformation.
This combined approach will help organizations
move from not just modernizing security operations
to a state of proactive cyber defense, which ultimately, we
believe, is the future of security operations.
And now to tell us more about how leading organizations are
transforming security, it's my great pleasure
to welcome my friend and a great partner
and a customer, Bashar Abouseido.
Over to you, Bashar.
BASHAR ABOUSEIDO: Thank you, Sunil.
Transforming security for me is all
about how security can be a business enabler while making
sure that team embraces change and leverages all the latest
Cloud-native security controls available to us.
To transform our security program,
we are really focused on three key areas--
security transformation to support business growth,
zero trust by default, and threat detection and response
going Cloud native.
Now, let's dig a little bit deeper
on securing our Cloud transformation.
For my team and I, our what isn't really changing.
In other words, we aren't taking more risk
just because we are embracing the Cloud.
And our risk appetite has largely stayed the same.
But what has changed is the how.
Now, what does that mean to us?
It means that just because we used to do things
a certain way, mostly in legacy data centers,
doesn't mean we should do them the same way in the Cloud.
Yes, we need to stay true to our risk appetite.
But we also need to use this as an opportunity
to innovate, to champion, and embrace change,
to do things differently if and where it makes sense.
To use the power of hyperscale Cloud infrastructure,
Cloud Native Controls, and AI and machine learning
to achieve greater automation, I want
to use machines to reduce my team's toil
and enable faster decision making based on data
sets we weren't even able to analyze previously due to scale
and various constraints.
Now, as I mentioned, our second key focus area
is all about embracing zero-trust architecture
at scale.
For us, that means putting identity
at the center of all decisions and removing implicit trust
relationships.
We focus instead on establishing an explicit trust
for each transaction.
Context and visibility are the other dimensions
that are crucial to successful implementation of zero trust,
in my opinion.
So how do we make sure we have visibility and contacts
from as many sources and signals as possible
to dynamically and continually assess
access policies on the fly?
How do we make sure that works where our teams are,
where, these days, is not likely in the office?
Ultimately, zero trust is all about linking
identity and access to prevention strategy.
But realistically, it dovetails into our third key focus
area, which is rethinking threat incident
detection and response.
For me, scalable visibility is the foundation
to modernizing threat detection and response,
especially in a world where our data sources continue
to grow exponentially.
The only way to process all of that security
into contextual data and actually make it useful
is to embrace Cloud-native technologies
to ensure scale and speed.
Scale is super important to us.
It ultimately enables us to use advanced analytics to make
better and faster decisions.
There's also the harsh reality of security talent availability
in our industry today.
My belief is that we need to leverage machines to do more,
to help us see more and to make decisions on our behalf
where it makes sense.
That being said, people and expertise
will continue to be important, even if they are outside
of your direct organization.
That's why choosing the right security partner
is key, especially in the context of security
transformation.
Make sure you choose partners based
on a shared vision of the outcomes
you want to achieve together.
The last thing I want to leave you with
is that make sure your team doesn't get hung up
on previous security patterns.
Push them to embrace change and innovate using all the latest
tools at your disposal.
With that, Sunil, thank you for having me and back to you.
SUNIL POTTI: Thanks, Bashar.
Bringing the best zero-trust access for users
to apps and apps to apps is top of mind for many of you.
So we've made significant investments in our BeyondCorp
Alliance alongside strategic partners
such as Palo Alto and a variety of other partners
in the ecosystem.
This now gives you comprehensive zero-trust options
to secure, private, and SaaS app access
while mitigating internet threats across managed
or unmanaged devices.
However, successfully adopting a zero-trust security
architecture isn't always easy.
So to help, we have packaged our proven experience and best
practices with our Cybersecurity Action
Team and select partners.
With this, they are available to support anything
from exploratory zero-trust conversations
to architecture reviews to implementation support.
So now we know implicit trust that we've covered so far
can create an opportunity for insider threat
management and other significant security risks,
not only in the context of access,
but also the software supply chain.
In my mind, that's the last green space
of potential opportunity to be really reimagined
within an enterprise security posture.
And to further help enterprises secure software supply chains,
we're introducing an all new offering called
Software Delivery Shield.
Software Delivery Shield takes this complex challenge
with a tested approach based on best practices
that we use internally and to secure our own software supply
chains for 100,000 plus developers here.
And so to double click on a specific area,
we have made significant progress on Assured Open Source
Software.
Very excited to announce the preview for Assured Open
Source that now provides access to the same open source
software packages that Google depends on,
allowing you to benefit directly from Google's own in-depth
end-to-end OSS best practices.
So in addition to everything I just covered,
we are also releasing a wide variety
of innovations across our entire security portfolio.
To hear more about them or to learn from others,
join our breakout sessions to go deeper into the topics
as well as engage forward looking beyond Cloud Next.
Now, we are so excited to help you become like Google
with our most trusted Cloud and by bringing security
magic to you wherever you are as our two fundamental pillars
of Cloud security here at Google.
And one thing I wanted to highlight
was that, in this journey of modernizing security either
on GCP or wherever you are, unlike some of our peers,
we have chosen to actually offer best-in-class partner
capabilities in conjunction with first-party Google solutions
in a cohesive experience versus an all-or-nothing capability.
So in closing, you may recognize that the pace of innovation
on this path to invisible security has not slowed down.
In fact, if anything, it has continued
to accelerate, especially with Mandiant now in the mix.
So I hope you'll join us and our partners on this journey
as we reinvent security to meet the requirements of tomorrow.
Thanks again, stay secure, and have a great rest of Next.
[MUSIC PLAYING]