CARTER MORGAN: Welcome to Cloud Security Basics, a new series
where we explain the ins and outs of securing
your application on Google Cloud.
Sound fun?
Then stick around, because in this episode,
you'll learn about the third of three distinct areas of cloud
security risk.
The platform.
[MUSIC PLAYING]
[PHONE DIALS]
BRAD ACTOR: Hello, Cloud detective.
You may have understood securing access and data,
but what about the platform?
What makes the physical and virtual hardware
Google provides secure?
Once your data is in the cloud, how
do you know it's really safe?
What if VMs aren't being properly isolated
from other workloads, leading to a tricky tenants isolation
exploit?
Are the physical devices being properly secured and checked
for malware?
What about people at Google looking at your data?
What if one of my hench people gets into a Google data center?
For your sake, I hope you know the answer to my questions.
CARTER MORGAN: OK, here's what we know.
Platform represents the physical systems that house and deliver
information.
It's important to understand the abstract notion of a user
accessing information is realized in physical systems,
and the sum total of those systems is the platform.
We often think of the platform as a server side thing
but really, it's everything from the user's fingertips,
to the bit on the disk, the in between,
the server which runs applications, and so on.
But since we have a shared security model,
it's important to remember that Google
is responsible for ensuring the physical
and virtual hardware Google provides
is operating as it should.
Luckily, Google Cloud Services are
designed to deliver better security
than many traditional on-premise solutions.
Because Google runs on the same infrastructure
they make available to their customers,
your organization directly benefits
from these protections.
Google uses a multilayered defense in depth approach
to security.
Each layer, from physical data center components
to hardware provenance, secure boot, secure interservice
communication, secure data, and protected access
to services from the internet--
each of these has strict controls
for access and privilege and is continually evolving.
Let's dive deeper into this.
So how does Google Cloud really protect
the physical and virtual hardware provides?
Well, check this out.
As part of their ongoing efforts to secure the Cloud,
Google Cloud has 850-plus security engineers,
$200 billion annual security investment, a 24/7 active
watch, 160-plus academic research
papers on security, a bug bounty program,
a penetration testing program.
This shows the level of investment Google
puts into security.
Google security teams triage, investigate, and respond
to incidents 24 hours a day, 365 days a year,
and conduct regular exercises to measure
and improve security detection and response.
On the application side, Google Cloud
provides libraries and frameworks
that prevent developers from introducing
certain classes of security bugs like cross-site scripting
vulnerabilities and web apps.
On Google Cloud, automated tools like fuzzers, static analysis
tools, and web security scanners are
used to detect security bugs.
On the access side, Google makes heavy investment
in protecting Google's employees' devices
and credentials from compromise, using technologies
and strict policies for physical computer data and network
security, access management, security login, and so much
more.
Ah, that's it.
I know the answer to Brad's question.
BRAD ACTOR: Hello, detective.
I see you've been quite busy and solved my little question.
What's really keeping your data safe once it's in the cloud?
Ah, and you found the key concept.
Clients secure their applications,
and Google secures the infrastructure.
The platform is secure, because that's Google's responsibility.
And security is foundational to everything
Google Cloud does, from designing data centers,
to software, to processes.
But most importantly, because Google Cloud
runs on the very same infrastructure it provides
to customers, all of those protections
can be used by people like you to protect your business.
Very good, very good.
You've answered today's question,
but be ready because next time, I'm
going to make you dig deeper into the platform
to see exactly how Google Cloud protects the user's data.
CARTER MORGAN: So there you have it.
Another episode of Cloud Security basics.
Next episode, we'll focus on how Google Cloud protects the data
that lives on their servers.
In the meantime, if you want to take a deeper dive into how
Google secures its platform, then
check out the article LinkedIn the description below.
And stay tuned for the rest of the Cloud Security Basic Series
because when it comes to security,
you can't let bad actors win.
[MUSIC PLAYING]