ERAN FEIGENBAUM: Welcome to Atmosphere Digital, Rethinking
Security in the Cloud.
I'm Eran Feigenbaum, director of security for Google Apps.
We have this great panel here of experts
through all across Google to talk about security.
Information security has become such a hot topic,
with the increase in cyber crime, the trends in privacy,
the changes in regulations.
It's something that businesses can't ignore.
Enterprises all over the world are concerned about security.
And to have a great conversation about information security,
we brought in four different experts
from all across Google, each a subject matter
expert in security in their own specific domain.
To my far left here, I have Tim Willis from our Chrome Security
Team.
Next up is Adrian Ludwig.
Adrian is responsible for Android security.
To my far right is Stephan Somogyi.
Stephan is a product manager in our Security and Privacy
Engineering Team.
To my immediate right is Suzanne Frey.
She's the director of security, privacy, and trust
for Google Apps engineering.
The move of businesses to cloud computing has really increased.
Companies see the benefits of lower cost but also the ability
to innovate faster for users to collaborate.
But one of the big areas of hesitation is security.
Companies are not comfortable putting their own data
into the cloud.
How would you respond to somebody that had that concern?
SUZANNE FREY: I think we're seeing a real sea change right
now with respect to people understanding
that the cloud is more secure than any on-premise solution.
If you just think about it, mathematically, you've
got all these different on-premise solutions
and individual teams trying to do the right thing.
And with any cloud provider, you have the locus
of the best talent, the best expertise centered
on making your solution secure and your data secure.
If you take a look at our customer base,
we have some of the world's largest banks.
We have some of the most stringent government customers.
We're FedRAMP-certified here in the US.
And the fact that we can solve for security
for all those customers is a great testimony
to our capabilities.
But in addition, we solve for something special.
In talking to our customers, it's
our ability to innovate and to bring new ideas
to bear that help enable them to be competitive, productive,
and truly novel and focus on the things that matter to them.
That's part of our really special secret sauce.
And I often say to people, at Google,
security comes in two forms.
It's both traditional cybersecurity,
but it's also security against technological stagnation.
ERAN FEIGENBAUM: That's interesting,
because we don't usually think of that second one very often.
We tend to think of the data security.
That's great from a cloud perspective.
How does that change in the Android or mobile world?
ADRIAN LUDWIG: Actually, I like the observation
about being too focused on security
to the exclusion of innovation.
I hadn't seen that phrase that way.
But I think one of the changes that we've
seen in the mobile space over the last few years
is, companies have focused first and foremost on innovation,
Android being a great example of that.
But we've tied it to a security model
that is how people actually consume applications
and services.
So we thought about the web and the sandboxing
model that was used on the web.
And we incorporated that in the way
we built applications sandboxing.
And I think a consequence of that
is, cloud services are becoming more and more important.
Most applications that are built for Android
or are built for mobile, regardless
of your mobile platform, are really cloud-based.
So I think those two were tied together because both of them
were thinking about innovation, first and foremost.
And then the security has unlocked that innovation.
ERAN FEIGENBAUM: So it seems like cloud
and mobile is a reason for companies
to move to those environments.
Is there stuff that Google's doing that others really can't?
TIM WILLIS: I think it's important to think
of the context in which we're talking in here.
So we have a complex set of systems
that we're dealing with today.
Going to get more and more complex over time.
We also have adversaries with increasing levels
of sophistication.
So you've got that on one side.
And on the other side we've got IT managers
having to defend their networks.
The problem with defense is you need to defend
everything incredibly well.
Attackers only need to find one hole into your network.
So I think that's where an advantage of moving
to the cloud is that you have dedicated teams
with robust experience.
I mean, Stephan and I were talking about this earlier,
that some of the people who I work with
wrote my textbooks in university.
And it's one of those things that I
get to work with these experts, and that's all they do.
They focus on security, and that's
one of the huge benefits, in my point of view,
moving to the cloud.
ERAN FEIGENBAUM: That's great.
We're protecting data while it's at Google.
But we actually do a lot of stuff
to make sure the data is safe when it's not at Google, right?
STEPHAN SOMOGYI: Safe browsing would
be a good example of something that we
can do at very, very large scale, where we actually
believe that the right approach is
make the entire internet safer.
So we build systems that hunt around and find malware
and find phishing.
And then we go and report this.
And so an individual consumer can benefit from this
because their web browser will let them know.
In a cloud environment, enterprises
can take advantage of this data as well
and keep themselves protected.
And we take this approach through a number
of different areas, certificate transparency
being another example where we're
taking a look at the internet as a whole
and finding ways to keep it safe at scale.
ERAN FEIGENBAUM: So obviously, in working
with various experts-- and you guys are
all experts in your field-- this encourages
us to innovate and come up with lots of security innovation.
Some of those really actually go beyond
and change security, really move the needle
from what users are used to.
Maybe you can all give me one of those examples that we've done.
SUZANNE FREY: I'd like to talk a bit about security keys.
Security keys have-- are you going to--
TIM WILLIS: Oh, no, don't.
STEPHAN SOMOGYI: Yep.
See, I brought my collection with me.
ERAN FEIGENBAUM: You have multicolored ones.
SUZANNE FREY: Nice.
Nice.
Almost Google colors too.
TIM WILLIS: Indeed.
You need a green one.
SUZANNE FREY: These keys are fabulous.
For the longest time we have been
talking about two-factor authentication
is critically important for most organizations to implement.
And many customers use Google Authenticator and other apps
like that to generate a onetime passcode.
And those are great.
They're certainly better than nothing.
However, a hardware-based security key such as these
is just quantum leaps ahead in terms of, they're not hackable,
and they really do protect our customers
from phishing in a way that basically the onetime passwords
do not, so.
TIM WILLIS: I think that's an interesting point, Suzanne,
especially talking about the not-so-glamorous side
of the things that we do.
One of those things is encryption for me.
It may not seem incredibly innovative,
but we're working really hard to make sure
that all of our traffic is encrypted
at rest and in transit.
And one example where we're being open with that
is our HTTPS transparency report.
Now you can go to that site and you can see our progress
towards our goal of 100% encryption in transit
through all of our products.
Again, another example would be working with TLS 1.3.
That's the next generation of transport layer security.
Now it may not sound glamorous, but we're not only
helping to implement that.
We're helping author the next version.
So that shows that we're in the mix
and we know what technologies are around the corner.
A practical application of that would be progressive webapps.
So these are low-friction web applications
which are designed to help increase engagement
and have an app-like experience for customers and businesses.
We've seen studies how that increases engagement.
And it's fantastic.
It's easy across the board.
Why am I talking about it?
Well, TLS is actually a hard requirement for those apps.
So it's one of these things where
not only are we innovating, we're making sure that security
is baked in from the get-go.
And I think that's one huge advantage of Google.
ADRIAN LUDWIG: There's a couple of elements about that that
are interesting.
One of them is, it's not so much that the security itself
is innovative, it's about using an innovative product
to make security available.
One of the things that we did early on with Android
is we thought about the platform stack.
We're like, OK, you need to have a verified boot,
you need to have encryption, you need to have sandboxing.
Those are all, I think, at this point
almost commodities for an operating system.
But one of the things that Google brought to bear
was security services.
It's going to be a cloud-connected device.
And we're going to make all of those services
available by default on all of the devices.
And so we started thinking about,
how do you bind services into the operating system itself?
So we added things like safety net and verify apps
where there are effectively hooks in the operating
system where we can make sure that we're adding
security dynamically over time.
So we can innovate in security even more quickly
than we can innovate in the operating system itself.
Does anybody know that that's happening?
Not really.
But that's OK, because they're safer
and they're happier as a result of it.
So the same way that you guys are
doing with TLS and progressive web apps,
binding those two things together just transparently
in the background.
STEPHAN SOMOGYI: And there are two ends of that spectrum.
There's also transparency.
I mean, Tim, you already talked about the HTTPS transparency
report.
But we've been doing transparency
and we've been shining light on ourselves for many, many years.
A couple of years back we did the safer email transparency
report where we were looking, first of all,
is there anything that we're doing that we could do better?
And then having looked at that, what
is the rest of the world doing?
And it's actually moved the needle forward.
We are now in a position to say, yes,
as a result of shining the light and illuminating the greater
situation on the internet, more people
are using encryption for their email.
It happens across all of our transparency reports,
where first we look at ourselves to see if we're doing the best
job that we possibly can.
And very often, then we cast our gaze more widely
into the outside world to see what else is out there
and if we can help people improve things.
ERAN FEIGENBAUM: Yeah, transparency
is actually a really big part of moving to the cloud.
I mean, especially we see that a lot with our enterprise
customers.
SUZANNE FREY: Absolutely.
If you think about it, like anything,
if you don't know enough or have sufficient information,
how in the world can you make a decision?
And how can you run your business?
And I do think that transparency has
been one of the biggest blockers to adoption
across all cloud products.
We've been investing in multiple areas
to ensure that transparency is front and center to what we do.
We engage third-party auditors to help ensure and provide
certifications against certain standards like ISO 27000
17 and 18.
Our FedRAMP process is also disclosed
to the government and leveraged uniquely
in terms of making sure that, across our company,
we are aware of vulnerabilities and addressing them quickly.
And I think just, in general, providing information
to the end user about whether or not
their employees have had a password violation
or have had some suspicious activity.
Or giving them greater reporting detail.
And I'm the first to say that we still have some work
to do on the reporting front.
And I think every cloud provider does.
But we're working really hard to improve the degree
that an administrator understands everything that's
happening within their company and can
take appropriate action.
ERAN FEIGENBAUM: So a lot of what
you guys all talked about are whether it's transparency
for our enterprise customers or for all users or some
of the innovation in Android.
We really wouldn't have expected years ago.
I, at least, wouldn't have predicted that.
You guys are all experts and very deep in your field.
What would be your security vision?
What's going to change?
What's going to make our lives easier for our users?
STEPHAN SOMOGYI: I think a lot of the security,
as we've talked about before, needs to stay invisible.
And in some cases it's going to be a little bit
counterintuitive.
So a couple of months back we released
a product called OnHub, which is a home networking router.
And one of the things that's particularly
counterintuitive about it, but which
is adding a lot more security, is the fact
that it's cloud managed.
So all the technology that we devise
to protect our users' accounts, like Suzanne
was talking about with the security key, all of that
benefits the user because the Google account is
the way the user starts to manage their device at home.
So as we connect all the various pieces of our security puzzle,
they all work together.
And suddenly you have a device at home which is actually
cloud managed and cloud secured, which
is not the way it was even a few years ago.
There's a distinct security benefit now.
SUZANNE FREY: I'd like to talk a little bit about the elephant
in the room with respect to security, which
is this dynamic tension between access to data
and keeping it secure.
One of the very hard things for most enterprises
is to say, listen, someone else is
going to be the governor of our data-- or steward of our data,
perhaps I should say.
And what is that company going to do with our data?
And I reference audit reports and certifications
that we commit to every year.
However, machine learning is one of the most exciting things
that's happening in the field of computer science today.
And machine learning requires training data to perform.
And obviously, with customers sharing data with us,
we could just take that data and go
nuts, which would be irresponsible of Google
and would really kill our vision overall.
But I do think solving that problem
and putting our customers in control
of what data we can use to enhance the way that they work,
to improve productivity, to reduce the costs,
and to understand how competitive they are
in a global landscape for a given industry, that's
super exciting stuff.
So I think finding that gentle balance between making sure
that customers can maintain absolute control over who
sees their data, when, and uses it for what.
It's one of the most exciting problems
we have to solve because it's going to bring
tremendous advances to mankind
ERAN FEIGENBAUM: Wow.
That's impressive.
TIM WILLIS: I feel like I'm the guy who's going
to talk about the boring thing.
I think it's really exciting that more and more companies
are moving, I think, more deeply into the cloud.
I mean, for some background, before I joined Google,
I was a sysadmin and our team manager,
and so I caught the security bug,
pun intended, and ended up joining an instant response
team.
So a lot of what I was doing was rolling out
to companies and departments who had been hacked
and helping them clean up their networks,
helping them rebuild up their defenses,
and kicking the miscreants out.
And it's one of these things where, as we mentioned earlier,
it's just going to get more and more sophisticated
and it's harder.
Moving to the cloud actually buys you
the Google Security Team, in a sense.
It gives you the protection that we're offering.
It lets you not have to worry about that.
And one of the great advantages of that is, as an IT manager,
I don't have to worry about that.
I can sleep a little bit better at night
knowing that Google's got my back when it comes to security.
ADRIAN LUDWIG: Yeah.
I mean, I think it's been interesting talking with folks
and getting a little bit different perspective.
Even in the last minute or two we've
heard discussion about hardware security
and we talked about machine learning and pulling
in data from different places.
Google, every conversation you learn a little bit
something new.
And I think that's one of the key things
that the security industry is going through right now.
We're beginning to a point where there's
enough maturation in all of our products,
where there's enough data that's being pulled in,
enough ability to analyze that data where we can actually
start to make good decisions.
For generations, really, from a technology standpoint,
we've been relying on assumptions about what
good security looked like.
Which things you need to be worried about,
what risk is likely to hit you.
But now that people are moving into the cloud,
now that we have operating systems like Android,
where we're trying to deploy security
solutions across the entire ecosystem,
we get a lot of data.
And we can analyze that.
And we can start to make really good decisions.
So I think that's the thing that I'm
most excited about over the next few years,
is we're going to get to the point
where, as professionals, we can actually
understand risk and make really good, risk-based decisions.
Which isn't something we've been able to do in the past.
It's not something that's possible
if you're not in the cloud, if you're not on mobile.
So that's what I'm really excited about.
ERAN FEIGENBAUM: The one thing that's
really in common with everything everybody
said is having a large security team that's capable
and has the expertise to really ingest all that,
to be able to do the things for you on the cloud
or to use all that data that now we
have to make products more and more secure
or to develop that machine learning.
So hopefully, this was a good insight for everybody
to hear what some of our security leaders at Google
are thinking about, what they're working on,
and what they're working on in the future.
So thank everybody for taking the time
and listening in to us.
SUZANNE FREY: Thanks, Eran.
ERAN FEIGENBAUM: [INAUDIBLE]
SUZANNE FREY: Thank you.