YUFENG GUO: Hi, I'm here with Chris Law
to learn more about how to protect highly sensitive data
from being exfiltrated.
CHRIS LAW: Hi, Yufeng.
Happy to be here.
YUFENG GUO: So I've seen a lot of headlines
over the last year about big data breaches.
And they seem to be getting bigger and bigger.
What's going on?
CHRIS LAW: Yes, any company storing sensitive data
needs to be ready to protect against data breaches.
YUFENG GUO: And so when you say highly sensitive data, what
do you mean exactly?
CHRIS LAW: Highly sensitive data can
be things like social security numbers, credit card
numbers, or patient data.
This includes things like PII, that's
personally identifiable information,
financial information, or PHI.
And that's protected health information.
But highly sensitive data could really
be any data that your company deems to be sensitive.
But the good news is Google Cloud
can help protect this data.
I'll show you how.
So let's say you're building your finance app,
and your partner is sending you a bunch of data.
The partner is sending you both sensitive data in red here,
and non-sensitive data in green.
YUFENG GUO: Got it.
So I really want to keep that red golf ball secure.
CHRIS LAW: Exactly.
Now the easiest way to get this data from the partner
is to create a public bucket in Google Cloud
and give them access to it.
So now, as you can see, the partner
is sending the sensitive data and non-sensitive data
all into this one bucket.
But there's a problem with that setup.
And it's that unauthorized parties
can get access to these public buckets
and can exfiltrate the data.
And any exposure of, say, social security numbers or credit card
information can put you and your company in the headlines.
But the good news is developers like yourself
can use Google Cloud's Identity and Access Management
System, or IAM, to restrict access to the bucket that
stores this sensitive data.
YUFENG GUO: So how does IAM work?
CHRIS LAW: With IAM, as a developer,
you can control exactly which users have access
to the new restricted bucket.
And each user will have to securely authenticate in order
to get any access to data.
YUFENG GUO: Right.
So as a developer, I can just lock this bucket down
so only a few people can access it?
CHRIS LAW: Exactly.
Anyone trying to get access to data in your restricted bucket
needs to be authorized before they can get access
to any sensitive data.
YUFENG GUO: So I have this new restricted bucket
with limited access.
How do I get the social security number data into that bucket?
CHRIS LAW: Great question.
Well, let's take a look at how you can do it.
One way you can sort this social security number
data into this restricted bucket is to do it manually.
The problem with this approach is that it might make a mistake
and categorize the data wrong.
So in this example, I might accidentally
miscategorize the social security number data
and put it into the public bucket,
exposing it to the wrong people.
YUFENG GUO: Got it.
CHRIS LAW: For highly sensitive data like this,
it makes sense to automate this sensitive data classification
process as much as possible.
And that's what developers use Google Cloud's Data Loss
Prevention, or DLP API, for.
DLP can identify over 90 plus different types
of common sensitive data types like social security numbers
and credit card numbers.
So with DLP enabled, now when the partner sends you data,
DLP will automatically identify the social security numbers
and automatically put that data into the restricted bucket.
YUFENG GUO: Amazing.
CHRIS LAW: Pretty cool.
YUFENG GUO: Yeah.
CHRIS LAW: So now that we've automated this process,
we've got the sensitive data all going
into the restricted bucket, and only a few select users
have access to it.
YUFENG GUO: Great.
So can I launch my app now?
CHRIS LAW: Not just yet.
This setup works fine as long as the partner sends the data
into the right API.
But let's say they accidentally email
through a bunch of sensitive social security number data.
So over here, we have a bunch of e-mails, white golf balls,
and e-mails with sensitive data, which are red golf balls.
Anyone who receives this email can
download the social security number data into to machine
or forward it into a personal drive.
This makes it much more likely to be exposed.
YUFENG GUO: So how can we keep this social security number
data out of inboxes?
CHRIS LAW: To handle this problem,
you can use Google Cloud's Data Loss Prevention
technology in G Suite.
So with G Suite DLP set up, the social security number data
within the e-mails gets automatically detected
and moved into a quarantine bucket.
YUFENG GUO: And so now that social security data
doesn't hit my inbox.
CHRIS LAW: Exactly.
And once the data is moved into the quarantine bucket,
admins can review and handle it more securely.
YUFENG GUO: So we've got the social security number
data going securely into this restricted bucket.
And now only a few select users can access it.
But what's to stop one of these legitimate users
from just stealing the data?
CHRIS LAW: Right, great questions.
Insider attacks are also a threat.
So even if you're putting the data in a secure environment,
a user who is granted access to that data
may have malicious intent and might
try to exfiltrate the data.
Leaks like this can be contained and controlled
using Google Cloud's VPC Service Controls.
With VPC Service Controls, we can set up a secure access zone
that acts as a perimeter around the sensitive data
so even insiders can't move the data out.
YUFENG GUO: So even a user I granted legitimate access
to would not be able to exfiltrate that data.
CHRIS LAW: That's right.
YUFENG GUO: What if an admin goes in and just changes
these settings?
CHRIS LAW: With Google Cloud's Forseti open source security
tools, you can set up an alert.
So when an admin makes any changes to sensitive data
settings, an alert can be sent to Cloud Security Command
Center so that even admin access can be monitored.
YUFENG GUO: Wow.
So are we ready to launch the app now?
CHRIS LAW: Well, let's take a look at your finance app.
The partner is sending you social security number data
and it's all being categorized in the right bucket.
There's a secure access zone around the data.
And even if the partner sends social security number
data via email, that data is automatically quarantined.
I think you're ready to launch your app.
YUFENG GUO: Great.
Well, Chris, thanks for showing me
how developers and companies can protect highly sensitive data
like this with Google Cloud.
CHRIS LAW: My pleasure.
[MUSIC PLAYING]