Hi there. Thanks for all that participation in that Q&A.
And I hope you're enjoying the show.
So, welcome to Security Spotlight.
My name is Sunil Potti and I'm the VP & GM for Google Cloud Security.
Over the last few months, we've seen some of the most damaging cyber attacks in history,
you know, against public utilities, private sector companies, government agencies,
causing many organizations to realize
they're at a pivotal moment in their security journey.
Of course, this is not news to, you know, most of you in our industry.
But let me put a few things in context with a sobering statistic.
Did you know that the cost of cybercrime is now estimated
between 2 and 10 trillion dollars a year?
For the past two decades, Google has made security the cornerstone of our strategy.
This has resulted in Google enabling more users to be safe
than anyone else in the world.
Blocking malware, phishing attempts, spam, cyber-attacks globally,
and not just for a few thousands of websites,
but for billions of users and millions of websites globally.
So that being said, we also realize that this journey,
you know, it will require enduring commitment over the coming years.
And that's why Google has committed to invest 10 billion dollars
over the next five years to help strengthen cybersecurity for enterprises,
consumers and governments.
We want you to be able to use our Google Cloud Security magic
to protect your enterprise.
We make that possible in two ways.
First, we provide the industry's most trusted cloud
for accelerating your digital transformation efforts.
And secondly, we bring trust to you with security products that meet you
where you are and bring our Google security magic to your on-prem private
and multi-cloud environments.
And it's just not about having best-in-class security capabilities.
It's also about how they're actually delivered in your consumerist fashion.
But at Google Cloud, we take a different approach.
We are driven by a vision of Invisible Security
where security technologies are engineered in,
so you get opinionated, full-stack coverage of security controls.
Security operations as a silo disappears, so niche security talent gets democratized.
And last but quite significantly,
shared responsibility in a world of public cloud evolves to shared fate
where we, as your provider, have true skin in the game and mutual security outcomes.
So a great example of what I mean by invisible security
is the all-new built-in data protection automatic DLP for BigQuery.
It's a game-changing capability that discovers and classifies sensitive data
for all of our BQ projects across your entire org
without you needing to do a single thing.
And if you take a full step back and internalize
what invisible security could mean for you as an enterprise, a service provider,
a partner or whoever it is.
There are three areas where Google's insight
and experience can make a meaningful difference.
One, protecting your employees and assets.
Two, protecting your IP.
Three, protecting your users and your brand.
Let me spend a bit of time on each of these.
First, one of the most overused buzzwords in cybersecurity today is Zero Trust.
Why not? The core of a Zero Trust approach
is the idea that implicit trust in any single component of a complex,
interconnected system can create serious security risks.
What does that mean? Is that trust needs to be established via multiple mechanisms
and be verified continuously.
So here at Google, we've applied
a Zero Trust approach to most aspects of our operations.
We went to Zero Trust access with our BeyondCorp framework,
shared our use case with the entire world and delivered BeyondCorp Enterprise,
a world-class solution that includes integrated threat and data protection.
We've had great reception to BeyondCorp Enterprise
since the launch earlier this year,
and today, we're delivering capabilities that expand the surface area
for Zero Trust access to cover all of your apps, both modern as well as legacy.
So as a point of note, right after this session,
the team will be doing a live end-to-end demo of BeyondCorp Enterprise
to show how you can make access easier and more secure the Google way.
So don't miss it.
Next.
Protecting your assets is easier if it's intentionally done upstream,
shifting security left.
And so, Zero Trust goes beyond access
to protecting your workloads as well and your IP.
And how Google operates our production environment is in this way,
the way software is conceived, produced,
managed and interacts with other softwares.
We call that approach BeyondProd
and we've already prioritized many capabilities for you.
So looking at BeyondCorp and BeyondProd,
you realize that Zero Trust is much more than tools.
Zero Trust is how we envision designing, deploying and operating safe environments,
so our daily lives as an enterprise or consumer can go from a world of being
on the edge, to being safe, and safer we go.
But you can't lose sight of the fact that while Zero Trust approaches help, you know,
address the preventative side of your program,
robust detection and response capabilities are needed to complete the equation.
And this is why we invest in Chronicle and we continue to amplify it
as our foundational security operations solution.
And we are excited to announce stronger integration between Chronicle
and Security Command Center, SCC on GCP, with centralization of alerts,
the addition of cloud asset inventory management
and user context to enrich investigations.
Next, let's talk a little bit about protecting our intellectual property.
So for organizations pursuing digital transformation, code is your IP.
It's the heart of your business.
The foundation of securing a code is a secure software supply chain
from the time developers start writing code through your CI/CD Pipeline
all the way to deploying and operating and production.
So at Google Cloud, we believe two things are foundationally necessary
for doing this in an enduring fashion.
One,
Industry-wide frameworks and standards are a must,
but they also need to be complemented by full-stack managed services that implement
these standards and make adoption easy.
So for the first, Google co-founded OpenSSF across Industry Forum for open
source and supply chains software security.
If it projects such as SLSA,
an end-to-end framework for ensuring the integrity of software artifacts.
And second, we have the all-star GitHub App right in time for the fall season
for continuous enforcement of best practices for GitHub projects.
And then, last but not least, Open Source Score Cards,
which provides a score for open source projects.
And these are just a few ways Google is contributing to industry-wide standards.
And on Google Cloud, with our invisible security approach,
we provide these tools in a fully-managed environment.
From code to build, deploy,
run and operate that implement these standards by default.
And let's not forget, you also get a consistent way to define
and enforce policy for a Zero Trust software supply chain that establishes provenance
and prevents modification or tampering.
And we're building the Zero Trust software supply chain
with new additions across the board.
You can learn more about all of these launches in our breakout sessions.
So to add some more, you know,
context to this with new voices in our conversation on these topics,
I'd like to bring on Murray from Facebook and Steph,
who leads our cloud security user experience team.
Steph and Murray, over to you.
Thanks, Sunil. And welcome, Murray!
Can tell us about your role at Facebook and what that work entails.
Sure! I'm a manager supporting the Cloud Foundation team within Facebook.
Cloud Foundation is chartered to help teams with a need to use public clouds
for their workloads so that they can do so both quickly and safely.
Can you talk about how Facebook is leveraging Zero Trust,
secure supply chains or other modern cybersecurity solutions?
Facebook focuses a lot of engineering effort on secure supply chains.
This extends to our use of the cloud as well,
so our workloads that will run externally have all of the same requirements as
the internal ones in terms of security, vulnerability management, security logging,
monitoring, tight access control to resources, access auditing,
data deletion requirements, penetration testing,
mandatory reviews of anything with privacy implications and so on.
One approach we're taking is that our teams can't use any UIs or directly control
the services they build in the cloud.
They have to go through our tool suite to do it.
Some of our suite uses common open source tools,
which means there are vast online help resources available to enable our teams to
design and build their services.
Then we provide our own extension
so that these tools integrated with our existing internal development workflows,
logging systems, dashboards, etc.
It also allows us to impose our own guardrails and best practices.
Its infrastructure as code in the truest sense.
Naturally, we already have an internal CI/CD system that's used to update
our internal services on a regular basis after appropriate code reviews
and automated testing.
So I'd love to wrap up by hearing about your experiences.
What your team uses to keep Facebook fortified
and continually strengthen its security posture.
And two, partnering.
One of the capabilities that our tool chain allows is to inspect
what the deployment is going to do before it happens,
which gives us an opportunity to impose best practices or error checking
and stop problems from going live.
Some of these rules shield us from an accidental security exposure.
Some look for weak deployment practices, such as a lack of redundancy,
and still others look for avoidably expensive practices.
These rules applied here are based on both our own experiences and policies
and those recommended by our expert partner teams supporting us.
This allows us to be agile and respond to incidents when they come to our attention.
Thanks, Murray and Steph.
Interesting to see how these ideas are implemented,
and I'm excited to see where we'll continue to go together.
OK, so let's move beyond our infrastructure for a moment and think about the big picture.
The software that runs your business delivers value to your customers and your users.
The security you're building is designed to protect the users
and build trust between them and you.
Security incidents erode that trust and eventually, damage your brand.
So now, Google keeps more users safe online than anyone else on the world.
So let's see how we are advancing our efforts
and delivering all these capabilities to enterprises wherever you are,
eradicating phishing as well as completely stopping fraud. Period.
And in this area, safe browsing is the gold standard.
Our program to protect users from dangerous sites or files is unprecedented in its reach
and capability.
Its capabilities are invisibly baked into browsers
on 4 billion plus devices.
Last year alone, we advanced the state-of-the-art
with enhanced safe browsing,
an optional but more advanced level of safe security for safe browsing in the web.
And by sharing real-time browsing data in a privacy-preserving way,
we were able to deliver a 35% additional reduction in phishing attacks
and malware that reach users.
These kinds of numbers and this kind of efficacy,
has not been possible without leaning in on our heritage
and our core competencies in providing security
as a built-in capability to consumers as well as enterprises wherever they are.
And since its introduction in April 2020, in addition to safe browsing,
millions of users have taken advantage of this extra protection
in a very rapid fashion.
So our ultimate goal is to eliminate phishing as a threat. Period.
Bringing safe browsing capabilities into your environment through Gmail,
BeyondCorp Enterprise and many other products.
So in addition to targeting users directly,
attackers view websites as the first and often easiest place to commit fraud.
And over five million sites today use reCAPTCHA,
our fraud and bot management solution that stops attacks like
credential stuffing and account takeovers.
With reCAPTCHA Enterprise,
you can do this frictionlessly, without usual challenges to maintain
an optimal user experience, which is just another example of invisible security.
And over and above this, we continue to bring together
the best of Google's capabilities to enhance fraud prevention.
So a new integration between Cloud Armor and reCAPTCHA Enterprise that detects
and stops back bot activity at the edge is now in preview.
So let's hear more from Brian Lozada,
the CISO at HBO Max on how they're actually using reCAPTCHA Enterprise to protect
their users, and therefore, their brand.
Thank you, Sunil. We chose reCAPTCHA Enterprise
because we wanted to offer our customers security against malicious actors
while continuing to provide a frictionless customer experience.
With reCAPTCHA Enterprise, we enable our customers through our login
or registration process without requiring them to engage in any kind of a challenge.
It's a win for everyone.
Our development and product organizations can continue to focus
on creating customer-centric experiences,
and our customers can easily use our services.
The use of reCAPTCHA that has helped us in our mission to secure
the customer experience allowing our customers to feel comfortable
while enjoying our platform. Thank you.
Thank you, Brian. So, we want to provide as much assistance
as possible in your digital transformation or your security transformation,
as Thomas mentioned in his keynote,
we are excited to launch our new Google Cyber Security Action Team to help.
And to talk more about this, I'd Iove to kind of bring on Phil Venables, our Cloud CISO,
who's leading this effort. to tell you more, Phil.
Thanks, Sunil. So, the Google Cyber Security Action Team,
marshalls experts from across Google to form what we believe will be
the world's premier security advisory team.
It has a singular mission:
supporting the security and digital transformation
of government, critical infrastructure,
enterprises, small businesses, consumers and society overall.
To deliver on this mission, there are many ways that GCAT can help you today
with strategic advisory services for your security strategy,
including transformation workshops
and content like our CISO guide to Cloud Security Transformation and our framework
for increasing operational resilience for financial services organizations.
With trust and compliance services
driven by specialists who continually obtain
the most important global compliance certifications for our products
and map them to industry control frameworks for you.
We are full spectrum customer security
and solutions engineering that delivers proven blueprints and architectures
for deploying our products and services securely
in accordance with your regulatory regimes,
as well as comprehensive solutions for areas like autonomic security operations,
cyber resilience, Zero Trust architectures and many more we've got under development.
And finally, with threat intelligence and incident response services,
including threat briefings, preparedness drills and rapid response engagements,
so you can stay on top of the evolving threat and security landscape.
Another way we're working to help strengthen
and transform security is by working with industry and the public sector.
Google Cloud joined as an initial partner for
the U.S. Department of Homeland Security's Joint Cyber Defense Collaborative,
and this initiative will strengthen our collective security posture by preempting
and reducing the impact of cyber threats through increasingly strong partnerships
between the public and private sectors.
And as Sunil mentioned at the White House Cybersecurity Summit in August,
we announced that Google will invest $10 billion dollars
over the next five years to further strengthen cyber security.
The areas addressed included expanding Zero Trust programs,
securing the software supply chain, enhancing open-source security,
as well as training a 100,000 Americans in skills,
including data privacy and security throughout Google Career Certificate program.
And this builds on the $100 million
we've already committed to improving open-source security
focused on efforts like Linux, kernel development and work
like metrics tracking and the coordinated vulnerability disclosure
through the Open-Source Security Foundation.
So with that, Sunil. Back to you to wrap up?
Thanks, Phil. Great stuff.
As you could see,
our commitment to improving security for customers and
the whole ecosystem is substantial.
And more importantly, it's enduring.
In products, in resources and monetary terms.
We're making a meaningful difference with our long-range vision
and commitment of invisible security.
Delivering continuously around Zero Trust,
safely securing your software supply chain,
and delivering user protection services to protect your users and your brand.
So to close, I mentioned a few new products and I didn't have time to cover
all the other amazing innovations that are coming out of our teams,
and we're making many more such announcements here next.
So please see our security experts,
fellow customers and partners in our track sessions to go deep on the topics
and products that matter most to you.
So don't forget, the live demo of BeyondCorp Enterprise is coming up next, right here,
followed by a live Q&A where we will be answering your top questions.
Thanks again.
Stay secure and have a great lesson next.