CHRISTOPHER JOHNSON: Hi.
Thanks for joining us today.
We're going to be talking about "Mission Possible,
Moving Your Most-Sensitive Data to GCP."
My name is Christopher Johnson.
I typically go by CJ.
I'm a security product manager.
I look after compliance, regulated data.
And what we're talking to you today about
are shared workloads for government.
I have with me Suzanne.
SUZANNE KAO: Hi, everyone.
Great to see everyone.
I'm Suzanne Kao.
I'm a managing director at Deloitte.
I oversee our global export controls practice
and focusing on regulations related
to export controls, as well as sanctions,
and working with CJ today on this fantastic presentation,
so looking forward to it.
CHRISTOPHER JOHNSON: All right, well, at the very base of this,
we want to talk about the challenge of compliance
in cloud.
Compliance, what we've learned over the last couple of years
is, a lot of the regulations, a lot of the compliance
regimes that we look after weren't written
with cloud computing in mind.
And a lot of them reflect requirements
that come from previous world of having everything
in a single data center or in a single room.
And our customers require something a little bit more
complicated than that.
However, as we move to this, managing compliance
with multiple data security regulations in a cloud
environment can be really complex
and slow, especially for government agencies.
And this is what we've really been thinking about
in trying to imagine solutions for this.
It gets extra complicated when you
have workloads that have to comply
with multiple different compliance and export
regulations.
I'll let Suzanne talk a little bit more
about the cloud compliance landscape.
SUZANNE KAO: Thanks, CJ.
So talking about the cloud compliance landscape, when
it comes to sensitive data and moving to the cloud
environment, there are a lot of regulations
that you have to consider.
Amongst them is export controls, as well as cybersecurity.
And what those really regulate are
who can have access, what can be uploaded to the cloud,
and then how can it be accessed.
So thinking about that, export controls
can be quite stringent when it comes to sensitive data
or controlled data.
And so as you can see, it restricts
the unauthorized transfer of technology and data
to non-US persons from an export controls perspective.
So there are a lot of different mechanisms
that a company can employ to make sure
that it's in compliance with these regulations.
And one of them is--
one of the leading practices is marking that data as controlled
or not controlled.
And because of the fact that export control regulations are
so stringent, a lot of other regulations
can piggyback off the various different compliance
requirements.
So for instance, when it comes to cybersecurity regulations,
which govern the confidential unclassified information,
and in other instances, classified information,
being able to employ a program where you're already
marking the data can also capture
some of the cybersecurity requirements as well.
But certainly, there are some times
that there are conflicts with these regulations.
So for instance, in certain jurisdictions around the world,
there is a lot around data privacy
and with respect to nationality.
So if you're thinking about from an export controls perspective,
where you need to identify who the non-US persons are,
there are considerations that you
have to resolve when it comes to sharing
that kind of personal information
in order to be in compliance with the export controls.
And there are different mechanisms
that you need to think about when you're trying to determine
who, what, and how.
And some of those are through performing such things
as screening, where you identify certain parties that you can
or cannot do business with, licensing, which really means,
is about, should you need to have--
provide access to a non-US person, from that perspective,
there are licensing mechanisms that you can actually
ask the government for permission to do so.
And then, also visitor management--
so in the instances that you have a physical facility where
you're needing to look at, whether it's
the physical parameters of the building, or the server rooms,
or whatever it might be, there are other protocols around that
to control who and who doesn't have access
to those types of physical locations.
And that relates also to access control.
And that is from a virtual perspective
such as in the cloud environment,
where it's technology, or it's a physical access.
And then with respect to disclosures,
just like in cybersecurity, if there
are instances of non-compliance, there
are ways in which you can actually
disclose those types of incidents to the government
and to resolve those sort of situations.
But as you can see, it's quite complex.
And there are a lot of different considerations
that come into play when it comes to compliance
and moving to a cloud environment.
However, should you have the right protocols in place,
and of course, the right tools in place to make sure
that you do monitor the who, how, and what of the data,
and the access of that data, and the controls of that data,
then it creates a smooth transition for such a platform.
CHRISTOPHER JOHNSON: Migrating government data to the cloud
is challenging.
And there is a few key questions that
must be answered before you get started.
And really, cloud users need to be confident of their answers
before they can start the migration.
And pretty soon, we'll get to the solutions
to these problems.
But for now, let's understand a little bit more
about what it takes.
You have to really understand what
information will be stored or accessed
in the cloud environment.
As Suzanne mentioned, that goes back
to one of the fundamental pieces of this,
is understanding your information
and tagging it appropriately.
The next is where will that information ultimately reside.
That could be on-prem in a server.
That could be in the cloud environment.
But it also is really important in terms
of choosing which regions, which cloud regions your data
is stored in.
We'll talk here in a few more minutes about that.
And then we also need to understand
what the process is to grant and manage access
to that information.
What are the controls that are in place?
Some of those, you get to inherit
from the cloud provider.
And some of those, you need to manage yourself,
in terms of looking after the data,
making sure you have the right controls in place.
That, of course, feeds directly into the next question, which
is, who can access that data?
So we put this great access control around it.
Now you need to make sure you're controlling
the people that have access to the information appropriately.
Do they have the right attributes to access
the data in the first place?
Do they have the right background checks?
These are really important considerations
that feed into the question of who can access that data.
The next question to answer here is,
what is the process to add content to the application
system or platform?
So we've spun up our environment.
We've put all these awesome access controls in place.
We have the right people.
Now we need to understand what it
takes to move data in and potentially out of the platform
or out of the environment once you have
things configured and working.
The next one is what the encryption protocols are
and how keys are managed.
This one's actually pretty exciting, and one of the areas
that we really try to help our customers out
with in Google Cloud.
And if you're talking about US government data,
it has to be FIPS 140-2 validated cryptography.
And it's really important that you have that in place
and you have good controls around the cryptography that's
used, but you also have to have a lot of options
in terms of managing the encryption keys.
And in the Google Cloud environment,
you have a lot of choices with customer managed
encryption capabilities, and all of those, of course,
being FIPS 140-2 validated and turned on by default.
And then finally, how and where are the data backups
being stored?
Where is this information being stored and processed?
This is also a key consideration.
And some of it is baked into the environment directly.
But in other cases, you need to make sure
that you're managing this yourself.
SUZANNE KAO: And I just wanted to add to some of the points
that CJ raised.
And I think these are really critical questions when you're
thinking about migrating to a government-- government data
to a cloud platform, is that you can see that it really
is about multiple responsibilities
and multiple responsibility owners,
where thinking about what information is going
to be stored, where the information is going to be,
how is it going to be accessed, and so forth.
And so even thinking about our relationship, Deloitte's
relationship with Google and working with CJ's team,
that's really been a collaboration.
And being able to identify and having those answers
very clearly laid out for these various different questions,
that will inevitably create that pathway and that journey
to being able to do that migration very smoothly.
CHRISTOPHER JOHNSON: So now we get
to make the transition to my favorite part here, which
is we spent a lot of time talking about the complexity
and challenges and the things that Google and Deloitte are
doing to make this easier and try
to help our customers through the migration
and bringing their most valuable information to the cloud
provider.
So we have a new product called the Shared Workloads
for Government.
And this is our solution to the problem.
The idea is, you're going to secure your sensitive workloads
and accelerate your path to running compliant workloads
on Google Cloud.
And we're going to talk a lot more about what that means
and how we're going about that.
So Shared Workloads, what is this product?
Basically, this product allows you to confidently
secure and configure those sensitive workloads
in alignment with the government requirements and regulations
in just a few clicks.
You get to choose your compliance security settings.
And we're going to put the necessary cloud
controls in place.
It doesn't mean you're off the hook.
You do have shared responsibility here.
As both Suzanne and I mentioned, it's really important
to make sure that that data is managed and controlled
correctly.
But on our side, on the Google Cloud side, we're making it--
we're streamlining that process to configure the environment,
make sure it's set up appropriately
for those compliance outcomes, and getting you started
on the path towards compliance.
How does this work?
Well, for starters, you log in and start
using a Shared Workloads.
This is available from the Google Cloud
console, which we'll show you here in a few minutes.
And you access the Shared Workloads interface.
This is optimized for customers in regulated industries.
And it's as simple as using this New Workload button.
We're using this workload concept
to put this information together.
You set up your new workload.
This is where you configure your platform controls
for data location, administrative access,
and encryption.
Again, back to what we were talking about earlier,
these are those fundamental questions
you have to answer before you start moving government
data to Google Cloud.
You have to understand where your data is going
to be stored and processed, who can access that information,
and make sure that the appropriate encryption is
in place.
And then finally, monitor your project details.
So make sure that the environment
is set up appropriately and that you're keeping track
of that environment over time.
And we help you with the Shared Workloads product.
So we'll talk through a little bit of the use case here.
I'll let Suzanne describe the use case.
SUZANNE KAO: Sure.
So a typical scenario that we really see that I think really
captures why something like a, quote, "tool" like this would
be really useful is, for instance, an aerospace
and defense client.
So if you have an aerospace and defense client,
if you're familiar with export controls, a lot of their data
is export controlled.
And also from a government perspective,
that's the key thing.
And so when you're looking at the aerospace and defense where
they have very controlled information,
they're going to be subject to a lot
of different regulatory requirements
when it comes to the type of data that might potentially
be shared with other entities outside of its organization,
or even within its own organization.
So the scenario is the client is already using a cloud platform.
And then it acquires, which often,
many aerospace and defense companies do.
They buy up a lot of smaller companies
and incorporate them into their IT environment.
But of course, with a smaller company
that might be less sophisticated,
there may be some risk around the identification of what's
controlled or not controlled on their on-prem data that's
being stored.
And so they would need to then go
through the exercise of understanding what
that data is, and as I mentioned before, potentially having
to mark it to understand what's controlled and not controlled.
But the client wants to move quickly to and migrate
the acquisition's data into the cloud
and also make sure it's showing compliance
with the various different export control regulations,
as well as cybersecurity regulations, and so forth.
And so the acquired company's data is export controlled.
So then the situation is, how do they do that quick migration
into the cloud that's already being
used by the parent company?
So then, with that, CJ, do you want to talk about [INAUDIBLE]??
CHRISTOPHER JOHNSON: Yeah.
So we're going to step you through this
and show you a demo of this.
And we're going to show you an aerospace user that's
going to create a new workload with
multiple regulatory compliance requirements for the data.
We're going to talk about storing and processing
that data in the cloud, and requiring, for example,
customer-managed encryption, US data location, and US persons
controls in terms of support of that data.
So I'll show you the demo.
We're going to come into Cloud Console.
And for starters, we'll come over to the menu.
You can see we have a new Compliance area.
We're going to click in there.
And this is going to take you directly into Shared Workloads.
In this case, we can create a new workload
and view the ones that we've created.
I'm going to go ahead and create a new one here today.
Let's fire this up.
We'll call this NEXT Demo.
And we're going to tie it to a billing account.
Next you're going to choose the platform controls that you'd
like to apply to the workload.
In this case, we've got IL4 and CJS turned on.
IL4 allows us to create a workload that's
compatible with IL4 controls.
Specifically, it's going to limit Googler access,
so Google support access to only US persons.
We also have CJS options.
CJS does something very similar, but it also
enables support for escorted access to support use cases.
We're going to use IL4 today.
What happens next is the regions that are available to me
are limited based on the compliance
framework that we've chosen.
In this case, IL4 only support the US regions or US
regional of data.
So only US regions are available to me.
I'm going to choose us-central1.
And now I can see which GCP services are available.
This will limit the capability to the services that
are compatible with these controls,
both for regionality and personal access controls.
We're going to click Next.
Then we're going to configure the encryption.
We'll start this thing up today, set the rotation period,
and then click Next.
We'll review the workload.
What you can see here is we've worked
very hard to make this an extremely streamlined
experience for creating a new workload,
putting the controls in place, and getting you
ready to onboard data into GCP.
I'm going to create the workload.
What's going to happen here, as I mentioned, in the platform,
we're going to create the project,
both for the shared workload as well as for CMEK.
So we have some separation of duties there.
And we're going to put the back-end infrastructure
and controls in place to protect the data
in a compliant fashion.
We can go in here and get some details on the project.
It's going to give us the platform
controls that were applied.
It'll show us the controls specifically
that were applied in this case, which are data access controls
and data residency.
We can see the region that was chosen, obviously,
the creation time, and then the projects themselves.
Like I said, it'll create one for CMEK.
It'll create one for the shared workload.
And it'll show you the services that
are in scope for that particular workload.
We, of course, can launch into the project.
And at this point, I can begin onboarding data
into the platform in a compliant fashion,
creating VMs, creating workloads, and really starting
to take advantage of the platform
in a compliant fashion.
As you can see from the demo, we've
worked really hard to make this process as streamlined and as
efficient as possible for creating a new compliant
workload.
And what we've done there is, we've
put those guardrails around your environment
and your infrastructure to make sure
that you can have those compliance outcomes in the end.
And ultimately, the product features
that we're talking about and demonstrating here
is the automatic enforcement of those data location
constructions.
So in the case of the US government compliance
requirements, these have to be stored
at rest in specific US regions.
What we're able to do with this product
is help you configure that so that it'll only
be stored at rest in these US regions
and also make sure that your users of your environment
don't accidentally store it somewhere
that they're not supposed to.
So we're compliant from the beginning.
And then we help you put those guardrails in place
to prevent misconfiguration errors that
could result in a non-compliant configuration.
So that's the first part of it, which
is the automatic enforcement of that data location.
The next part is personnel access.
This one is actually very interesting.
What we're able to do is limit Google personnel access
based upon predefined attributes such as citizenship,
a particular geographic location, or potentially,
background checks.
So for example, the support for CJS
allows us to have controls in place that
make sure that it's a US person accessing from a US location
with a very specific background check in place,
or they're escorted by somebody that is.
Finally, the built-in security controls here,
this reduces the risk of accidental misconfiguration
by choosing the available platform security
configurations.
And we'll help you put those controls in place.
Again, the idea here is start from a compliance beginning
and then help you keep that in place
as you move through the lifecycle of your data on GCP.
Automatic enforcement of products deployment location,
this allows you to restrict the deployment of new resources
to specific Google Cloud regions based
upon an organizational policy.
Next, the security and compliance monitoring,
we're working on this now.
It's coming in Q4.
And this will allow you to continuously monitor
the security and compliance of your Shared Workload
environment and adjust those settings as needed
based upon your own security and risk assessment.
There is also premium support offering here
for Shared Workload customers.
This allows you to ensure that only US persons support from US
locations are available 24 by 7 to help
meet compliance requirements.
And this does require additional support services
purchase though.
So the premium support offering is quite interesting.
Thank you so much for your time today.
It was a blast getting to introduce Shared
Workloads for Government.
We're really excited about it.
And thank you so much for your time.
Suzanne, thank you so much for helping us out with us.
SUZANNE KAO: Oh, it's been great.
And it's been a fun time.
And it's been a great journey.
So I really appreciate being able to participate today.