[MUSIC PLAYING]
YUFENG GUO: Hi.
I'm Yufeng Guo, and I'm here with Ameet Jani,
a Google expert in identity and access management.
Thanks for joining me today, Ameet.
AMEET JANI: Thanks for having me.
YUFENG GUO: Let's dig right in.
So with the increase in cyber attacks recently,
it's more important than ever for IT
to stay in control of who accesses company resources
while still enabling employees to have
simpler and more intuitive access to work apps and data.
AMEET JANI: That's right.
Employees often work outside the office,
as we know, in coffee shops, hotels, airports,
and from home, so it's important for companies to make sure
that employees access apps and data securely.
YUFENG GUO: So let's just say I'm a chief information
security officer, and I have a lot of employees
who want to access their apps from outside the office,
like you mentioned, and from their personal devices.
AMEET JANI: OK, so you want employees
being productive from anywhere, but IT
wants to make sure that they are controlling
what data they have access to.
So let's take this example.
You have a sales rep using their personal device
and is about to close a deal.
You want it done securely, safely, and successfully.
We can see that our sales rep is using a corporate laptop that's
approved by IT, but they're also using a personal tablet
device that hasn't been approved by IT.
The sales rep wants to be able to use their tablet to access
CRM systems and G Suite, and corporate IT has to allow that.
YUFENG GUO: Right, so the employee
wants to use their personal tablet and access work data.
AMEET JANI: Exactly.
But the problem is that personal tablets
don't have as many security controls
as the corporate device does.
YUFENG GUO: And so can you talk a little more
about the risk of that?
AMEET JANI: Well, the risk is that if an attacker exploits
the weaknesses on this personal tablet--
let's say that they use OS version flaws
and things like that--
they can get access to apps and data
that they shouldn't be able to.
YUFENG GUO: Got it.
So as a CSO, how can I make employees more productive
using these personal devices?
AMEET JANI: Well as a first step, what you want to do
is only give our sales rep access
to apps on their personal device if they're
in the right context.
Using Google Cloud's Access Context Manager,
you can define a policy for these personal devices
to only allow them to access some apps while the employee's
in the office.
So if you go to our sales rep in the office,
they can now access their CRM system and G Suite applications
from their personal device and from their corporate laptop.
YUFENG GUO: So that lets my sales reps
be productive on their personal tablet
while they're in the office and can be on a secure network.
AMEET JANI: That's right.
YUFENG GUO: And so this is great for my employees that
are working in the office all the time.
But then what about when they leave the office?
AMEET JANI: Good question.
It's common today for our employees
to be working outside the office.
Let's say our sales rep goes to the coffee shop,
and they log in using public Wi-Fi.
This is a problem because they may not be a secure network.
YUFENG GUO: Right, public Wi-Fi is often not so secure.
AMEET JANI: Public Wi-Fi might be secure,
but we need to be careful.
Otherwise, attackers can exploit vulnerabilities
in these networks to get access to users' devices
or they could easily look over users' shoulders
to see sensitive data or password information.
YUFENG GUO: Yeah.
So the way I've always done this is just by logging into a VPN
when I'm accessing one of these networks.
AMEET JANI: Well, VPNs might do the trick.
But they can be one-size-fits-all,
and they can be a pain for employees to log into.
We have another way of giving context-aware access
to applications using Google Cloud.
Using Google Cloud Services like Identity-Aware Proxy in Cloud
Identity, we can gather information from the employees
context, like the device they're logging in from,
the type of network they're connected to,
and we can set up a rule that blocks access
to sensitive applications on personal devices
when they're in a situation like this using public Wi-Fi.
So if our sales rep moves from the office to the coffee shop,
this triggers a context change in Identity-Aware Proxy
in Cloud Identity.
And when our sales rep tries to access their CRM or G Suite
app, they can access the app from the corporate device
because this is a more secure device.
But for their personal device, the app
is blocked because of this heightened security need.
Why don't you give it a try?
YUFENG GUO: All right.
So OK, so that's blocked.
AMEET JANI: Here, you can see it's failed.
And here, the access is granted.
YUFENG GUO: Got it.
So as employers move around and their context changes,
that changes their access to different apps.
AMEET JANI: Exactly.
So now, the sales rep can still be
productive outside the office, but their access
to certain apps on certain devices are restricted.
And as a CSO, you can see granular controls
to add heightened security in some context.
Let's say your sales rep is closing a deal overseas
and needs to travel to an international country
that your security team has deemed
to be a restricted country.
If the sales rep accesses their app
from a network like the hotel Wi-Fi,
attackers may exploit vulnerabilities
in the network to access the sales rep's app and data.
YUFENG GUO: All right, so I should just
lock down all access to apps when employees are traveling
to these countries.
AMEET JANI: Not necessarily.
It's often the case that executives
need to be able to work from these higher security threat
countries, and they need to access some sensitive data
to get work done.
Using Google Cloud, you can add an additional level of security
for high-risk context like this.
In Access Context Manager, I can set
a rule that blocks all access to apps except G Suite
Gmail from these countries and only from a corporate device.
Why don't you give it a try?
On the personal device, why don't you try accessing Gmail?
YUFENG GUO: Sure.
I'm going to flip over to Gmail here.
And say try to type in Gmail, and I hit Enter.
And it looks like we're blocked.
AMEET JANI: You're blocked.
But from a corporate device, you'll
lose access to the confidential data.
YUFENG GUO: OK, so no CRM access for me.
AMEET JANI: Exactly.
But when you check your email, it'll continue to work.
YUFENG GUO: Great.
AMEET JANI: So now when the sales rep
tries to access this application from the corporate device,
everything works as planned.
And the only app they can access is, of course, the G Suite app
because that's what's been termed to be safe.
YUFENG GUO: So that means the sales rep doesn't have access
to all the apps with sensitive data in this country,
but they can still be productive.
AMEET JANI: Exactly.
So now, even in these high-risk context,
you can better keep employees productive
and your apps and data safe.
YUFENG GUO: This is great.
I think it might finally be time to get rid of that Legacy VPN.
Ameet, thanks so much for talking to us today
and teaching me how to keep a mobile workforce
productive and secure.
AMEET JANI: My pleasure, Yufeng.