CARTER MORGAN: Welcome to "Cloud Security Basics," a new series
where we explain the ins and outs of securing
your application on Google Cloud.
Sound fun?
Then stick around, because in this episode,
you'll learn how Google Cloud protects customers' data.
[MUSIC PLAYING]
[DIALING]
BRAD ACTOR: Hello, cloud detective.
You may have answered basic questions about platform
security, but what do you know about how Google Cloud secures
data inside of its platform?
As you hit send on your keyboard and send data over the network,
one of my hench people could intercept that data,
or I could plant malware inside of your system
to nefariously do my bidding.
What can you do to stop that?
For your sake, I hope you know the answer to my question.
CARTER MORGAN: OK, here's what we know.
This comes down to securing data at rest
and securing data in transit.
When Brad Actor talks about a malicious service
inside of your system gaining access to your other services,
there are a lot of ways Google protects from that.
For one, to keep data private and secure,
Google logically isolates each customer's data
from that of other customers and users,
even when it's stored on the same physical server.
As Google is managing this for its cloud clients,
it protects them from employees abusing their access.
Only a small group of Google employees
ever have access to customer data.
Additionally, Google doesn't scan customer data
for advertisements or sell it to third parties.
And then if customers delete their data,
Google commits to deleting it from their systems
within 180 days.
Finally, Google provides tools that make it easy for customers
to take their data with them if they ever choose
to stop using Google services.
These are just a few examples of how
Google Cloud protects customer data that
lives in Google Cloud.
Let's look at a few more.
So how does Google Cloud protect from data being intercepted
as it's sent over the network?
Before we answer that, let's talk about data at rest.
When users store their data in Google Cloud,
the various Google Cloud Storage services
can be configured to use keys from a central key management
service to encrypt data before it's
written to physical storage.
Performing encryption at the application layer
allows the infrastructure to isolate itself
from potential threats at the lower
levels of storage, such as a malicious disk firmware.
Other layers of protections are also used,
such as hardware encryption.
But once data leaves Google's secure server,
customer data must make several journeys
across devices, known as hops, across the public internet.
The number of hops depends on the distance
between the customer's ISP and the solution's data center.
Each additional hop introduces a new opportunity for data
to be attacked or intercepted.
Because it's linked to most ISPs in the world,
though, Google's global network improves the security
of data in transit by limiting hops
across the public internet.
All traffic is routed through custom Google front end
servers.
Google front end servers are used to detect and stop
malicious requests and distributed
denial of service attacks.
Additionally, GFE servers are only
allowed to communicate with the control list of servers
internally.
This default deny configuration prevents GFC servers
from accessing unintended resources.
As the data moves along the network,
Google uses cryptography to ensure the data is private,
unchanged by any third party, and is being exchanged
between trusted partners.
These cryptographic features are encapsulated inside
of the Google Cloud RPC mechanisms.
So they are available to other application layer
protocols, such as HTTP.
This provides application layer isolation,
and removes dependency on the security of the network path.
Encrypted interservice communication
can remain secure, even if the network is tapped
or a network device compromised.
On top of that, Google uses industry standard firewalls
and access control lists, or ACLs,
to ensure network segregation, adding
another layer of protection to sensitive networks.
Lastly, since Google is using the same infrastructure
to provide to its users, the same DDoS and man-in-the-middle
protections we talked about previously apply here,
which means I know the answer to Brad Actor's question.
BRAD ACTOR: Hello, detective.
I see you've been busy and solved my little question.
Once data is stored in Google's data centers,
what's keeping it safe?
Very good.
You found the crux of the argument.
Google has protections in place to store data
in transit and data at rest.
Data stored on Google's server is only
ever accessed by a Google employee on a need
to know basis.
Once data leaves Google's data centers,
there are a few tools Google puts in place
to protect customers' data, like custom networking
hardware, interservice encryption,
and interservice ACLs.
Very good.
You've answered today's question, but are you ready?
Because next time, I want to see how your platform handles
physical security.
CARTER MORGAN: So that's it.
Another episode of Cloud Security basics.
Next episode will focus on how Google Cloud secures the data
centers and hardware.
In the meantime, if you want to take a deeper dive in how
Google secures its users customer data,
then check out the article linked in the description
below.
Stay tuned for the rest of the "Cloud Security Basic" series,
because when it comes to security,
you can't let bad actors win.
[MUSIC PLAYING]