[MUSIC PLAYING]
STEPHANIE WONG: Hey, everyone.
Welcome to "Eyes on Enterprise," where
I bring on Googlers to talk about the technology
landscapes that are helping enterprises scale,
adapt, and modernize.
My name is Stephanie Wong, developer advocate
for Google Cloud.
And today I have on Collin Frierson, security specialist
for Google Cloud.
And we're going to be talking about cloud security
and privacy, which is a super highly-requested topic,
so we have a lot to get through.
But Collin is here to talk about our comprehensive security
approach, all the work that we've
been doing over the last 20 years,
and how you can leverage some of those benefits.
So Colin, thanks for being here.
COLLIN FRIERSON: Thanks for having me.
STEPHANIE WONG: All right, so diving straight into it,
I want to talk about how a lot of companies
have concerns over Cloud Security.
They're still on premise.
They're starting to migrate some workloads that make sense.
So, are there any major differences
in how they should approach security
on premise versus in the cloud?
COLLIN FRIERSON: The biggest difference
is, when you're in the cloud, you
get to share the responsibility of security with the provider.
So when you're on premise, you have
to worry about everything from provenance of hardware
all the way through what your software is actually deployed.
When you're using a cloud provider,
you get to share that responsibility.
So there's a lot of things you no longer have
to worry about, depending on which
services you're consuming.
And that's a really good thing.
Enterprises are far more likely to be secure
if they have less things to worry about and offer
those responsibilities to a provider.
STEPHANIE WONG: And of course, a lot of the cloud technologies
have matured over the last five to 10 years.
They still have on-premise technology.
So can you comment on how cloud security has also matured along
with it or how we've been able to adapt
to those new technologies?
COLLIN FRIERSON: I think the biggest difference
there is, because of the size of investment cloud
has in both infrastructure and supply chain,
cloud is able to solve a lot of these problems fundamentally
differently than a traditional enterprise would,
simply because of the scale and nature of the way
you're buying.
Google, for example, has been building our own systems,
provenance from end to end.
So we own the manufacturing and the supply chain there.
So we get to do things from a supply chain logistics
perspective that other companies don't do.
They have to buy from a traditional enterprise
vendor like Dell or HP.
And you have to trust that vendor then implicitly
if you're buying equipment from them.
STEPHANIE WONG: So we've talked about the technology
and landscape a little bit.
But what about security teams?
Because obviously, people are at the heart of a security
approach and so are the tools.
Do you think it's more important that you
have a comprehensive security model that
includes both people and tools?
COLLIN FRIERSON: Tools are a great way to augment people.
But they're certainly no substitute.
So depending on the size of the organization,
I'd probably have very different advice.
For the very large organizations,
it's absolutely critical that they invest in security.
Most of my major Fortune 500 companies,
it's a matter of where they invest.
So I try really hard to make sure they're investing
in things that are effective.
For smaller companies, it's a matter of, will you invest?
And I'm trying really hard to say,
it is worth it to make sure you're
investing in a security team.
Even if it's just a couple of people,
I want them fully dedicated and only doing security.
Because they can make a big difference,
and they can also make great recommendations on what tools
they need, what risk the company is likely to face.
But you wouldn't believe the number
of mid and small companies that have
half of a person dedicated to security
and just hope nothing goes wrong.
We have a nice saying internally here at Google.
It's hope is not a strategy.
STEPHANIE WONG: Definitely not in securities.
COLLIN FRIERSON: No, definitely not in security, not even
for SREs.
Hope is not a strategy.
STEPHANIE WONG: One thing that I've also heard and talked
about with customer is automating security practices
as much as possible-- like, for example, building compliance
as a checkpoint in your CIC process
before deploying, things like that.
That probably helps to create a more lean security team.
COLLIN FRIERSON: Absolutely.
It is critical to have automation in place there.
A lot of times, people get really worried when we say,
oh, we're to automate remediations to incidents.
Because people go, well, wait.
I don't want you turning things off or shutting them down.
I say, well, what would an analyst
do if they saw an incident like this in their SIEM.
Well, they'd go get more information.
OK, how do I automatically get you
that information so you don't have to manually go get it?
And if you know, well, nine times out of 10,
I take this action, how can I just take that action for you--
except in the one out of 10.
Maybe I wake you up when I take that exception
or when it doesn't make sense that one time out of 10.
So reducing the total volume of events
that analysts have to respond to is really important.
And then trying to make them as fast as possible
is also critical.
It's almost as important to filter out noise.
So we know there's a lot of security tools out there.
And analysts can spend just as much time trying
to filter through what is a signal but not really an event.
So automating that process can be just as
important to make sure that they're
spending their time on things that are really critical.
STEPHANIE WONG: It seems like one underlying principle
that's important here is creating
a more proactive security practice as opposed
to reactive in those cases, as well.
COLLIN FRIERSON: Absolutely.
Again, as you shift to the cloud,
your risk posture is going to change, which
means your priorities change.
And re-evaluating that is something
that not everybody has very much experience in,
because enterprises are within their first 10
years of moving to the cloud.
So re-prioritizing what risks you're
likely to face as a business is really important.
And then focusing your time and energy on those things
is critical.
STEPHANIE WONG: All right, so phishing--
I know that's been a huge topic in the last couple
of for the start of breaches.
How do we actually categorize how severe of a problem
this actually is?
COLLIN FRIERSON: It's a big problem.
There's been several high-profile breaches
in the last couple of years that started with phishing.
And we think about 85% of all cyber crimes
initiate via phishing.
STEPHANIE WONG: So I've heard of these tests
that I know I've seen in my past companies
as well, where they send you an email
to try to test your employees and see if you'll
give any log-in information.
Do people still use that?
Does it work?
COLLIN FRIERSON: You'd be surprised.
Everybody still does those.
But we have not seen great results
in terms of getting people to be better at this.
It turns out, about 18% of people
will fail those exams every time.
It's just a question of which percentage failed.
Well, while companies still certainly do those exercises,
I'm not a big fan.
I don't think they actually make the company any safer.
STEPHANIE WONG: Can you talk about what
we do here at Google?
Because I know we have a different approach to that.
COLLIN FRIERSON: Yeah.
So our approach has been the employee cannot be relied upon
to not put their credential into a phishing site.
So we had to build technology to solve
the problem for the employees to keep them safe.
So we built a technology that's called a hardware security key.
It's based on an open source standard called FIDO.
And we require that everyone use these here at Google.
So whether you're an employee, contractor, or a vendor,
you have to have one.
And it has driven our incident rate to zero.
STEPHANIE WONG: So, what's a bad example of someone suffering
from a phishing attack?
Have they actually lost money from this kind of problem?
COLLIN FRIERSON: Yeah, actually, I
worked with a hospital whose CFO was phished.
And the phisher, what they did was
they emailed their purchasing department and said,
hey, I need a purchase order.
We are trying to close a M&A deal.
Wire $80,000 to this account really quick.
And I'd be so grateful.
Please email me if you have any questions.
And the accounting department, trying to be helpful, agreed.
So they did what the CFO asked, even though it wasn't really
the CFO.
It was the phisher--
and all because he lost access to his email.
And so $80,000 gone just like that--
and it happened twice-- not once but twice.
STEPHANIE WONG: At the same place?
COLLIN FRIERSON: At the same place.
STEPHANIE WONG: Wow.
COLLIN FRIERSON: And after the second time,
they give us a call and said, we really need help fixing this.
STEPHANIE WONG: Yeah, this might be a problem at this point.
COLLIN FRIERSON: This is getting really expensive.
STEPHANIE WONG: So tying this back to cloud,
I know that you can obviously use this with Google Cloud.
But can a company implement this into their production running
systems, as well?
COLLIN FRIERSON: Absolutely.
So it's an open standard.
So Google, of course, supports it in every account we offer.
Other major cloud providers are picking up support, as well,
in various forms.
And keys are designed to be used many to many.
So if you have one key, you can use it anywhere
on the web that supports it.
And the number of places supporting is going up rapidly.
STEPHANIE WONG: We talked about the shared responsibility model
when it comes to security.
I know a lot of people have concerns
over moving to the cloud.
And you mentioned that it can actually help
a company's security posture.
Can you talk more about how it can actually help?
COLLIN FRIERSON: Typically things, enterprises
have an entire staff of teams just to do patching.
And as you move on to cloud services,
many of the managed services don't
require you to do that at all.
It's the cloud provider's responsibility.
Great example for Google is actually
the Heartbleed vulnerability back in 2014--
affected everyone on the internet, was really scary.
Google actually had a team that discovered this.
So we found it.
We helped the Red Hat develop a fix back at the time.
And we actually had the entire system patched in 46 hours--
so all of Google's infrastructure,
multiple places.
And that was a huge deal, especially because,
when you look at the rest of the internet, 90 days later,
still about 30% of the internet was still
susceptible to that risk.
STEPHANIE WONG: Yeah, it ties back
to what were saying earlier about having
the resources, and the network, and everything
that we have here to be able to run through these changes
as quickly as possible.
COLLIN FRIERSON: Yeah.
Well, and Google, again, we invest.
So we understand that our business
is providing world-class secure infrastructure.
So when there's a vulnerability like that,
we have all hands on deck, and we've trained, and gotten ready
for this.
STEPHANIE WONG: So companies have a lot of concern
over cloud providers potentially using their data
or their customer's data.
So what can we do to guarantee that that doesn't happen?
COLLIN FRIERSON: It's a common concern.
I would break it down into three classes of things
we do to try to help.
The first one is audits.
So we go through really rigorous audits
to demonstrate that we're not using data
for any purposes other than to render the service.
So specifically, it's like ISO 27018, which
is a cloud privacy standard.
The second one is every cloud provider
has contractual clauses that say,
we will only use the data to render the services
as described.
And the data belongs to the customer.
So Google has no intellectual property rights contractually.
One of the other things we launched last year
was a service called Access Transparency,
which is a technical control.
And what that allows us to do is produce
logs any time a Google administrator needs
to enter a customer's tenant to perform something,
like whether it's a port request or maintenance.
But we show technical evidence of that every time,
and it's immutable.
We were first in industry to do something like that.
And also available is now a customer
can control what types of access they're going to permit.
Maintenance is OK, but support's not
OK for a given set of their environment.
STEPHANIE WONG: So when we were talking about phishing,
you mentioned the security keys.
And that's part of a larger picture of our overall security
philosophy, something called defense in depth.
COLLIN FRIERSON: So the defense in depth
is how we think about defending ourselves from really
sophisticated adversaries.
So what we do is we think about a problem.
We build a control.
And we build it as the best we can.
And then the next step is once we
think it's perfect to assume it's broken.
So let's assume this is going to break
in a way we can't understand or figure out yet,
and we have to build another separate, entirely
independent control accounting for this one is now broken.
So when we're thinking about a problem set,
we want there to be multiple things that
have to all fail simultaneously in order for data
to be exposed.
So that's what we mean by defense in depth.
STEPHANIE WONG: And that also means, especially even
internally at Google, we don't use a VPN,
because we have all these layers in place
to prevent any bad actor from being
able to access beyond what they're
supposed to be able to access.
COLLIN FRIERSON: Right.
VPNs would be, like, a single point of failure.
It's much better to have 10 browser tabs, which
means 10 different encryption channels,
in order to send data independently to each one.
STEPHANIE WONG: One of the interesting things
that developers care about often is being
able to have cloud governance.
So they want to be able to work productively
in the cloud, leverage things like Kubernetes,
and cloud native technologies.
Yet, security teams also care about maintaining governance
and creating card guardrails in place.
So, how can you have a balance between both?
COLLIN FRIERSON: Yeah, this is the practice of DevSecOps.
The basic premise is you want to make sure that your security
team is very close to your developers,
so they really understand what tools they're using,
what they need to be productive, and the security team
is not blocking them by writing a policy that
doesn't get looked at until someone screams loud enough.
Having security team members close to those developers
is key, because they'll understand
what they're blockers are, what they
need to do to move forward, and where they can strike
a balance between what's risky to the company versus what's
actually going to make the company productive, and money,
and all that fun stuff.
STEPHANIE WONG: I think, with a lot of enterprises,
they have a lot of organizational structures
in place already.
So how have you seen companies be
able to restructure that so that they can work
more closely with developers?
COLLIN FRIERSON: The best teams I've seen
are the ones where the security person is embedded and has
a dotted line report to the developer's manager.
So they have the same goals.
They go to the same team meetings.
But they also get security saying, hey, don't let
them go off the reservation.
We still need to make sure that the guardrails are in place
and we're following this basic operational model.
STEPHANIE WONG: So companies obviously want
to maximize protecting their sensitive data on the cloud.
And they take advantage or have heard
of things like Zero Trust, parameter lists.
Do we employ those kind of concepts here at Google Cloud?
COLLIN FRIERSON: So last year, we
launched a service that lets you build perimeters round
your APIs, which, again, is much easier to do
than trying to manage perimeters around IP addresses.
And we also have, again, layering controls
on that defense in depth strategy
to make sure that, in order to access sensitive data,
there must be five gates that are passed through.
But we can still check for all of the things
that an enterprise security team would like.
What device are you on?
Where are you coming from?
What time of day is it?
Have I seen you on this device before--
things like that.
STEPHANIE WONG: I want to talk a little bit about some
of the announcements we heard at Next last year and things
like Access Transparency, which you mentioned,
and external key management.
Do you mind going into it?
COLLIN FRIERSON: Sure.
So this is all about us giving evidence to customers
that their data is not being used by Google for any purposes
other than to render services.
External Key Manager is really targeted for major enterprises.
So it's a way for them to retain ownership of their keys
on premise while still interacting
with Cloud Services.
It's a first in industry, where they
have to maintain their existing key infrastructure on prem.
But we actually get to programmatically interact
with that system through cloud, which means, if at any point
they decide they don't want to use cloud anymore
and they turn off their key services on prem,
all the cloud services immediately stop working.
STEPHANIE WONG: We can't talk about security
without talking about compliance.
We know that different industries
like banking versus health care has different regulatory needs.
So how are we able to meet those concerns?
COLLIN FRIERSON: Yeah, so at Google,
we decided everyone should have access
to secure infrastructure.
So we built Google Cloud on top of what
we consider the most technically sophisticated and secure
infrastructure and then built a compliance and audit
program on top of that.
So it means, whether you're in health care, or life sciences,
or in banking, or even in government
in the federal space, we can meet your regulatory needs
with the same platform.
STEPHANIE WONG: Regulatory compliance
is obviously one way that we instill trust in our customers.
But we also have to meet the changing
legal needs of each country.
I'm sure those constantly change.
So, how are we putting an effort into adapt to those?
COLLIN FRIERSON: Yeah, this is a huge effort.
Whether it's regulation and rules in the US,
versus Australia, the EU, Japan, every country
has rules about use of data and privacy.
And Google's stance here is offering
the most secure and private platform
we can and, again, meeting the regulations once we've
done that.
So in most cases, like in the GDPR,
for example, most of the work we had already been doing.
And it was a matter of, well, how
do we acertain show this to the EU regulatory bodies?
Same thing for HIPPA--
we already take data privacy more seriously than HIPPA does.
We just need to demonstrate that what we're doing
meets the spirit and the technical requirements
of those rules.
STEPHANIE WONG: Now, coming from a regulatory perspective,
how do companies actually adapt to those changing
legal requirements, like GDPR, CCPA, those?
COLLIN FRIERSON: The cloud provider actually
helps quite a bit, because they take
on some of the regulatory risk and can help with compliance.
Although, we certainly don't do everything for the enterprise.
The enterprises I've seen that have been really worried
about this are very quickly accelerating their adoption
to cloud, because they can now share this liability
with the cloud provider.
STEPHANIE WONG: All right, so we just talked about a lot
here with contracting and regulatory requirements.
But bringing it back to the larger picture,
a lot of the sophistication of our adversaries
is constantly increasing.
And we have a lot of tools out there
that you can leverage to protect your environment.
What can you say to an enterprise that
just simply wants to keep up with that dangerous world
out there?
COLLIN FRIERSON: Yeah, the big one
is, get the cloud provider to help you with as much
as you can take on.
Most enterprises' core business is not security and technology.
So if that sounds like you, make the cloud provider do as much
of it for you as you can.
And then try to reduce the number of tasks
that you as an enterprise are responsible for.
So make the cloud provider encrypt for you.
Make the cloud provider provide systems
that our GDPR compliant, so you can
write policies that are easier to enforce, rather than have
to enforce systems, too.
STEPHANIE WONG: So, what can a company actually
do today so that they can start improving their security
posture?
Or those who are already bringing on Google Cloud, what
can they do to start leveraging some of the tools
that you've mentioned?
COLLIN FRIERSON: For cloud customers,
the thing I would recommend is log into Security Command
Center.
And start going through what tools we have available there.
It's a great way to look at, gosh,
did I misconfigure something?
Do I have environments that have a known exploit that's
currently active?
And we provide a lot of those signals out
of the box in the platform.
So start there.
It's a great way to start triaging.
And also, take a look at our security blog.
So we publish periodically.
What are some of the best practice for enterprises there
and how to mitigate certain threats.
STEPHANIE WONG: Well, thank you so much.
We covered a ton.
So I appreciate you being on the show.
COLLIN FRIERSON: Thank you for having me.
STEPHANIE WONG: So everyone, if you have any stories
or anecdotes about your own security challenges,
how you've been able to address them,
or if you've been able to use some
of the tools we talked about today,
let us know in the comments.
Take care.
And join us next time for "Eyes on Enterprise."
[MUSIC PLAYING]