ERAN FEIGENBAUM: Welcome to Atmosphere Digital Rethinking
Security in the Cloud.
I'm Eran Feigenbaum, Director of Security for Google Apps.
We have this great panel here of experts
through all across Google to talk about security.
Information security has become such
a hot topic with the increase in cyber crime,
the trends in privacy, the changes in regulations.
It's something that businesses can't ignore.
Enterprises all over the world are concerned about security.
And to have a great conversation about information security,
we've brought in four different experts from all across Google,
each a subject matter expert in security
in their own specific domain.
To my far left here, I have Tim Willis from our Chrome Security
Team.
Next up is Adrian Ludwig.
Adrian is responsible for Android security.
To my far right is Stephan Somoygi Stephan
is a product manager in our security and privacy
engineering team.
To my immediate right is Suzanne Frye.
She's the Director of Security, Privacy, and Trust
for Google Apps engineering.
The move of business to cloud computing has really increased.
Companies see the benefits of lower cost,
but also the ability to innovate faster
for users to collaborate.
But one of the big areas of hesitation
is security right Companies are not
comfortable putting their own data into the cloud.
How would you respond to somebody that had that concern?
SUZANNE FREY: I think we're seeing a real sea change right
now with respect to people understanding
that the cloud is more secure than any on-premise solution.
If you just think about it, mathematically, you've
got all these different on-premise solutions
and individual teams trying to do the right thing.
And with any cloud provider, you have the locus
of the best talent, the best expertise centered
on making your solutions secure and your data secure.
If you take a look at our customer base,
we have some of the world's largest banks.
We have some of the most stringent government customers.
We're FedRAMP certified here in the US.
And the fact that we can solve for security
for all those customers is a great testimony
to our capabilities.
But in addition, we solve for something special.
In talking to our customers, it's
our ability to innovate and to bring new ideas
to bear that help enable them to be competitive, productive,
and truly novel, and focus on the things that matter to them.
That's part of our really special secret sauce.
And I often say to people at Google,
security comes in two forms.
It's both traditional cybersecurity,
but it's also security against technological stagnation.
ERAN FEIGENBAUM: That's interesting
because we don't usually think of that second one very often.
We tend to think of the data security.
That's great from a cloud perspective.
How does that change in the Android or mobile world?
ADRIAN LUDWIG: I like that observation
about being too focused on security
to the exclusion of innovation.
I hadn't seen that phrase that way.
But I think one of the changes that we've
seen in the mobile space over the last few years
is that companies are focused, first and foremost,
on innovation, Android being a great example of that.
But we've tied into a security model
that is how people actually consume applications
and services.
So we thought about the web and the sandboxing model that
was used on the web, and we incorporated that in the way
we built applications sandboxing.
And I think the consequence of that is cloud services
are becoming more and more important.
Most applications that are built for Android
have built for mobile regardless of your mobile platform
are really cloud based.
So I think those two are tied together, because both of them
are thinking about innovation first and foremost,
and the security is sort of unlock that innovation.
ERAN FEIGENBAUM: So it seems like cloud
is actually and mobile as a reason for companies
to move to those environments.
Is there stuff that Google's doing that others really can't?
TIM WILLIS: I think it's important to think
of the context in which we're talking in here.
So we have a complex set of systems
that we're dealing with today.
They get more and more complex over time.
We also have adversaries with increasing levels
of sophistication.
So you've got that on one side, and on the other side,
we've got IT managers having to defend their networks.
The problem with defenses you need
to defend everything incredibly well.
Attackers only need to find one hole into your network.
So I think that's where an advantage of moving
to the cloud is that you have dedicated teams
with robust experience.
I mean, Stephan and I were talking about this earlier
that some of the people who I work with
wrote my textbooks in university.
And it's one of those things that I
get to work with these experts and that's all they do.
They focus on security, and that's
one of the huge benefits, in my point of view,
of moving to cloud that's great while we're protecting data
while it's at Google but we have to do a lot of stuff
to make sure the data safe when it's not Google
STEPHAN SOMOGYI: Safe Browsing would
be a good example of something that we
can do at very, very large scale, where we actually
believe that the right approach is
make the entire internet safer.
So we build systems that hunt around and find malware
and find phishing and then we go and report this.
And so an individual consumer can
benefit from this, because the web browser will let them know.
In a cloud environment, enterprises
can take advantage of this data as well
and keep themselves protected, and we take this approach
through a number of different areas, certificate
of transparency being another example,
where we're taking a look at the internet as a whole
and finding ways to keep it safe at scale.
ERAN FEIGENBAUM: So obviously in working with various experts
and then you guys are all experts in your field,
right this encourage us to innovate and come up with lots
of security innovation.
Some of those really actually go beyond
and change security and really move the needle
from what users are used to.
Maybe you can all give me one of those examples that we've done.
SUZANNE FREY: I'd like to talk a bit about security keys.
Security keys have-- Are you going to--
TIM WILLIS: Oh, no don't.
[LAUGHING]
ERAN FEIGENBAUM: Wait you got my collection with me.
You have multicolored ones.
SUZANNE FREY: Nice, almost Google colors too.
STEPHAN SOMOGYI: Indeed.
You need a green one.
SUZANNE FREY: These keys are fabulous.
For the longest time, we have been
talking about two-factor authentication
is critically important for most organizations to implement.
And many customers use Google Authenticator and other apps
like that to generate a one-time pass code.
Those are great.
They're certainly better than nothing.
However, a hardware-based security key,
such as these, just quantum leaps ahead in terms of they're
not hackable and they really do protect our customers
from phishing in a way that basically
the one-time passwords do not.
So.
TIM WILLIS: I think it's an interesting point, Suzanne,
especially talking about the not-so-glamorous side
of the things that we do.
One of those things is encryption for me
like it may not seem incredibly innovative
but we're working really hard to make sure
that all of our traffic is encrypted
at rest and at transit, and one example
where we're being open with that is our HTTPS transparency
report.
Now, you can go to that site and you can see our progress
towards our goal of 100% encryption in transit
through all of our products.
Again, another example would be working with TLS 1.3.
That's the next generation of transport security.
Now, it may not sound glamorous, but we're not only
helping to implement that, we're helping author
the next version, so that shows that we're in the mix
and we know what technologies are around the corner.
A practical application of that would be progressive web apps.
So these low friction web applications
which are designed to help increase engagement
and have an app-like experience for customers and businesses.
We've seen studies how that increases engagement.
And it's fantastic.
It's easy across the board.
Why am I talking about it?
Well, TLS is actually a hard requirement for those apps.
So it's one of these things where
not only are we innovating, we're making sure that security
is baked in from the get go.
And I think that's one huge advantage of Google.
ADRIAN LUDWIG: There's a couple elements about that
that are interesting to me.
One of them is it's not so much that the security itself
is innovative, it's about using an innovative product
to make security available.
One of the things that we did early on with Android
is we thought about the platform stack and go OK,
you need to have verified boot, you need to have encryption,
you need to have sandboxing.
Those are all, I think at this point, almost commodities
for an operating system.
But one of the things that Google brought to bear
was security services.
It's going to be a cloud-connected device,
and we're going to make all of those services
available by default on all of the devices.
And so we started thinking about how
do you bind services into the operating system itself.
So we added things like safety net and verify apps
where there are effectively hooks in the operating
system where we can make sure that we're adding
security dynamically over time.
So we can innovate in security even more quickly
than we can innovate in the operating system itself.
Does anybody know that that's happening?
Not really.
But that's OK, because they're safer
and they're happier as a result of it.
So we the same way that you guys are dealing
with TLS and progress web apps, binding those two things
together just transparently in the background.
STEPHAN SOMOGYI: On the two ends of that spectrum,
there's also transparency.
And Tim, you're already talking with the HTTPS Transparency
Report, but we've been doing transparency
and we've been shining light on ourselves for many, many years.
A couple years back, we did the Safer E-mail Transparency
Report, where we were looking-- first of all,
is there anything that we're doing that we could do better?
And then having looked at that, what
is the rest of the world doing, and it's actually
moved the needle forward.
We are now in a position to say yes,
as a result of shining a light and illuminating the greater
situation on the internet, more people
are using encryption for their e-mail.
It happens across all of our transparency reports
where first we look at ourselves to see if we're doing the best
job that we possibly can, and very often then we
cast our gaze more widely in the outside world
to see what else is out there and if we
can help people improve things.
ERAN FEIGENBAUM: Yeah.
Transparency actually a really big part
of moving to the cloud.
Especially we see that a lot with our enterprise customers,
right?
I mean.
SUZANNE FREY: Absolutely.
If you think about it like anything,
if you don't know enough or have sufficient information,
how in the world can you make a decision?
How can you run your business?
And I do think that transparency has
been one of the biggest blockers to adoption
across all cloud products.
We've been investing in multiple areas
to ensure the transparency is front-and-center to what we do.
We engage third-party auditors to help ensure and provide
certifications against certain standards
like ISO 27017 and 18.
Our fed grant process is also disclosed
to the government and leveraged uniquely
in terms of making sure that across our company
we are aware of vulnerabilities and addressing them quickly.
And I think just in general providing information
to the end user about whether or not
their employees have had a password violation
or have had some suspicious activity
or giving them greater reporting detail.
And I'm the first to say that we still have some work
to do in the reporting front, and I
think every cloud provider does, but we're working really
hard to improve the degree that an administrator understands
everything that's happening within their company
and can take appropriate action.
ERAN FEIGENBAUM: So a lot of what
you guys all talked about, whether it's transparency
for our enterprise customers or for all users or some
of the innovation in Android, we really wouldn't
have expected years ago.
I, at least, wouldn't have predicted that.
You guys are all experts and very deep in your field.
What would be your security vision?
What's going to change?
What's going to make our lives easier for our users?
STEPHAN SOMOGYI: I think a lot of the security,
as we've talked before, needs to stay invisible,
and in some cases, can be a little bit counter-intuitive.
So a couple months back, we released
a product called OnHub, which is a home networking router.
And one of the things that it's particularly
counter-intuitive about it but which
is adding a lot more security is the fact it's cloud managed.
So all the technology that we devise to protect our users
accounts-- like Suzanne was talking about with the security
key-- all of that benefits the user because the Google
account is the way the user starts
to manage their device at home.
So as we connect all the various pieces of our security puzzle,
they all work together and suddenly you
have a device at home which is actually
cloud managed and cloud secured, which
is not the way it was even a few years ago.
There's a distinct security benefit now.
ADRIAN LUDWIG: I'd like to talk a little bit about the elephant
in the room with respect to security, which
is this dynamic tension between access to data
and keeping it secure.
One of the very hard things for most enterprises
is to say listen, someone else is
going to be the governor of our data-- steward of our data,
perhaps I should say, and what is that company
going to do with our data?
And I reference audit reports and certifications
that we commit to every year.
However, machine learning is one of the most exciting things
that's happening in the field of computer science today.
And machine learning requires training data to perform.
And obviously, with customers sharing data with us,
we could just take that data and go
nuts, which would be irresponsible of Google
and would really kill our vision overall.
But I do think solving that problem
and putting our customers in control
of what data we can use to enhance the way that they work,
to improve productivity, to reduce the cost,
and to understand how competitive they are
in a global landscape for a given industry-- that's
super-exciting stuff.
So I think finding that gentle balance between making sure
that customers can maintain absolute control over who
sees their data, when, and uses it for what,
is one of the most exciting problems we have to solve,
because it's going to bring tremendous advances to mankind.
ERAN FEIGENBAUM: Wow.
That's impressive.
TIM WILLIS: I feel like I'm the guy who's going
to talk about the boring thing.
I think it's really exciting that more companies are moving,
I think, more deeply into the cloud.
For some background, before I joined Google,
I was the sysadmin and an IT manager,
and so I caught the security bug--
pun intended-- and ended up joining an incidence response
team.
So a lot of what I was doing was rolling out
to companies and departments who were being hacked and helping
them clean up their networks helping them rebuild up
their defenses and kicking the miscreants out.
And it's one of these things where as we mentioned earlier
it's just going to get more and more sophisticated,
and it's harder that moving to the cloud
actually buys you the Google's security team in a sense.
It gives you the protection that we're offering.
It lets you not have to worry about that.
And one of the great advantages of that is as an IT manager,
I don't have to worry about that.
I can sleep a little bit better at night
knowing that Google's got my back when it comes to security.
ADRIAN LUDWIG: I think it's been interesting talking with folks
and getting a little bit different perspective.
Even in the last minute or two, we've heard discussion
about hardware security, and we talked about machine
learning, and pulling in data from different places.
Google every conversation you learn a little bit something
new.
And I think that's one of the key things
that the security industry is going through right now.
We're beginning to a point where there's
enough maturation in all of our products,
where there's enough data that's being pulled in,
enough ability to analyze that data,
where we can actually start to make good decisions.
For generations, really, from a technology standpoint,
we've been relying on assumptions
about what good security looked like,
which things you need to be worried about, what
risk is likely to hit you.
But now that people are moving to the cloud,
now that we have operating systems like Android
where we're trying to deploy security
solutions across the entire ecosystem,
we get a lot of data.
We can analyze that, and we can start
to make really good decisions.
So I think that's the thing that I'm
most excited about over the next few years
is we're going to get to the point
where as professionals, we can actually
understand risk and make really good risk-based decisions,
which isn't something we've been able to do in the past,
and it's not something that is possible
if you're not in the cloud, if you're not on mobile.
So that's what I'm really excited about.
ERAN FEIGENBAUM: The one thing that's
really in common with everything everybody
said is having a large security team that's capable
and has the expertise to really ingest all that,
to be able to do the things for you on the cloud
or to use all that data that now we
have to make products more and more secure
or to develop that machine learning.
So hopefully, this was a good insight for everybody
to hear what some of our security leaders at Google
are thinking about, what they're working on,
and what they're working on in the future.
So thank everybody for taking the time
and listening in to us.