[MUSIC PLAYING]
MAX SALTONSTALL: Welcome to "Architecting
with Google Cloud."
I'm Max Saltonstall.
And lately, I've been thinking, security
is a constant challenge in the Cloud and never fully solved.
Most companies work with a variety
of vendors, and platforms, and solutions
to keep their people as safe as possible.
Today, I'm pleased to welcome Mason, from Palo Alto Networks,
to talk a little bit about how their solutions work well
with Google security products.
Hi, Mason.
Welcome.
Can you tell me a little bit about who
you are, what your role is, and what you're doing right now?
MASON YAN: Thank you, Max.
My name is Mason Yan.
I'm with Palo Alto Networks for about three years.
I lead the Google Cloud Alliance Technical Team.
My team has been building better together solution
with Google Cloud.
We help customer use Palo Alto Networks and the Google Cloud
together.
MAX SALTONSTALL: That's awesome.
And Palo Alto Networks and Google
both have a lot of different security products.
So Palo Alto Networks can help in many ways
and can integrate with Google, right?
MASON YAN: Yeah, that's correct.
So we promote a cybersecurity platform approach.
We cover across the [? cost ?] security, network security,
[? start ?] the access--
secure access service edge, which allow all users access
from anywhere security.
We also cover endpoint security and security operations.
The benefit of the platform approach
is to allow customer use consistent security policies,
eliminate gaps.
Of course, you know the scale issue has been challenging
in the security industry.
You can never hire enough security professionals, right?
We try to do automation as much as possible.
We try to help customer solve 95% of their alerts
automatically, so the customer can really focus on the 5%.
MAX SALTONSTALL: That's awesome because it
sounds like it's going to save me time and energy
and give me better security.
And if I recall, this partnership
between Google and Palo Alto Networks
has been pretty darn successful, right?
MASON YAN: Yeah, that's correct.
We are very proud that Palo Alto Networks was awarded
as the Technology Partner of the Year for the past three
consecutive years out of thousands of Google Cloud
technology partners.
MAX SALTONSTALL: Sounds great.
And we all love it when everything works perfectly.
But what happens when something actually goes wrong?
And how are you able to help me with some of these solutions?
MASON YAN: Yeah, as you know, no matter
how good your security solution is, the breaches happen.
When it happens, you want to minimize the damage, right?
So you race against the time.
That's the life at security operations.
The tools like Cortex XDR stop breaches because it does--
it not only has the visibility to your endpoint,
but also to your firewall in the network
and your Cloud asset and security events in your Cloud.
MAX SALTONSTALL: So getting that visibility helps me respond
and helps me minimize the blast radius.
Can this help me against both small hobbyist attackers
and big professional hackers?
MASON YAN: Yeah, that's the goal, right?
So you must have heard of APT, Advanced Persistent
Threshold, the most sophisticated cyber criminals.
So they are equipped with advanced attack software
techniques and create--
they're creating a tremendous challenge
to security professionals.
So how would we know our cybersecurity solutions
is robust enough to protect us from APTs attack?
So industry uses MITRE ATT&CK evaluations.
The evaluation, it really test the user, test the solutions,
like if the solution could detect and protect
from ATPs attacks.
So the evaluation emulate the real-world attack
sequences APT uses.
And Cortex XDR was ranked the highest protection
and visibility combined score out of 29 solutions last year.
Cortex XDR blocked 100% of attack
in the protection phase against both Linux and Windows
endpoint.
MAX SALTONSTALL: Wow, that's fantastic.
So let's say I'm at a company, and we want
to operate in a zero trust way.
But I also need to understand, what's
the current state of all these different computers
that my people have, especially when many of them
are bringing their own devices, they're working from home,
and I can't necessarily reach out and touch
and check and update those?
So can you help me with that?
MASON YAN: Yeah, so for the zero trust,
Google has been building a very effective access
control for the Cloud resources and the SaaS
applications, which is part of the BeyondCore architecture.
Context-aware access level provide a Cloud native way
to control the access.
I think one of the biggest challenge, as you mentioned,
is to understand the security postures of your endpoints,
right?
And you don't want a compromised endpoint
to access your Cloud resources and SaaS applications.
Cortex XDR deploy the security agents to the endpoints.
The agent stops malware, exploits, and ransomware.
Cortex XDR creates alerts, incidents
from malicious activities at endpoint.
Think about if we can just add this endpoint security posture
as part of the Google BeyondCore context
policy, context-aware policy.
So I think we can prevent a compromised computer
from accessing core resources and SaaS applications.
MAX SALTONSTALL: That sounds great.
So by putting some software on my employees' machines,
you're both helping me stop those attacks on the one hand,
and detecting malicious activity to flag
a machine as compromised.
So what's all the magic behind the scenes that's
giving you the information to calculate a health
level for each device?
MASON YAN: Yeah, so the Cortex XDR, they
include a broad set of exploits protection module.
So it could protect you from the malware infection, exploits.
And also, the Cortex XDR could actually protect you
from a malicious file download.
So we pretty much have two phases.
The first, we would just examine the file locally
and use the machine learning abilities
to figure out if this file is first seen,
if it's a known file.
And if the local analysis is not able to figure out,
we have a industrial well-known security service sandbox
service called WildFire.
The file would get uploaded to WildFire.
WildFire should be able to figure out
if we detect some new zero-day malware,
we would notify the entire Palo Alto's install base.
So everybody get a benefit from this analysis.
MAX SALTONSTALL: That's great.
And that sounds like it's going to keep lots of my computers
much, much safer.
So this output also plugs into Google's security system
so that I can make good decisions about how healthy
or how safe one individual client device is, right?
And then that lets me decide whether to let it in or not?
MASON YAN: Yeah, that's correct.
So for that purpose, we joined Google BeyondCorp Alliance
program.
We develop a solution called Cortex XDR endpoint
verification.
So the first release, we pretty much measure three things.
So number one, we want to make sure
the endpoint is protected by Cortex XDR agent.
And number two, the endpoint should not
be isolated by your security admin.
So that means the endpoint is compromised.
So number three, we want to make sure there is a health score--
the health score meet your threshold you set up.
So we calculate the threshold in the first release
by alerts, number of alerts, if the alerts is severe enough.
And the next release, we're going to also include
instance information.
MAX SALTONSTALL: And those alerts and future incidents,
those are based on phishy activity basically, right?
MASON YAN: Yep, that's correct.
MAX SALTONSTALL: OK, so this is going
to make me a lot more secure.
How is it going to help me prevent some compromise
or intrusion?
MASON YAN: Yeah, so our solution,
we automatically update Google's employee management
with the endpoint security posture from Cortex XDR.
Once we have that done, you can create a context-aware access
policy.
Then you can use the Google, for example, IAPs,
maybe the service control to control the access to the Cloud
resources.
And also that same access level, you can apply the access policy
to your SaaS application, including the Workspace
and third-party applications.
MAX SALTONSTALL: So get this agent on all my devices.
Set up some kind of endpoint datastore.
Hook it all up to Google's zero trust posture.
This sounds like a lot of work.
Do I have to do all of that manually by myself?
MASON YAN: We try to make this deployment as easy as possible.
So I think what you would need to do
is just deploy the Cloud function we build
and to your Cloud environment.
And the Cloud function would just reach out to Cortex XDR.
The API and the Cortex XDR would reach out to the endpoint,
get endpoint security posture information.
The solution review would automatically update the Google
endpoint management.
And from there, the access level,
you can fix, or take the magic and prevent
that compromised endpoint access to Cloud resources, and also
the SaaS application.
MAX SALTONSTALL: Great.
So in the unlikely but inevitable event that something
bad does happen, how is this going
to also help me minimize the damage, restrict the blast
radius?
MASON YAN: Yeah, so if anything is happen,
so the first step, the Cortex FDR agent would
prevent the malware, ransomware, exploit
to damage your endpoint.
But at the same time, the Cortex XDR agent
would create alert, create incidents.
And those security posture information
would get transferred into Google endpoint management.
And the Google context-aware access level
will prevent a compromised endpoint
from accessing Google resource and also the SaaS application.
MAX SALTONSTALL: Awesome.
So let's say I want to try this out and move forward.
What should I do first?
MASON YAN: So Cortex XDR endpoint verification
is in private preview at this point.
Contact us at google@paloaltonetworks.com.
We will get you started.
MAX SALTONSTALL: That's awesome.
Thank you very much, Mason, for joining,
and for telling us about some of these really cool, innovative
security solutions.
MASON YAN: Thank you, Max.
My pleasure to talk to you.
Really appreciate you promote the Cortex XDR endpoint
verification for BeyondCore.
Thank you.
MAX SALTONSTALL: If you liked what you saw today
and you want to see more like it,
you can check out the full playlist below.
Please make sure you like and subscribe
to get more content from "Architecting
with Google Cloud."
[MUSIC PLAYING]