EP102 Sunil Potti on Building Cloud Security at Google

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us for the final episode of 2022. Your hosts here, as we've been all this year and last, are Timothy Peacock, myself, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, our tamed analyst and now senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. You can also find us on the general Google podcast page at cloud.google.com/podcasts. If you like our content and want it delivered piping hot every Monday, please do hit that subscribe button. You won't get us next week because we're going to be on hiatus until January, but ordinarily we come out every Monday. You can follow the show and argue with us on Twitter as well, twitter.com/cloudstackpodcast. If you're feeling podcast withdrawal over the next couple of weeks, you should check out the curated playlists that Anton and I have put together of some of the fun episodes we've covered in a bunch of different areas. Anton, this episode is special for a lot of reasons today, but in part because of who our guest is. Who do we have today?

Well, let it be a secret for another 2 minutes, but—

Oh boy.

I don't know. I don't want to joke about it, but I think it's a boss of one of us.

He is definitely my boss eventually. Yes.

Yes.

Yes. I thought this episode was great because more than once, Sunil— well, I gave it away, listeners.

You did.

Sunil Potti, my GM, leader of the security business here at Google Cloud, referred to the security wine. And I like the idea that all of us cloud security Googlers are slowly turning Google water into cloud security wine. I think that's great. So perhaps with that cheery holiday image, Let's welcome Sunil to the podcast. Today we are joined by the man, the myth, the legend, Sunil Potti, VP and GM for Security here at Google Cloud. Sunil, I've actually been at Google Cloud longer than you, fun fact, and part of my time was before you arrived. One of the biggest shifts I've seen in my time at Google was the shift we had when you came. We were previously, you know, building security because we were good little Googlers who thought that was the right thing. And now we have this business and some revenue and some serious industry point of view going on here. So how did you make this cultural shift happen?

Obviously, I contributed to it. It required the broader team to sort of collaborate, come along for the ride as well as drive it. But I'll just tell you at a high level, when Urs and I were talking about me joining Google, one of the things intuitively I felt, even though I'm I haven't been in the security market per se, Tim, was, you know, I was in the infrastructure market and lots of infrastructure was being consumed for security use cases. And secularly, it just felt like it doesn't matter whether there's an uptick or a recession. We all think about a few markets being quote unquote recession-proof, right? But I think the part that both led me to Google as a bet that we would be open to capitalize on this long-term cyber trend by taking stuff that we had built to secure Google. When I say Google, I mean Alphabet, YouTube, everybody, not just GCP, and make it available to a larger surface area than we currently have, which at that time was just GCP. And with the spirit that the more we offer some of that goodness to a broader surface area of the world, One, obviously, we can help more people without being restricted to just the GCP surface area. But also, the more they taste the wine that powers some of that goodness that protects Google, the more they'll covet that and maybe enhance or amplify their reason to come to GCP. Okay? Because, you know, when I take a full step back in the last couple of years, what has happened, as you all know, is I've always felt that, look, and I say it now, it looks obvious, but if you remember the big trends over the last 2 decades of like internet, and then there was mobile, and then there's cloud. If you think about mobile in late 2008, 2009, it was viewed initially as a feature of the internet or the desktop, right?

Hmm.

Until Mark Zuckerberg at Facebook or a few folks said, look, we're just not going to create another version For mobile, we're going to create only a mobile version. If you remember those days.

Mobile first.

Anton still uses Facebook, but, you know, I know we don't.

I do.

But that was a bold move to say, it's just not mobile first, it's mobile only, right? And so, that created mobile as a secular, long-term, like, multi-decade market that we all know of. And I think cloud was similar, right? You could have said, hey, cloud was just for backup. Remember the original days? It's just for small workloads. It's an adjunct to on-prem. But now we know. I think the parallel that I draw, and I think this has influenced some of the change over the last few years, is security was similarly viewed as a feature, rightfully so, for internet, for mobile, and for cloud. I think for a couple of reasons, I think we need to view that to be a distinct multi-decade theme, like cloud, like mobile, like the internet. And the few reasons why it's going to become, and sort of becoming depending on who you talk to, but it's only going to amplify. And we've all seen this a little bit, but I think it's going to get amplified is for one, there's a constant, if anything, an amplified theme around the global sovereignty needs for privacy, governance, and so forth. And then there's this other thing that we all talk about, right? That that we are increasingly calling it as a nation-state pivot, which is, hey, in the old world, you had actors primarily for ransomware, for targeted actors hitting up enterprises that are large or small. But in the last year or 2 or a few years, and especially if you ask the Mandiant folks and so forth, there's this increasing but real trend that nation-states also need money.

Hmm.

So, where better to hit those to support their mission than to hit the enterprise? And so, you then get asked the question, look, Other than an Apple or a Google or an Amazon or somebody like that, you don't really have the wherewithal to protect yourself from that new set of seasoned actors, right? And unless every one of those companies that we're talking about that they're targeting become an app on this operating system. And so therefore, everything that protects the operating system can therefore flow to these apps. And that's really sort of like the the genesis for, rather than just protect our platform, if the end goal is all of the customers can eventually be protected against these nation states by becoming apps on these few operating systems where you can actually get the full power of protection that protects Google apps, you need to be able to offer that in a way that they can consume it in place rather than just do a forklift deployment. And so, that's really part of the reason why over the last 3, 4 years, in addition to sort of building all these controls and capabilities for sovereignty and privacy on GCP, we have bottled up some of that magic and brought it to customers so that they can start tasting the wine, modernizing where they are. And so that over a period of time, when they fully transform to cloud, they can hit that endgame that it doesn't matter which nation state is going after them. You know, the full power of Google is protecting them.

I really like this answer quite a bit for a lot of reasons, but I want to pick on something you said towards the end there, Sunil. You talked about forklifts and the wine and the power of cloud. And so when we've got organizations migrating to cloud and we've got them coming with not just their on-prem technology, but their on-prem mindset, how are you thinking about the trade-off between giving people what they think they want, Firewalls, IDS, syslog collection versus what we think they want, invisible security, zero trust, agentless approaches like VMTD. How do you think about those 2 kinds of investment across the portfolio?

Yeah, I mean, I think that's a great question because I think it depends on when— see, that answer would change like 3 years ago to today versus 3 years from now. What I mean is, you know, people have evolved, right? So If you think about pre-SolarWinds, most of cloud adoption was gated by compliance, a few things that are basically saying, look, I've got a little bit of governance and risk and all. I kind of know what I have, whether it's awesome or not. And when I come to cloud, unless I have that MVP that I understand my risk and my posture and so forth, I won't be able to accelerate my workload movement. So, that was more of a a blocker for cloud adoption, all right, for the last 3 years. Today, in the recent times, as we're looking forward, I think to your point, there are enabled capabilities now, like VMTD and the things that we're trying to do there, that are now accelerants because you can now show things to a customer that if you happen to be, quote unquote, this app on this operating system, guess what? Here's how your risk profile increases. not as just the SIEM, because of all these capabilities that you're now leveraging from a portfolio that's built into the cloud operating system and so forth, right? So, that's just an example of now that they've sort of checked the box on unblocking themselves from a compliance and regulatory perspective to move to cloud. Now, I think the next phase is about accelerating to a better posture, right? Which is why I think various of the capabilities that we talked about will come into play.

But it still means that some CISOs and some organizations show up in the cloud with very much pre-cloud mindsets. And again, at our org, Office of the CISO, we do see people who show up with like, where's my firewall? Where's my IDS? How do I copy my data center stuff to the cloud? So, I feel like we need to handle it somehow. I don't know. I'm not trying to suggest an answer, but like, what's the best trick we have? To help those people adopt GCP.

Yeah. What are your Jedi mind tricks at the exec level for getting those people unstuck?

Yeah. For people who insist on the on-prem stuff. Yeah.

Yeah. Yeah. Look, I actually think just like, you know, all of us are, you know, CISOs are human beings and there'll be cohorts and you just need to be thoughtful about, you know, both from us talking to a CISO as well as CISOs talking to clouds. They just have to be a little honest about which cohort they are in. And there's a cohort, for example, and this is just not a personal thing, it's a situational thing, right? So, a cohort of CISO who is a digital native CISO can afford to ride as aggressively as possible on the cloud program, right? Or on the cloud bandwagon. And then, on the other extreme, you have a CISO who has very little footprint in cloud, first of all, maybe slowly even embarking on SaaS. That means it's just not even on-prem. They haven't even sort of internalized what cloud is, right? Forget about security, right? But at the same time, that cohort, if they were breached and they had a breach incident, the way that their mind is open versus if they were not breached and they were in that cohort would be even more extreme, right? So, I think my point is that depending on— there's a spectrum there. We just have to kind of, you know, and I think this is what we do, is to sort of like before any discussion, either us talking to a CISO or CISO talking to us, we try to categorize where a company or their leadership is in what cohort, just so that the most practical approach is adopted. Because an answer to the last cohort can't be just come to cloud because that's too much of a forklift. Whereas, that last cohort, if you went in, to your original point, and you said, look, just build some best practices that now that you've been breached, here's some good tooling that you should use, whether it be zero trust or getting events logged.

Chromebooks.

Yeah, exactly. Then that's a good way to kind of start on that journey on that spectrum without feeling like that they're taking a huge leap forward.

That actually, I like the answer as well because to me, the cohorts is something that's part of life. There would be a CISO who thinks— I mean, I've met CISOs who think DLPs and firewalls are cool new technology in the 2020s, even though some were born in the 1990s, others were born in the early 2000s. But there are some organizations who are sort of encountering them now. So, I think that cohorts is the only answer. So, the next question we have is kind of a little bit of a trick question because you're absolutely welcome to say both or a bit.

Okay. You tell the guest it's a trick question before you ask them the trick question.

Because it's Sunil. He's our friend, right? So we do that. So you have leadership of the security sort of organization and sort of what matters to you more as a leader, secure cloud or security products? Is it more about GCP Workspace security or is it more about SCC, Chronicle, BeyondCorp? Like from those 2 children, which one is your favorite child? That's what we're really asking.

Yeah. In fact, this is the question that comes up just because in the past we only had one. When you have 2, there is attention split on both. And by default, there is insecurities or questions on which allocations happen, right? I actually generally think it's not even like 2 children. It's like you have 2 legs. You can't walk, you can't get to a destination without using both legs. It's extremely hard to walk on one. It doesn't matter what you choose. If I take a full step back, ultimately, remember our thesis, right? Look, you have this nation-state pivot. It's hitting the entire pyramid from a large retail bank to a small credit union. The only way that entire stack of customers can eventually enduringly protect themselves is to become an app on an operating system, right? Remember, that's our thesis, right? So our endgame is that over time, we need people to just feel like they become secure once they've onboarded to cloud. And so therefore, that's the endgame, the true north that we keep in mind. But we know that is not the reality today. We just talked about the customer cohorts, right, on an extreme end. So we need the flexibility to offer up some of this stuff. So, that's why I don't distinguish it as products versus platform or whatever. It's mostly about, can I modernize? Can I get safer where I am on a journey towards becoming an app on your platform? And if you compare ourselves to AWS, that's the big difference is that AWS is like, just come to us and we'll help you with some tooling, independent of what the tooling is. And I genuinely think Our differentiation comes from the fact that if we can help our customers today, tomorrow, and for every day that we help them, many of them actually, their right brain gets stoked to accelerate their journey to cloud while their left brain is actually saying that, okay, I'm actually getting safer and safer and safer.

I think that's a very interesting answer, Sunil. I mean, obviously you missed out on the correct answer, which is that me and my products are your favorite children, but that's okay.

Eventually, Tim, that'll be in that Tim Only podcast, not the Anton and Tim podcast. That's right.

That's right. Since we had that conversation with Anton before we started recording, I want to talk about another phrase you've used a lot, which is invisible security. Is that just the same as building security in? Like my whole crew, we've said, oh, security can't be a bolt-on, it's got to be built in. Is there a gap between invisible security and this kind of rational everyday advice?

Yeah, I think having things built in is a necessary but not sufficient condition for invisible security.

Okay.

Because ultimately, what is invisible security? Invisible security simply says you have to be as secure as possible while being as simple as possible. Because right now, we have security as one of those unique capabilities that the more secure you want to be, the more willing you have to be around complexity. And the whole premise of this vision of invisible security is to break that correlation. And so that's why, yeah, if you have engineered stuff, that's good, but partly it not only helps you make yourself secure, but if done correctly, it sort of hides the complexity. So for example, when I'm deploying a storage bucket of some sort, just having a radio button which simply says, do you want a protected version of this? And behind the scenes, we are doing a ton of stuff.

Right.

around DLP, logging, analysis, and monitoring, and all these are all elements of that. Over time, they should not even be a choice. Every bucket should be a protected bucket, just like all the data is encrypted, right? Right now in cloud. So, that's the essence of invisible security is that, look, we need to make it as simple as possible while increasing the surface area of security. And that's why when you look at invisible security beyond just being built in, we talk about How you want to make sure that things are not just made automated so that we talk about things going from manual to automated operations and all that, but to autonomic as in— and this seems like an overhyped and overloaded term and probably deservedly so, but I'm a huge fan of like, if you just take a step back on this analogy, like, look, if you just think about the automotive industry and you look at the big step function change that has happened in the last— Whatever, recent times. One would say, oh, it's because of Tesla, or is it self-driving, or whatever. But think about it, was it the move from— to electric? Like, if you just use the Tesla example, I actually think that was the first killer app for Tesla to introduce people as onto a new paradigm of a car.

Mm-hmm.

Right? But in reality, what it was was, oh, I had sensors. You know what I mean? Oh, by the way, you know what I mean? Like, I added so many more capabilities, but ultimately what that whole thing did was that the car has become basically a software-driven machine. And once you get into that paradigm, there's so many more apps you can add on to that mode of operation that didn't exist before. And in doing so, security, as an example, people are much more safer. You could argue independent of self-driving, autonomic driving, or whatever, Generally speaking, there's more sensors, there's more indicators. And as long as you have that bigger intelligence because of the data that's being gathered and you're keeping it simple because the system is smart to only figure out what to do, when to do it, and so forth, in an essence, that's the other elements of invisible security is, look, you need to go use data to make yourself smarter rather than just automate some workflows. You need to be able to make things simpler so you're democratizing who can help, you know, a customer in security. It just cannot be a tier, you know, high-end analyst. It could be just like DevOps has become democratized, right? Can you actually democratize SecOps?

You know, it's a great example of that is everything in SCC.

There you go.

Everything in SCC, it just works.

Yeah. But I mean, look, I think the key thing is, in some ways, you know, if you remember, the discussion stemmed from our original discussion on threat detection to where things are, increasingly, the best version of SCC eventually, man, only shows the findings that you need to really take action on.

Oh, for sure.

We're not there yet. We're not there yet, but that's the journey, right? But that's what it— like, if you really map invisible security to a few things, it'll be like, look, we think these are the things you need to pay attention to, and we have recommended actions to turn it off. Do you want us to prove or not?

Yep.

So anyway, so that's the— yeah, yeah, there's a gap between that and building in stuff. Yeah, I love that answer.

And I think if you would call it data-driven, simple but effective security, it would not have the same magic as invisible security. So to me, I think that explanation is very coherent, but I think that I'd stick to the original brand. Invisible security does work as a concept for— it's simple, it works well, And it is based on data, not on hunches. That's pretty awesome. So the next question we have is kind of, I don't know, political maybe? I don't know. Everybody asks about Mandiant. And I think when I think about Mandiant, I still think of the most well-known brand in IR and response, but I also almost immediately jump to services DNA, that it's a company with a lot of top-tier, best-on-the-planet people who do this, but it's kind of about people. So how do we plan to really make the most of Mandiant within our culture? And our culture is building tech.

Yeah.

not really the services culture. How do you marry?

Yeah, yeah, yeah. Obviously, it's been a question that, you know, even pre the Mandiant acquisition, during, as well as post, right? We'll keep iterating on. I think at a very metal level, the way to think about this is security practitioners who have seen especially day zero attacks and the respective remediations are probably, you could argue, in the best seat to suggest next-generation preventative measures because they see a pattern of these day zeros coming around that nobody down in the value chain sees, right? I mean, yeah, eventually our tooling sees it. We can analyze it and all, but having that kind of strategic asset adjunct to this operating system that will help you protect yourself, not not just based on the toolings and best practices within Google, but from what customers are seeing on a day-to-day basis, was the real genesis for the Mandiant synergy. So, our goal, by the way, is to— it's less about services. Yes, obviously that comes in the form of people sort of empowered by technology that we will build in conjunction with Mandiant technology, but it's really getting that insights from the frontline, using that Democratically across every customer so that the time to get to preventative stance gets smaller and smaller and smaller over a period of time. It's never going to go to zero. It's one of those math functions, right? So, that's why you always need that person part. The key part is, is that actually going down because of that connective tissue between people and the technology?

Sunil, I love that answer. We spend a lot of time thinking about connective tissue around here. I have to ask our traditional closing questions because we're tight on time. First, do you have a recommended tip for improving people's cloud security posture? And 2, do you have recommended reading?

I'd say, you know, recommended tip for cloud security posture. I mean, look, I think my read on the situation, because it keeps coming up on cloud security posture management, is I actually think most enterprises, when they talk about multi-cloud versus single cloud, in reality, everybody that I talk to has 60% of one cloud, 30% of the second cloud or something like that, right? So, in reality, you're talking about 2 clouds. And increasingly, you're going to see security posture management being built as a differentiated depth-wise capability per cloud. And my biggest recommendation to customers would be to look at the cloud's native, because this is no different than having a storage capability. capability or a network capability, right? You could argue you could have a multi-cloud network, but this is so central to being depthwise integration that in the next year or 2, you're going to see that, you know, like SEC becomes the default for GCP workloads versus getting enamored by this multi-cloud thing, which I think is more about consolidated reporting and all, which is almost incremental rather than the core value.

I couldn't agree more.

Yeah. Recommended reading: I always go back to Start with Why with Simon Sinek, man. It's an evergreen, awesome sort of ways to kind of look at not just work but also life. Okay, in terms of you know why the why matters before the what and the how.

Sunil, I can't thank you enough for joining us today. Really appreciate the crisp and understandable answers.

Good stuff, Tim and Don.

Thank you. Well, doctor. Thank you very much. And now we are time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @anton_chuvakin and @_timpeagle. Tweet at us, email us, argue with us, and if you like or hate what you hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Thank you, Roni.