EP120 Building Secure Cloud and Building Security Products: Finding the Balance

Secure running.

Hi there. Welcome to Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with your hosts, and catch the occasional live-streamed episode if you follow our show on LinkedIn. Today, we are joined by my boss's boss's boss, and it was a delight to have him. And we're announcing— well, we're talking about something we achieved recently, which is good analyst placement. What else do we cover? Actually, listeners, this is a fun episode. Anton, why is this such a fun episode for you in particular?

Oh, well, you're asking me to almost kind of cause a little bit of a spoiler.

Oh, maybe I won't. No spoilers.

Okay, so for a moment, I felt regretful that I didn't make a certain career choice that I used to make in the past. Okay, I'll go with that. It's cryptic enough.

That's good. You know, listeners, it was really an army of people that came together for the Forrester work, but I want to call out in particular one Googler who, without whom it would not have been possible, and that's Ryan Chen. He wasn't on the show with us today when Jeff was talking about it, but Ryan has been instrumental throughout my entire time at Google in our work with analysts. So Ryan, from one Googler to another, man, could not do this stuff without you. And so with that, let's turn things over to today's guest. I'm delighted to introduce today's guest. He's not my boss, he's not my boss's boss, he's my boss's boss's boss. We've got Jeff Reed. VP of Product for Cloud Security. Jeff, I want to start out with maybe a softball just to get you warmed up, being a VP and all. You've had a long career in software and security. What brought you to Google Cloud for this role? Because I'm sure you could have gone anywhere. Why Google to do security products?

Actually, it was a 2-step process because I was in security and then actually came over from Cisco to Google, but went over to Kubernetes and containers and in that world. I'd like to move around a bit from the idea of the store. I did file systems and volume managers, and networking, and security. And so, I was interested in that. And so, then I was in Google Cloud, and let's just say your bosses, but whatever, whatever Sunil is.

Even more bosses.

Who's my boss, exactly, plus one boss, is a very persuasive man. Yes, he is. And so, I think he was looking for someone to come in and lead product. And I'd worked some with him in what I was doing around GKE and Anthos. And so, he started to— it took him a few, a couple quarters, but he finally got his hooks into me.

Only a couple quarters? That's pretty fast for that kind of decision.

Exactly.

So, that's the story.

Yes.

At least you consciously joined Google. You weren't, like, acquired in or found on the street like some of us.

No, 100%.

Anton was acquired. I was found on the street, listeners.

Well, look, you know, I'm like an infrastructure person for years and years, and I think the future of that is cloud. So it was a very natural place for me to go.

That actually makes sense. And yet at the same time, here's the product question comes from me, the non-product type. So sometimes when people think about cloud and invisible security, they sort of think this, have this vision of security being so easy, you don't need to do all that much. But at the same time, we get requests from people who want to have encryption keys under a particular mountain in Switzerland, like EKM. So, it's almost like large financials, other demanding clients require things of us, but also the rest of the world sort of needs things. It's ultimately your call, right? You're the boss of all that. So, how do you decide whether to invest, whether to focus on things that are needed for the top-tier elite clients versus millions of others? That's a hard question.

That's a hard question. Yeah, that's kind of A little bit of the job of a PM is to take all that input across your customers, what you're hearing from partners and sales, et cetera, and work through how do you prioritize scarce resources against those needs. In a lot of ways, you can kind of like— that's almost, I think, the foundational element of what we do in product. And so, it's not exactly like one size fits all, One interesting thing I'd say when you're talking about the other capabilities, SMBs, etc., and I've seen this over the past, you know, 10+ years, is the consumerization of IT actually is beneficial for even those large, most sophisticated customers. And it's interesting, when I was at Cisco, we brought in Meraki into the suite, you know, Cloud managed, initially wireless and moved into routing, and just a lot simpler than what we did in the rest of the classic iOS Catalyst, et cetera, portfolio. It was really interesting to see the demand from a customer base in terms of the most sophisticated. They cared all about, literally 3 months before, I was talking about these random multicasts, esoteric scenarios. But then we show them this other thing, it's like, wow, like, that is just easier. And I might be willing to sacrifice some of the other things I was looking for in order to get that value. And I think that's the opportunity we have a lot within this space. That said, I think, you know, there are certain non-negotiables in the security space, and a lot of which are being driven by things even outside of the customer's direct control. So this is coming from regulations and compliance and things like that, whereby they just foundationally can't bring the workload to the cloud unless they have this control in place. And so, to me, at the highest level, a big chunk of our role here in cloud security is how do we help customers bring workloads to the cloud securely? And so, you can almost like, how big are the workloads? What do I need to do to invest to enable those? And that's almost the back-of-the-envelope triage that I have. It says, hey, look at a lot of these financial services need this esoteric thing where I store a key in a mountain and switch a LEND. But that gives me— it unlocks a large amount of workloads across, even if it's a small number of customers, that could very well be worth it.

Okay. So this is a really good answer because it leads really into the next question, which is about a split in your org. Some of us, like me, work on products—

May I have an annoying comment? I wanna make an annoying comment.

Please, Anton. I can never stop this.

His answer almost made me regret that I'm not a PM anymore.

Really?

Yes.

Wow.

Because this is kind of such a wise answer, and I see a lot of PMs who don't follow that wisdom. So I'm kind of like, it made me very briefly, briefly, Tim, regretful that I'm not a PM anymore.

You're welcome back anytime, Anton.

Whoa, careful what you wish for, right? So I want to pick at that though, because it is really interesting, and Anton's right, it was a very inspired answer. Some of our products are meant to unblock cloud adoption. And some of our products are meant to sort of generate direct revenue for the unit. How do you think about the split between them in terms of where we allocate resources and attention and time and headcount and all of that? And how do you allocate secondarily your time between all of that?

So I end up mapping to really where we're investing the engineering resources in terms of my direct time, but I'm obviously part of that decision-making process and where we're allocating those engineering resources. And so what I would say is, I think that first piece, if you look at our role, I think the first thing, like, don't pass go, don't collect $200, is around helping making sure the platform itself is secure.

Mm-hmm.

Like, that to me, we are— our customers are entrusting Google with their most important applications and data in a lot of cases. And so, like, that's a piece. And I think the hard thing about that is it's like actually the role of a CISO, You can always spend more money in making your security environment more secure. That's kind of a never-ending path. And so it becomes this view of what's the trade-off between what's the marginal value I get over another investment and how do I kind of track that. But to me, that's kind of the starting point. And then really, you want to think about the The next is, it kind of comes back down to the same thing. Getting more workloads allows Google Cloud to make more money, but also, being able to deliver SaaS security solutions helps us get more money as well. And so, to me, it's a little bit of that traction. Does this investment— is it unlocking enough additional workloads that the marginal investment in HSMs and key management, or even policy intelligence is more valuable versus, hey, I think we can go out and we have a really— we can change how folks are doing security operations, and that's something that will be more directly monetizable. So, as best possible, you try to come to that rationale. It's not perfect by any way, shape, or form. And a little bit also just comes down to how much is the field yelling at us or our customers yelling at us. That becomes a way to, on the balance, make sure that we're not too overweighted on one side or the other.

You know what I really like about that answer is that there's no magic that you just identified, Jeff. It's like the hard work of product management there. And I think one of the things that's maybe surprising to people when they talk to me about the podcast, one of the things they say that's surprising is hearing how Google does it and hearing the ways in which Google is normal versus is not normal. And I think what you just described is Although the stakes are abnormal, the process is actually kind of normal. That's how you would expect it to work.

Yeah. It's so funny. Look, I mean, I was very excited to join Google and just the type of people we get to work with, the opportunity in front of us was amazing. I remember talking to Renzo after I'd been on board for a few quarters and it's kind of like, oh, how is product management like at Google? And I was like, you know what? Kind of the same thing. I think if you're good at this type of role and job and thinking, I think those foundational elements are pretty applicable across a wide swath of things. And as special as Google is, I don't know that it's so special that the product management job is foundationally different.

Yes. And I think over the years, over the 2 years of our podcast existence, we've seen cases where Clearly, Google has a magical answer. And when people hear how we do it, their minds are just blown because it's unthinkable. But we also had cases when we describe how we do something, people thought, huh, that makes sense. That's just common sense components done really well together. So I think this is in the second bucket. It's not like we have this magical wand that PM just waves and the priorities just line up right away. Yeah, he's doing it.

He's doing it.

Yeah, I'm waving a whiteboard marker, listeners.

Yeah.

So, that actually makes sense. And I think it has nothing with my desire to be a PM again. It doesn't affect it. So, the question I have from this kind of decisions and all that is that clearly, we listen to customers. And customers at times struggle with cloud. They struggle with adoption. I mean, as— so, from my side, Office of the CISO, we see people struggle with adopting cloud securely, figuring out who is responsible. What's your take as a product leader? Like, what aspects of cloud security have you seen people struggle with the most? Like, what is the— where is the pain? Can you distill it for us?

Yeah, I think there's a standard pain that I've seen. I saw in the app modernization Kubernetes space, I see it in security as well. And I think that is a lot of our customers are looking to map exactly what they've been doing on-prem into the cloud. And there's, you know, like, oh, I have this control and this boundary, and those things don't always map one-to-one. And so, getting through that process, I think, is always— it has been, I think, reasonably challenging for a lot of the customers that I meet with. It's kind of like, oh, no, no, but I do this here. And, like, well, that doesn't exactly work the same way. Or, if we made that thing, it would actually take away from some of the capabilities and reasons why you came to the cloud in the first place. And so, to me, that's always been this kind of hard thing. And a lot of times, this isn't, again, it kind of comes back to, it's not necessarily the exact security practitioners we talk to themselves, but it's the, hey, I need to go get this approved by our risk council, and the risk council is gonna, like, this is the process, and this is what they look for, and this doesn't exist there. So, I think that's been one that's probably the most the pattern I've seen repeated the most when I talk to customers. And the same thing happened when, you know, looking at, like, refactoring their applications, and, you know, are you taking advantage? Like, I want customers to take advantage of things that we can uniquely do really, really well in the cloud. And, you know, like, the threat detection stuff that Tim has been driving us, he's a great example. Like, you just can't do that unless you were Google. And so, can we enable that? But that means that, you know, where's the agent on that? You know, well, no, we don't need an agent on that. So, those are the types of things that I think are kind of interesting.

But so, sorry to kind of rephrase this, but is it again about their minds being on-premise, but they come to the cloud? Because when you've described this challenge, I've heard something that we see a lot with clients at Office of the CISO is when they ultimately come with on-premise expectations, ideas, plans, practices, problems, and it's almost like they bring all the baggage and all the baggage, including problems from on-prem, and they drag it with them to the cloud.

Yes.

So, it's kind of the same Exactly.

And would you say that they're missing an opportunity there, Jeff?

Yeah, 100%. And again, as I said, I don't know that— I'm not necessarily calling out the practitioners directly. You know, a lot of times it's all the systems around that or compliance. I mean, the other big thing I see is your customers moving to cloud. How do they get the regulatory bodies that are overseeing their environments on board with what they're doing? It looks different. And we spend an amazing amount of resources and energy trying to work with those bodies directly. But yeah, so those are the things I'd probably call out.

So that makes sense for things that people struggle with the most, and I always appreciate hearing that my stuff is innovative. What are maybe the things that are surprising or unexpected that you've seen with our users? Is there anything that's like, I never would have guessed that would happen?

That's an interesting question.

Thank you.

Maybe I don't get surprised that much. I say that in a way that seems too grandiose. self-congratulatory. Yeah, I think it's— I mean, some of the cases, maybe just in the scale at which some of these companies operate, it's amazing when you talk to some of these and how they're doing that across such an interesting infrastructure. So, that's probably the thing that, you know, until I came here, I still didn't necessarily understand the scale at which— and it's not just our customers, even Google itself operates.

Yeah. Yeah, I think that's a very fair answer. I have had my mind absolutely shattered by that in more than one experience here.

Yeah, we were talking about like, you know, the DDoS attack that we stopped for a customer last fall. Like, it's unbelievable.

Yeah, it's completely nuts. There is a time where one of my teams messed up a deploy and we accidentally saturated an entire fiber optic link between Asia and the US, and Traffic SRE's response was not Hey, you jabronis, what are you doing? The answer was, try to deploy it better next week. It's no big deal.

Yeah. Yeah, we got it handled. Yeah.

So as we are working on this, clearly outside parties like analysts recognize ongoing improvements we make in cloud security. So recently, we had a really great placement with Forrester Wave with what they call IaaS platform native security, which really makes us look great, look really, really good compared to other providers. My suspicion, because I was involved with that process during previous years, that a lot of work went into that. So, can you maybe open the truth to this? How was it done? What was involved in us collecting, building all that?

Yeah. So, A, agree. I'm very excited about the placement in the IP&S way from Forrester. And I was talking to the team and then they worked for months on this. And part of it is just making sure that we can accurately answer The very, very long list of questions and data points that are being looked for as part of this process. But I think what the team did particularly well is, as part of the process, we built out a demo of how all the different controls can work together across the platform. And I think until you see it— once you see it in action, it really helps crystallize, I think, the thought behind the controls. And then the unique power, kind of our previous conversation, there's things that you can do because you're in cloud that would just be really, really challenging to do otherwise. And so, bringing those together, I think making those very visceral in terms of, actually, let's walk you through what the user experience would be like, tying together what we're doing in identity and what we're doing in threat detection and what we're doing in org policy. All these places that are designed to help make sure our customers are as secure as possible by default, have the controls at their disposal to make sure that where data is placed, how it's accessed, et cetera, are there. And then to make sure that on an ongoing basis, they're monitoring that against drift and other things, I think is really powerful. And so, to me, that stood out. I think it's the magic sauce. And you'd have to ask the Forrester guys if that was actually true. That's what I'm going to say.

I would actually add that I think a few years ago, maybe 3, 4, I felt like some of the analysts are trying to judge cloud with a mix of cloud and on-prem standards.

Yeah.

And this has been— I mean, I was an analyst myself. And when I started seeing this from the vendor, from Google side, I started saying, why can't they just get it? What are they doing? This is not a call. But ultimately, my impression is that customers channel to analysts what they want in the cloud. And sometimes it is ultimately kind of a call, right? From less mature clients. And so analysts then channel it to cloud providers and cloud providers push back and say, no, we're a cloud, we're not a rented data center. And then there's a slight mismatch.

You shouldn't do it this way. Yeah, yeah, yeah.

It's not, we can build it to check your box, but it's the wrong checkbox. Do we see less of that now, right? I'm almost like asking you a leading question.

I don't know, Anton. I participated—

We do see less of that, right?

We did, we did. I participated extensively in this one and the last one. I put a lot of demos together. I got fewer fish climbing tree questions this time around than last time. There were still some. Yeah, I'll be honest, but I thought there were fewer. What did you think, Jeff? You probably saw the criteria.

Yeah, spot on. And you said, I guess, less from the analysts. I think more and more customers are seeing the value. And again, it's partly on us to make sure that we demonstrate why more of the cloud-native way is there. I think this happened long before I started at Google Cloud. I also think there was a very concerted effort for Google to do a better job of trying to meet customers where they were. And so, the investment, particularly across helping classic enterprise, not just the digital natives, but the folks that I've been working with for 2 decades, were able to translate what they needed, understood that. So, that's been, I think, a really just nice push, generally speaking, at Google over the last few years.

Yeah, that was something we talked about in the Sunil episode as well, actually, was the shift, because I've been in the cloud security group here for 5 years now. At first, when I joined, it felt like we were building security because we thought it was the right thing to do. And with the arrival of Sunil, with your influence on the group, it really does feel like we're building it in a much more customer-centric way. And Anton, I think I want to push back a little bit on your characterization of some of those users as less mature. I don't know if it has to do with maturity. I think it has to do with what they want out of their cloud provider. I don't think it's invalid to say, I need a bunch of equipment and I don't have linear feet to put it in my data center.

Yes, I think you're right. I think I would probably apologize for treating them all as less mature, but I've certainly seen this as both a sign of a cloud need, kind of a legitimate requirement for that, but also in terms of maturity, people who were sort of, raised and born and educated in the '90s, and their IT experience was all '90s realities. And then suddenly, they're in the cloud. So, they demand the 1990s stuff.

Killing me.

Okay. Now you're all laughing at me.

Okay. All right. So, Jeff, Jeff, we agreed in advance on the questions, but I wanna throw you a curveball because Anton's got it pulled up on the screen. Curveball question, listeners, he didn't have this one in advance. Is cloud migration a risk reduction move?

I mean, we've been asking every CISO that question. Well, Jeff thinks we can give a quick context on this. We've been ambushing CISOs with that question because Phil Venables always says yes, and he cannot be ambushed with this, but we've been testing it on others.

So, I think, yes. Look, I was actually going to talk about Phil's. I think Phil has a very articulate way to talk about The kinds of scale that we're achieving in cloud allow us to make investments that almost no other enterprise would be able to do. And so, if we do our job right, customers can migrate to the cloud, and they're operating on top of a base that has so much investment from a security perspective. And this is an investment not only in support of GCP, but frankly, like all of Alphabet. So, the fact that we can amortize these, what would almost be ludicrous decisions and investments if you were a standalone company, I think it raises the tide for all the customers that are operating on the cloud. And the other thing too, I think it's interesting is that availability has a role to play in security as well. And to me, again, this is, I mean, now that I'm inside of Google and understand Just the amazing things that we do from an availability perspective. I think that's another thing that is just— you could not replicate that unless you're, you know, one of, you know, less than a handful of companies in the world.

I think that's absolutely right. And I think that scalability investment is really fascinating, especially when we take the opportunities we've done in some of my products to really bake the security into the fabric of cloud rather than try to bolt it on after the fact.

Yeah, exactly.

So it is sadly time to ask you our closing questions. First, Do you have a tip to improve security product management, and do you have recommended reading for all of the PMs and aspiring PMs we got out there?

Interesting. Okay. So, for me, intellectual curiosity is just like— I've just seen a very strong correlation between intellectual curiosity and good product management. I don't know if that's even a tip. I don't know how you describe that, but to me, that's a characteristic. That I believe is foundational and something that I always look for when I'm talking to folks about potential product management careers or roles in the team, et cetera. So, that would be the one thing that I would probably highlight.

And have you read something interesting lately? It can be anything. It doesn't have to be about cloud security or product management. We had somebody recommend Mary Oliver last week.

Okay. Yeah, yeah, yeah. I'm a big Murakami fan.

Yeah.

So, it's funny, most of my reading, I like fiction a lot and my wife's a huge— she literally probably reads like 2 or 3 books a week.

That's amazing.

And so I get the— she curates my reading list and so she also has a really high bar. But yeah, I'd say Murakami. My son, so he's a high schooler, he just started reading Murakami, so it's fun. So I'm rereading some as he's reading it just so we can talk about it, which I love.

That's awesome. Well, Jeff, thank you for the look behind the scenes of how we do PM here at Google. I think this was a really enjoyable conversation, and thank you again for taking the time to join us.

No, love it. Really appreciate it and honored to be here.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikian and TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security. Security.