EP159 Workspace Security: Built for the Modern Threat. But How?

Security.

Hi there, welcome to the Cloud Security Podcast. Thanks for joining us today. Your hosts here are myself, Tim Peacock, the Senior PM for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, our guests, and the rest of the listeners on our LinkedIn page. Anton, we are kicking off Workspace as a topic today. We've touched on it before. Today we're very fortunate to have not one but two of the engineering leaders that actually build Workspace joining us to talk about it. So Unlike, say, having a filthy product manager like myself who doesn't actually know anything, you've got 2 EMs who are deep in the heart of things.

Right. But I think that's what's interesting in the episode is that you asked a really tough question right up front. And without revealing the question, I would say that the theme that came up is that Workspace is cloud-native to the maximum possible degree. It was never an on-premise installable office suite. It was always born in the cloud day one, and it was always evolved and became better in the cloud. And that does give it some incredible security superpowers, which you're not going to get if you evolve from like CDs, I don't know, floppy disks. I don't know what the other guy evolved from.

Floppy disks. I remember those.

Probably, yes. Probably from the days of floppy disks, people have been installing the Office software on the computers. If you start clean in the cloud, you do gain superpowers.

Yes.

That's a very important point that comes up.

It's so fascinating to me how it's difficult to bridge that gap. Like, if you imagine the changes you have to make to make something go from the world of installed software to the world of cloud, that's a crazy leap. But if you're cloud-native, all of the things that are great about No patching and no files on disk and application contextualization awareness for access. All of those things you kind of get, not quite by default because you still have to build the features, but your foundations are so much more correct for building that out.

I think it's even better.

Yeah, it's better. It's better to be cloud-native, isn't it?

And this episode also made Phil Venables' megatrends come to life for me because this was an example of something that clearly showcases security advantages of building in the cloud from day one, as opposed to migrating, evolving, rewriting, resurfacing, keeping the legacy stuff to some extent. So, this is kind of the magic of being born in the cloud, and improving security in the cloud at the cloud pace is what we have witnessed today.

Yes.

And I think that last part about improving security touches on so much of what we've done on the show when we've talked about ASO, talked about other advantages of cloud-native approach to software development and deployment. You really get just a fundamental pace advantage, not just relative to whom you're competing with, but relative to adversaries as well.

Yes. And I think that we did go through some details about DLP. And I think AI made an appearance as well, which is kind of exciting because if you are doing security for the cloud workspace office suite type of application, of course, AI would show up. Like, how could it not?

I think it's really interesting again with the AI piece to think about the advantages and disadvantages of AI that's co-located with your application versus third-party. But maybe you and I have rambled quite a bit today, haven't we? Maybe without any more rambling, let's welcome today's guests. With that, listeners, I'm delighted to welcome today's guests sitting here. In fact, in the room with me, I've got Sophia Gu, an engineering manager here in Workspace, and Amre Kamlikilicar. another engineering manager here in Workspace. And I promise listeners, it's not going to be a management-heavy episode. We've actually got a really fun question to start out with, which is, Workspace makes this big, bold claim that it's architected for the threat landscape. It's a big claim.

What does that mean?

What's actually behind that claim?

Yes, I can explain. So I actually asked this question to Bard, and it highlighted a few attributes of our zero-trust architecture.

You asked Bard?

Yes.

Okay.

I wanted to try our artificial intelligence that are made by Google.

Uh-huh.

And then I wanted to listen what he has to say, right? And it highlighted a few key areas, and I find it actually very accurate. Not to advertise Bard here, but some of them are, we have a cloud-native architecture. Bard highlighted this one, this fact. And we have Google's security expertise behind our products. And then finally, we provide easy deployment and management capabilities to security, which is typically seen as a difficult heavyweight in the industry. Managing security requires expertise. It requires a lot of training. But with Google Workspace, all of our customers, whether they are SMB or enterprise, they can actually easily manage using our controls that we provide to them. So let's little bit deep dive into our cloud-native architecture. I think this is the key here. One of the facts that our customers' data is always stored in the cloud. What this means is if the devices are lost, stolen, or taken to another country, our zero-trust controls can immediately block access to this data.

That happened to me, listeners. I traveled to another country where where we don't allow data access, and I couldn't access anything. It was great.

Correct. And one of the reasons we are able to make this claim that you mentioned is because our customers' data always is in the cloud, and we don't have to deal with the difficulties and challenges when the data is stored on-premise, on the devices. Then, if you think about if the device is lost or stolen, The attacker has direct access to the storage space.

That makes a lot of sense. And surely with the cloud deployment, you also get, you know, automatic updates and all of that. So admins aren't scrambling to triage, do I patch this? Do I patch that? We take care of all of that for them.

But also cloud-native means we were never software installable from CDs on a PC, right? We don't have the legacy roots of, you know, Windows application. You whip out a CD, insert it in the drive. Like, that's not in our past, and that allowed us to do some things that just doesn't derive from that past, right? That's how I'm thinking about, like, why Workspace is so amazing.

Correct. You can move from one device to another device. Your data moves with you, but it doesn't really physically move. You have access all the time, and when a threat occurs, we can also block access in real time.

So another thing that I wanted to explore with this is, of course, the whole question about data security. And in many cases, documents are some of the most sensitive elements of enterprise corporate data posture. So people are typing SSNs into documents, people have sheets with sensitive data. So presumably, controlling data of that sort is difficult. So we have superpowers in this area, right? How do we approach this? And by the way, our boss, Phil Venables, highlights the fact that in the cloud, data is usually more secure rather than, say, on-premise on many PCs. So what are the challenges you observe with controlling access to data, and how do you protect the data?

So I think at the end, you know, the challenges can be summarized: there's no one-size-fits-all solution for that, meaning that, you know, for example, in today's world, Most of the people are working in the hybrid environment. Hybrid environment meaning that, you know, people want to access their data from anywhere, from any devices, at any time. So how can you control that to grant access to people who need them, but also to prevent attackers and the people who are going to compromise your data? So the environment is super complex. in this situation. And the data protection is also very complex, meaning that, you know, the same set of sensitive information probably should be granted to people in one environment, to the other, or, you know, at a different time, that the same set of information can be shared or cannot be shared. So, for example, we just had this quarterly financial result. That right before the annual report or quarterly report, this information is super confidential. But right after that minute, it will all of a sudden become public. How does your data protection scheme accommodate this type of situation? So we have this whole solution that being able to protect the information dynamically based on—

Mm-hmm.

the environment, based on who you are, based on what type of data, and based on, you know, the stage of the data for that.

What I love about that example is it makes it so obvious to me why, say, network as a boundary isn't very sufficient. Like, clearly, you need more than, what network am I jacked into, to make a decision about that kind of data classification decision. That's fascinating. So, in this world where we've got a lot more context, a lot more app awareness, we're not relying on, where people are connecting from. What do people get wrong? What are the mistakes we see people making?

I think a lot of people may not be aware that there's a significant risk out there and that there's a tool over there to protect their data for that. So a few years ago, Workspace rolled out this product called DLP Insights, recognizing that not everyone is realizing the risk. So this DLP Insights proactively scans over the customer's data, highlighting some of the risks, and sends the report to the admin to that domain proactively on a regular basis. And basically, it's just to tell them, look, you know, there's a potential risk over there, and our tool is helping you, is protecting your data. So, The first wave of the email notification, interestingly, you know, one of the Google execs' domain, and who happened to procure a domain for himself.

Hmm.

And then when he read this email notification, he picked up the phone, called the head of the engineering of the Workspace immediately saying, oh, now I received this email notification. I'm concerned about my data. What do I need to do about this?

You scared a Google exec about their personal domain.

Exactly. And when we did that, of course, you know, on one hand, we recognized, oh, this message really resonated with a lot of folks and people do need data protection. At the same time, we received a list of the requirements from this exec saying, please help me to do the step 1, 2, 3 for that. So of course, because it's coming from that, surely enough, we roll out additional follow-up features right after.

I love when executives become the PMs for features like that. That's great.

Yeah, totally. And, you know, another thing is that we didn't realize, actually, we have a lot of supporters, a lot of people out there who really need our help.

That's an awesome example of unintentional dogfooding.

Yes.

And another example maybe I can mention about and how we are helping customers here to reduce these mistakes as much as possible. With context-aware access, our customers need to understand what works best for them and try to create policies that will block access that they see risky, right? And in order to do that, they basically create these access levels based on the attributes that we and third parties expose to them. And one of the mistakes I see a few customers did in the past is, they quickly rolled out their access levels to the environment and then figured out some of the end users have their access blocked unintentionally. So what we did to help this, again, in the ease-of-deployment perspective, we recently launched a monitoring mode for context-aware access. So now, instead of our customers deploying these policies in active mode and constantly blocking access, allowing access decisions, they now have the opportunity to monitor what would these access levels and policies do in the environment before they turn them into active mode. So they can look at the audit logs, and then they can then decide whether they have the right policies in place And then can avoid these kinds of mistakes where the end users' access are blocked by mistake.

But this is classic for DLP tools, though. I vaguely recall tools going back maybe 15 years that had monitoring mode before you go enforcement mode. So what is special about our approach to this?

Okay, so listeners, this is one of my favorite things about Anton. If you build a feature that belonged in a tool 15 years ago, he'll say, what's special about that? But if you don't do that, he'll They'll say, why didn't you learn from what we did 15 years ago?

That's very fair.

Correct. So this was a known gap in our solution for some time, and we've seen our customers using our products in scale, and we saw the need, basically, that this is something that we need to enable to basically stick to our principles, right? We claim Google Workspace security is easy to deploy, easy to manage, And we closed this gap, key gap, and we saw a huge adoption right after we released this feature.

No, I love that because so often we're balancing the security and usability trade-off. We've had CISOs on the show talk about the risk of, you know, losing data versus the risk of your business not being there. And I think we've all felt the pain of, you know, document access in our own lives. So that's great. I really like that.

I was just curious because some of this, when we point out that there's a context-aware data security? I mean, in a traditional DLP, people assume that you would detect the pattern, say sensitive data, SSN, some ID, but we also look at more than that because we, of course, couple DLP to zero-trust context-aware access. So how do these work together? Like, what is context-aware about this? Can you maybe drill down into this?

Yeah, sure. So DLP is scanning the document, based on the content as of today for that.

Mm-hmm.

But the same set of the content may be at a different sensitivity level in different situations for that. So that's where the context-aware access came into play. So for example, the same set of the request asking for this snippet of this document, if it's coming from a legit user, you should grant access to that user. But if that request is coming from a suspicious IP, for that, maybe your account has been breached for that. So this is real-time dynamic identification about the context that really helps us to provide even more comprehensive protection to our dataset and to customers' data.

So here, essentially, we are combining content and context together and giving it very powerful to our customers. Based on the content, you may want to block or allow, but you may also want to combine this with the context. If the end-user device is a company-owned device, for example, if they are accessing this from a country that the customer sees as risky, right? So based on the content and context, you combine both, and then you can actually do block and allow decisions.

And do you do that out of the box for customers, or is it incumbent on them to set all that up? What's that lifecycle look like?

So what happens is, once the customer signs up to Google Workspace Secure, all these features are available to them. They need to go to our security page, and then they need to configure this based on their environment. Each customer has a different, unique set of requirements, and then they basically understand their environment the best, and we give them the flexibility to configure, create rules for DLP and CAA in a very intuitive UI. And then they enable this for a subset of their users or all of their domain. They also have flexibility to choose.

And can I ask Bard to do that for me?

Not yet, but maybe in the future. Not yet.

It's coming.

Yeah, really? Listeners, you heard it here first. Okay, so again, the podcast is not a declaration of roadmap, and we disclaim all statements about where we're going with things. With that in mind, though, I want to ask, what are the future cool plans for this? Because it is fun to talk about the future. Where are we going with this stuff? Not in an official roadmap context, but in a between friends, what are we working on?

Yeah. So we touched upon the CAA, DLP, the zero trust. We're doubling down on this footprint. The zero trust really is the table stake for the public sectors for that. And there's a CISA requirement for that.

What's CISA? Anton, what does it stand for? Because last time I said what it stands for, I got made fun of for putting them in the wrong department.

Oh, that's right. Yes. Well, now I'm not going to say the same mistake.

Cybersecurity and Infrastructure Security Agency. And they're in which department? I always forget.

But anyway, those guys, you know, I'm going to look it up because I don't want to make your mistake again.

Yeah, right.

And of course, the site—

I feel so bad for CISA. They're so cool and we always forget where they're at. So you're, you're working on this as a team.

One, one of the fun facts, I guess, in security, like, we have so much acronyms, right? Yeah. Right. It is hard to keep the full, basically, what does this stand for?

What is this?

Yeah.

Like, sometimes we talk about CAA, right? Like, what is CAA? Okay, it is context-aware access. What is DLP? And in DLP, even like, there may be multiple, like, multiple things in one single acronym, right? Interpretations. So yeah, I think it is important to basically be explicit about sometimes, right? So that Especially in this podcast, our listeners understand.

Yes.

Yes, definitely. So with that, we have this target to unblock the public sectors so that they can deploy our solutions without any restrictions to those requirements for that. And besides that, public sector is a big space. We also recognize security is for everybody. So for the small and the medium business, Even for the very small shop, they also need security for that. So we are also considering and packaging some of those features to offer to the smaller sector as well. So that is because that's our, you know, as a vendor, we see this as our responsibility to really protect our customers, regardless of the size of their deployment for that. And then the AI, as we touch upon, AI-first is such a big buzzword, and everyone's trying to see how to do that. And this is one of the competitive advantages that Google offers for that. So we, as part of Google, we are leveraging all of those infrastructure and IPs and capabilities to use that capability to help our customers to deliver that. So one example with that is we have AI data classification.

That's cool.

Yes. So one of the large enterprise customers, they came to us really asking us to help them to classify their dataset for that, for the compliance requirement for that. So we roll out the first wave of the manual classification. The customer's extremely happy and they roll it out immediately to their entire employee space. But within the year, they did everything to their employees, They did the training, they did mandating, they did threatening, but threatening the employees or doing threat modeling? No, you have to manually tag your documents. Oh, tagging, tagging your documents.

I heard threatening.

Yes.

I was like, are you threatening the employees to do the training? What's going on here?

Threatening their employees. If you don't tag your document, blah, blah, blah.

I see. I see.

After a year, and they came back to tell us. Look, we could only reach single digit of the coverage for that.

Wow.

Can you help us with that? So we said, here we go. We have the second wave of automated data classification through DLP and try it out. And they deploy that and immediately they reach the first threshold of the coverage requirement for that.

That's great.

But that's not all because they would like to have more. And we have the third wave of the AI data classification that can do a lot more based on the learning, based on the dataset for that. So that is coming. And with that AI deployment, then they can reach the much, much higher coverage.

That's awesome.

I mean, it's been one of the projects that kind of never completes. Back to my Gartner experience, if you try to do just popularize manual data classification by users, you end up 10 years later achieving pretty meager goals. So, I think that customer experience is very much a match to what I've observed. So, given the timing, I think it's time for our traditional closing questions, which are, of course, any recommended reading resources, it can be recommended watching perhaps or listening, and of course, one tip that clients can use, that the audience can use on securing workspace.

Yeah. So, I strongly suggest our listeners to follow the Google Workspace blog for the extra resources to learn more about what security features we offer from the Workspace. We, time to time, publish new blogs about DLP, CAA, and other security features and how they are helping our customers and how they can use this. In addition, as we release new features, these are published to Workspace update blog, so they can Our customers can follow the update blog to learn what new features are coming. In addition, we have a previous episode on Workspace Security: From Trust to Zero Trust, and they can listen to that podcast. I believe it is episode 99, to learn more about some of our zero-trust strategy and vision, as well. There are other resources.

Mm-hmm.

Sofia mentioned CISA, is one of the basically authorities in the U.S. which publish requirements, right? So there are articles published by CISA, as well, on zero-trust maturity models. Our listeners can go and then find these articles, and then they can educate themselves more about zero trust.

I love that. And listeners, you can tell he did his homework because he knows what episode number it is. I never would've remembered what it was. Sophia, what's your recommended reading? Not the blog.

Not the blog. Okay. So, we have a lot of those different analysts' reports for that and to tell us how compelling our AI solutions are. And we can also look at other vendors' claims to see the difference for that. And we talk about zero trust. We talk about the advantage of cloud-native solutions. And then, you know, the listeners can check out some other vendors' solutions.

Mm-hmm.

And then, I think it will be Amazing to do some of the, you know, eye-opening comparisons to realize the value.

I love it. Sophia, Amri, thank you guys so much for joining us today.

Thank you.

Thank you for inviting us.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin and _TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security! Security!