EP86 How to Apply Lessons from Virtualization Transition to Make Cloud Transformation Better

Security running. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, our tamed analyst and now Senior Security Staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts. as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. Listeners, if you like our podcast, please do subscribe. And we recently were told you should also drop us a rating if you like our content in your podcasting app of choice. Of course, if you don't like our content, please don't rate it. But if you do, please do. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we are doing an episode today where we get to learn from the past. And history does not repeat, but I think this is a case where it does clearly rhyme. What am I talking about? I'm talking about virtualization and that revolution.

Correct, correct. We're going to take a time machine to say 2008.

Oh boy.

When virtualization was really cool. It was like this innovative tech that nobody understood and it was promising to change how IT is done because hey, those server huggers who like literally hugged hardware servers, cannot hug servers anymore because like virtual machines. So I think this has lessons to what's happening now with the cloud. And so does our guest, by the way.

And so does our guest. And listeners, hopefully you think so too. And if you don't, let us know on Twitter, but please not with a bad rating on the podcast app. With that, let's welcome today's guest. We are delighted to introduce today's guest, Thibault Meyer, Director in Google Cloud's Office of the CISO. We're really racking up the visits from Office of the CISO here on the show. Today we've got a fun topic though. We're talking about virtualization to start off with. And so 20 years ago when I was, well, we don't need to talk about how old I was 20 years ago. Virtualization was this huge shift in how people thought about IT. It was a revolution. It was one of those generational shifts in how people think about computing. Surely each generational shift has lessons that at least will rhyme with the next one. So what lessons can we take from that shift and apply to today's shift? Very light philosophical question to get us started today.

Thank you, Tim. I think it's indeed an excellent parallel to draw. As you said, 20 years ago, organizations discovered the magic of virtualization. For most applications, it was the end of one server per application. It was the beginning of building and managing a software-defined infrastructure. And also, we discovered automation and maybe the very beginning of the foundation of the coming CI/CD pipelines. Virtualization in itself was not tremendously complicated to operate. In addition, the budget was not really a big issue, at least not a blocker. There was indeed an initial investment to acquire the storage and the compute capacities, the The IPFS license, but it was usually soon written off. So, I think it was not really a technological issue, but the main challenge was to manage the organizational changing in the IT teams. I'm thinking, for instance, about the teams dedicated to racking and stacking, installing all the physical servers, the physical network connection, and so on, or the team installing the operating system on the server. As the virtual machine was instantiated by templates, they were more or less no longer needed. So organization was really an important part and really a key part of the process.

So wait, what did those people do? What did organizations go on to do with their guys who used to run cables through data centers and plug 'em in?

Well, first of all, part of the job remained. There were still some servers, there was still the OS template to initiate, But they had to evolve, they had to be trained to be able to manage the hypervisor, and also all the lifecycle of the virtual machine on it. But they were not only dedicated to physical servers anymore. So, I think we are facing the same challenges today with the cloud. It relies on new technology, but it's important for us to keep in mind that it deeply involves new processes, and also a transformation of the organization.

I think that made sense. And I've picked from some discussions with customers that they see cloud as their minds jump right away into the migrations and how do I copy the VMs, where are the APIs. It's interesting that I think I'm sensing the parallels where many, even technology leaders' mind goes straight to tech. when they migrate to cloud. They say, maybe in their minds, they think of the 3-legged stool, people, process, tech, but ultimately, they rush to tech. They rush to, oh, migration is about how do I transfer the VMs or how do I rewrite the app? And maybe eventually, they get to other things, but not immediately. So, how do we balance the whole rush to deal with technical issues, back in the day, virtualization, now cloud, and the new processes? Because of course, cloud comes with its own magical process stack, agile in case of Google SRE and other things. So how do we balance this?

Yeah, well, I think you said the right word, the magic, the magic of the cloud. And for most people, this magic is first of all, the technology changes, the scalability. Well, I'm sure our listeners know very well about it, but scalability, the software-defined infrastructure, automation in building, testing, deploying, managing compliance as code also, with guardrails for developers, enhanced security, distributed security. So, that's really the magic of the cloud. However, I do believe that successful adoption of the cloud relies on the ability of the organization to adapt themselves. And what I mean by successful adoption is really to gain all the benefits of the cloud we just talked about. Not simply consider the cloud as another data center, not simply having a virtual machine running on a cloud infrastructure, but really taking the benefits of what we said about scalability, security, automation. And for that, maybe the key point is to, yes, you need to acquire the skills. You talked about that. And also to train the staff and to adapt the processes.

So I want to pick on this successful adoption concept for a second. It kind of sounds like you might never successfully adopt cloud if the bar is you get all the benefits of cloud, because you think about cloud, clouds are not these static things. We're releasing new stuff all the time and always pushing to new levels of abstraction. So is there— am I being maybe too pessimistic in imagining some ever-moving goalpost of cloud adoption, or is that actually kind of the journey that organizations are on? And the nature of technology for a company is you just can't stay still and you always have to be improving. Maybe that's a good thing, actually.

Yeah, I think you're not pessimistic, you're optimistic. It will indeed be a never-ending story and a journey, a continuous journey because of the evolution of the improvements. So when I said successful adoption, I mean really taking the benefits. I'm not saying that it is a pass or fail. thresholds to be successful or not in the cloud, but it's really a change of mindset, a change of mindset, and not to try to reproduce the exact same infrastructure or the exact same security you have with your on-prem infrastructure, but to think differently.

So I really like this.

But it's hard. This whole human stuff is so hard for so many IT, even IT leaders, right? And it's kind of a contradiction in terms. If you're an IT leader, you are kind of a leader of people, but you're also in IT, which means you like computers more than people. I'm sorry, I'm rambling.

I don't know if it means they like computers more than people. It might certainly be stereotyped that way.

Okay, fine. Okay. In this case, you know, you're right. Maybe I'm stereotyping it.

But let's pick at this. This is a great theme. Let's pick at this. How do people successfully lead the people side of the change? Because sure, it's one thing to be like, okay, we're going to use this technology. We're going to use this process, but how do you get the people moved around? How do you, how do you say to that person who ran cables, now you're going to run hypervisors? How do you make that happen?

Well, I think 2 key points, in my opinion. The first one is to train your staff. As you said, it's an ongoing evolution. Technology is going on. So it's important to maintain the technical level of your staff. And that includes also the new technology. And it also means to convince them that they will not lose their job, but their job will evolve, and it will be at least as interesting as the one they had before. I'm pretty sure that if you talk about someone who did install network cable and then used to manage virtual switch on an hypervisor, He would probably love this evolution.

Oh yeah, you get way less sweaty running cable that way, right?

Exactly.

But its cultural change seems bigger this time though, right? I think that I get the whole lessons from virtualization angle. Of course, that's hugely useful, but it's all— is this revolution more revolutionary, Thibault? Do you think that this revolution is more revolutionary or not? Because I haven't truly lived through the previous one. So just curious.

Well, I do think so. I do think it's indeed a greater change, mostly because virtualization involves servers. The cloud transformation is broader and involves more segments and more teams in your organization than only virtualization. Let me take just 2 examples. The first one is application development. To take the benefits of the cloud, you have to rethink your development pipelines, to automate your testing, your deployment. So you are not just talking about the teams managing the physical server, but also the developers. Of course, we can talk about security.

Let's talk about security.

The goal is not to copy-paste the controls you have on-prem and to put them in the cloud. It will be both complicated and mostly inefficient.

And expensive.

And expensive.

Also expensive because the scale goes up.

And sometimes counterproductive.

Counterproductive, expensive, inefficient. Any other bad words?

Those are all the bad words I know.

So you have to think it differently and to adapt your organization structure. Well, of course, there are more examples about operation, about so on. So in a word, virtualization provoked a change in the infrastructure teams, but cloud goes beyond that. So I think the change indeed is greater.

That does make sense to me. And I think that there's still, you know, big lessons. And of course, the other one we know, I think one big thing that we learned from the virtualization revolution is ultimately most companies transitioned. And ultimately, it didn't really— well, it probably did heavy damage to some IT strategies, but ultimately, it worked out. So in that sense, this gives us hope for the cloud transition being successful, because people did transition from a very old world of hardware to the world of virtual machines. So, Edouard, to switch topics to something that, you know, maybe not Tim's favorite topic of all time, but it used to be mine at one point. Some of the compliance mandates, you know, I lived through some of the PCI disruptions. Tim is making a face, and of course you hear the noise. Yes, PCI compliance, for example, was disrupted by virtualization. The council has to write documents that kind of explain how this whole thing is supposed to work. Many QSA assessors, who are not supposed to be called auditors, were super lost a little bit. Like, is virtual separation between servers PCI compliant or in line with PCI requirements? I remember these questions being truly fascinating 10+ years ago. So, what do we expect to happen? Maybe that's too broad. Today, compliance is kind of disrupted by some of the cloud transitions. And of course, maybe there are compliance lessons we can draw from the previous revolution. So, care to shed any light on this, Thibault? I mean—

Yeah, sure. First of all, indeed, regulators and supervisors closely looking at cloud services. As customers are putting more and more critical workloads into the cloud, that raises growing attention from the supervisors. For instance, just to talk about an example I know well, in the financial sector in Europe, the supervision authorities first focused their attention on cloud service providers, and then broadened the guidelines and the requirements to other providers beyond the cloud. So I think again, we can see similarities between what happened with virtualization and what is happening today with the cloud. Regarding virtualization, regulators and supervisors tended at first to focus only on the risk. They considered the hypervisor just as an additional layer of software.

Malware! Hypervisor is malware.

Almost, almost. additional layer of software with potential vulnerabilities and with new threats that did not exist with physical servers. You talked about the ability for an attacker to bypass protection and to jump from one virtual machine to another. That does not exist with physical servers. And well, they were right. At least part of their reflection was good. It was a new threat model, and indeed it involved the vulnerabilities in the hypervisor. But it was not only that. Sometimes, they seemed to forget about all the benefits of virtualization, and that includes security.

Security benefits.

For instance, the server cartography, which was built in, in your hypervisor, the ability to patch in an easier way with the snapshots and the rollbacks, the improvement of disaster recovery with the mechanisms also existing in the hypervisor. So In most situations, the benefit-risk ratio is clearly in favor of virtualization. And I think we are living the same thing today with the cloud. Of course, there are some risks with a provider, with a third party, like with any outsourcing. You have another organization in your equation, so you have to take that into account. You have to be aware about the loss of skills in your internal teams.

Hmm.

You have to integrate. the provider in your disaster recovery plan, in your incident response, in your compliance strategy. Maybe you have to prepare an exit strategy in case. But with the cloud, I think that regulators and supervisors are even more unsettled and confused.

Aren't they always?

Not with mainframes, I'm sure.

Because they also are not able to have answer to simple questions anymore, as where is my app running? Where is my data stored? And you cannot show them the exact server with the exact disk where the critical data is. So they kind of lost this physical relationship with the IT system.

I could see that being scary.

That is unsettling. I mean, that's legit unsettling if you lived through that for 30 years, 40 years, and suddenly that's like, gone by magic, I have compassion maybe a little bit.

Yeah, I could see that being disturbing. I guess in my mind, I kind of grew up with things that way, so it's not so disturbing. So we changed their minds once. What can we learn from that to changing their minds this time? How do we help them?

Well, I think it starts with education and explaining also, explaining them the way security is built in the cloud, all the possible security controls available to the customer. And well, it's quite a natural posture. It's the apprehension of the unknown. So it's important for us to explain how it works. And well, I see mainly 3 things. First of all, it's thanks to the secure layer to show them the security level achieved by Google Cloud, for instance, which is way higher than what a single customer can do on his own. regarding the security measures and also maintaining this high level in time regarding disaster recovery, incident response, or the whole chain of security. We have to explain how a cloud provider can enhance and improve the overall security level of a customer. Then we also have to— because compliance will never be the cloud service provider's only responsibility. The responsibility of compliance will remain with the customer. So we also have to explain to the supervisors and regulators that the customers have access to several security controls to enable them to be completely compliant with the regulatory requirements and frameworks. And lastly, I think that They have to be convinced that cloud means, first of all, a maturity growth regarding information systems, more agile, more secure, a real evolution, and also access to new technologies, AI, ML, in a way that is far quicker than if they remain on-prem. So, with that, they are also able to solve problems and mitigate risks beyond the only security risks we talked about.

Like resilience, reliability type stuff? You're describing cloud improving on many risk postures, not just cyber risk posture, right?

Yes. And even on the business risk, I'm talking about AML and the anti-money laundering or anti-fraud in the financial sector, for instance.

Yes.

Which can be mitigated thanks to cloud technologies. So we definitely have to continue our engagement with regulators and supervisors by many ways. This podcast is a way, blog articles, direct discussion. It's definitely a path we should continue to follow.

This does make sense. And I think you're right that while a particular auditor may not care about the benefits to the business he's auditing, but in general, the regulators, I think, can be convinced. And just like in PCI, compliance and virtualization, it was very clear that certain things are just cleanest, more straightforward with the new technology, and compliance becomes easier. And then, of course, the argument about other risks. I like that. And I think it takes work. I mean, it is not magic in this case. It's a bunch of sometimes painful conversations with customers and regulators, and sometimes with customers and regulators in the same room. But ultimately, the road is at least somewhat clear. I think that's the main lesson, maybe. Okay. So, this is a kind of a self-serving question, maybe. Of course, Google Cloud customers are transitioning, going the same journey. Some of them lived through virtualization revolution. Some of them are not. Some of them are cloud natives. They were born in the world when virtualization was kind of old technology. So, what can a Google Cloud customer do if they feel lost in this transformation strategy while moving to the cloud?

Yeah.

Well, first of all, that's a totally legitimate feeling. It can be indeed a little bit unsettling to build a new cybersecurity strategy in your migration to the cloud.

Mm-hmm.

That's really the core mission of the team Office of the CISO, to be engaged with our customers and to help them to build their security roadmap and to help them in the transformation if they need to. This is really part of Google Cloud's shared-fate model. We do not just provide an infrastructure to our clients, but we are really engaged with them and help them in lots of different issues, and in particular in their transformation strategy. Of course, it can be on a high global level, but we can also help them on specific topics. Well, of course, when I'm talking with you guys, the first thing I'm thinking about is security operations. All about the SOC transformation, and that includes organizational transformation, or it can be more specifically about incident response. So how do I handle my compliance? How do I handle my control in this journey to the cloud? So if any of our customers have this feeling and need our engagement, it's very easy. They just need to talk about that with the account team. which will reach out to us and together we will work on that.

Amazing. So we're at the point where we have to ask the traditional closing questions. Do you have a piece of recommended reading? And it could be something about the topic or totally out of left field. And one tip from the virtual revolution useful for the cloud transition?

Well, I will start with the second part of the question. One tip really from the virtualization revolution is think about your people first. And then the processes and the technology will follow. But it's really the key issue.

Wasn't there a memorable acronym you used? Sorry for giving this hint, but I really like it myself.

Yeah, you're totally right. One of my colleagues in the meeting said a wonderful sentence, you have to think Hoot and not Toot. And so, yeah, it's thinking first about organization and lastly about technology. The other part of your question was recommended reading. Well, of course, I would start with Google Cloud blogs, articles, wonderful mine of information on lots of topics, either very technical and deep dive in several points, but also on organizational and on roadmap and how to build your strategy.

Perfect. Thank you very much, Thibault. This was really useful, and I love how you structured the answers. So thank you very much for being on the podcast.

Thank you for having me, as you will.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.