EP99 Google Workspace Security: from Threats to Zero Trust

Security running.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website. cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday afternoon Pacific time, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we're talking about that other part of Google Cloud today, that Workspace part. It's another sort of SaaS episode, isn't it?

Exactly right. And I think that we've departed from the discussion of the Google Cloud Platform technology and went to workspace. And of course, there are a lot of fun security challenges there, right? It involves email, it involves documents, it involves file storage, it involves, you know, the last factor is like the most annoying. It involves pesky users, humans, right?

You know what's one of my least favorite phrases in all of InfoSec?

That the user is the weakest link?

Least favorite phrase.

Yes, I hate it. I just hate it with a passion.

So negative value.

Yes, yes, yes.

But what I love about this episode is we talk about ways to protect humans, and in particular talk about one of my favorite ways of protecting people, which is phishing-resistant 2-factor keys. And we get into whether they are phishing-resistant or phishing-proof and have a long digression about watches and going to the moon. So perhaps with that teaser, listeners, let's turn things over to today's guests. We are joined today by 2 wonderful Googlers. We have Nikhil Sinha, a group product manager for Workspace Security, as well as Kelly Anderson, Product Marketing Manager for Workspace Security. We're talking about not quite cloud today, but something delivered from the cloud, Google Workspace Security. Nikhil, when I think about email, I think about lots of kinds of threats, but there's more than just email in Workspace. So could you give us just, like, the 10,000-foot overview of the kind of threats we're caring about here?

Sure thing. And thanks, Tim, for having us on this spectacular podcast. As far as the variety of threats go, we think we can categorize them into 3 broad categories. The first one is account hijacks, which is essentially to gain access to crown jewels from a customer. This can include credential theft, cookie theft, another wide variety of mechanisms to get to your data. The second is data exfiltration, particularly from an insider who is trying to leak sensitive information externally, either via the web interfaces or through the mobile interfaces.

By the way, to remind— insider from a client side, not insider at Google, correct?

That is correct. Yeah, it could be an employee, it could be a contractor that works at your organization where there is a potential for leaking information. And the last part, or the last bucket I would say, is ransomware, which is essentially an attempt to hold customer data hostage. Typically starts as a phishing attack, but there can be many other ways of getting to it. What I would say is that as a general trend, we are seeing the threats increase and really getting sophisticated by the day. Our job as Workspace and Google is to stay ahead so that our customers can securely collaborate and innovate while using Workspace tools.

And to build off of— I just want to touch on this point that Nikhil made about the increase of threats getting more sophisticated by the day, because for our listeners and, like, for all of us since we work in security, The threats that he named, like account hijacks, data exfiltration, ransomware—like these are not new threats, right? Like these have been threats that have been around for a while that I think unfortunately our listeners are all too familiar with. So the emphasis is really on the sophistication, and like what do we mean by that? In the workspace world, we think about the increase in sophistication around social engineering and phishing attacks, and how. Those types of attacks, it's getting harder and harder for IT professionals and security professionals to understand, is this behavior that is coming from a user, or is this coming from a bot, or is this coming from a script? Because they're starting to get really good at mimicking user behavior. And so an example of this is like when we look at like account hijacking, credential stuffing, We're starting to see criminals being able to write scripts, have bots that mimic like the speed and pace in which somebody is starting to log into their account or the speed at which their mouse hovers over a certain object. So that's what we mean by an increase in sophistication is we have to have threat detection models that are staying ahead and keeping pace. of attackers being able to get better at mimicking human behavior.

And listeners, what you might take away from Kelly's answer there is that before she was leading Workspace Security product marketing, she was quite involved in reCAPTCHA product marketing. And fun fact, Anton was the only Gartner analyst to question where the term credential stuffing came from when we first made it up back in my days at Shape Security.

Yeah, I don't know. This sounds like an impressive feat of, you know, analysting, but at the same time, it's—

It was.

It felt very obvious. If I hear a vendor, back in the analyst days, if I heard a vendor say something suspicious, I would always say, what? That sounds suspicious.

You were the only one.

In any case, I'm going to put my vendor hat— I can see it there. It's called a Noogler hat.

Ah, with the little propeller.

On my head and ask a question that sort of moves us a little bit away from threats. And there are also compliance motivations here, right? Not because people put credit card numbers and email. You should not do that. But there are other reasons for regulatory pressure to improve security. What are some of the things? Because I'm not even sure what regulations may apply to an office online.

Do regulators know what a Google Doc is?

Yeah, exactly. Thank you. So let Nikhil and Kedi go over there.

You'd be surprised. They do. I think you have a great point there, Anton. Many of the cyber agencies across the globe are taking actions to protect themselves, right, and their respective users, their citizens, et cetera. For example, in the US, the White House has a mandate to implement about 90 or more controls for their agencies to meet the Zero Trust security model criteria. In the EU, we are seeing stricter regimes to ensure safety of PII data. And so in Google Workspace, we are trying to keep a very close watch on these developments. A lot of times, these are prescribed over time. And so, we have to keep a close eye to understand what these regulatory regimes mean. For the most part, for US public sector though, I think getting the agencies to adopt Zero Trust controls is something which the industry has aligned to as well. And we are trying to make sure that we can offer the right set of tools over there. Speaking of toolsets, it's always hard to find those unique approaches that will make your environment safer. One example I typically like to call out, particularly for EU sovereignty purposes, is our unique approach to what we call client-side encryption, where the customer data is entirely inaccessible to Google for privacy and confidentiality reasons. This is a quickly changing area, so don't stick to one tool. Be sure that there are many more things coming in strung together with the Zero Trust approach, and we are being very intentional about our approach in this area.

So wait, so what are the regulations? I'd love a bit more clarity. So it's not only about PII being stored in email or online storage, right? So what else may affect the scope of regulatory compliance here?

Maybe the example to look at is if you are an agency within the US public sector, you are using productivity apps, you are using infrastructure, you are probably moving some of your workloads to the cloud. And what CISA has come up with now is a framework of how to go about securing your environment using the Zero Trust maturity model approach.

Hey, Nikhil, sorry to interrupt you, man, but for some of our listeners who aren't as deep in the area, what is CISA? And is that different from a CISO?

Good call out. So, CISA is the Cybersecurity and Infrastructure Security Agency that essentially has the charter to make sure that US public sector infrastructure remains safe and remains secure. CISO, as you know, is a very different concept. It varies from one organization to another.

Yeah. And listeners, a CISO is a Chief Information Security Officer. A lot of our listeners, Nikhil and Kelly, are not as long in the tooth when it comes to security as the rest of us are. So it always helps to break things out. I want to touch on a particular area that Google's been leading on, which is hardware keys. Tell us about how hardware key adoption is going with your users, and are you helping with that? Because I think hardware keys are pretty important, and it's worth talking about in the context of account security.

Oh, absolutely. So the hardware keys, like you mentioned, they're phishing resistant, right? We are seeing a steady adoption of what we call 2SV, 2-step verification, within our customer base. In fact, recently we have mandated, in order to help our customers, we have mandated use of 2SV for our reseller partners. Some of them, based on the customer or based on the customer base that they're serving, may have access to admin consoles. So, you want to make sure that it is well secured, and we are carefully expanding this mandate to larger customers as well. Another way we are trying to help our customers in this general authentication area is to make sure that we can extend some of our passwordless controls Over time. I think the hardware keys in particular, like you mentioned, are a unique value proposition here in the market, mostly because we are trying to get rid of phishing from your environment. The way these keys are different from what you might have used in the past, like token numbers, is essentially that any cryptographic information is unique Across every single domain. These never leave the user device and are never stored on a server, which makes it a pretty hard construct to go and try to crack against a control like this.

So wait, as I recall from another episode we've done on this, does it mean that phishing is largely solved if customers adopt this, or is phishing more difficult, or is phishing gone?

So I think the way to think about it, that these keys essentially are phishing resistant. Which means that if you are using it appropriately for your particular use cases, the propensity of a phishing attack goes much, much lower than what would have been otherwise the case.

Okay, but when my watch says it's water resistant, that means I can't take it in the ocean. So I feel like there's some softness in your position about hardware keys being phishing resistant versus phishing-proof.

Well, you can totally swim with your water-resistant watch in the ocean. I hope that's what you're using.

No, he uses a diving watch for this, and he uses a water-resistant watch on dry land.

That's right. I use my Speedmaster when I go to space. I use my Seamaster in the ocean.

Yeah, to answer that question, I think what we'd like to say is that you can absolutely go swimming in the ocean. You can go dive into the ocean as well. We are not seeing, or at least there are no known attacks that we have seen when The phishing keys have been used in our customer bases, right? So we encourage you to make sure that you have taken the right steps to us. Remember that when you're in the ocean, the threat vector can be different based on your depth. It's about securing your account, but there can also be other shocks out there. So make sure that you are well equipped to deal with those nightmares.

Okay, so I love this answer for a lot of reasons, but I think it's really good to bring up that there are other threats out there. It's not as if Solving phishing solves everything. It solves one of the major ways orgs get their initial access popped, but not the only way, certainly. So that's a great answer.

So I have another controversial-ish question to ask.

Yes, please.

I know this is multifactor, so that means one of the factors is still username and password, right? So with more hardware keys being used for, say, workspace security and other domains, do we expect that passwords would actually die, or would they become less important, or we are just strengthening them with this?

I think they'll become less important. They're annoying in some ways. Many users will be like, oh, I have to remember stuff. And by the way, if I can't remember stuff, I'll just use the same one across different places. So, we do see some challenges with the way passwords are used today. And the intent with passwordless is to essentially take away that user friction without compromising the security model. So, forecasting into the future, Anton, I would like us to be at a place where passwordless becomes more the norm and some of the usage of passwords slowly goes away. It'll take some time. There are many, many places where passwords will continue to be used, at least in the near term. But we are going in that direction to make sure that our users can have a better experience without compromising the security.

I like that answer too. So we're recording this from home, obviously, or perhaps not obviously. 3 of us are from home. You're actually in the office. This is a great example of hybrid work. But with hybrid work and the return to office, what assumptions baked into the Workspace security model have we had to change?

The good news is that Workspace was built on zero-trust security models even before zero trust was a buzzword many, many years ago, right? So we didn't have to fundamentally change the security model. All that we have been focused on is to refine it, make it more continuous, so that we can better adapt to the needs of our users. And like you said, many of us are working from home. Many of us are probably working from cafes. And we have to account for the fact that corporate network boundaries are no longer a thing. And you cannot ask your users to not access corporate resources when they're outside the office. So we do have these controls baked in to make sure that work from home can easily be accommodated with the existing model that Workspace has believed in. brought to its customers for a long time.

So you didn't have to change anything? It just worked?

Yeah. I mean, if you're asking, what did you have to change? Maybe some admins had to flip a few switches in the admin console, but that's about it.

Perfect. So this is interesting because I feel like when we all moved to some form of remote work, there was a lot of discussion about which security controls would survive, what security controls would not survive. So the idea is that In hybrid land, it looks like we have to deal with threat scenarios that are common to in-office work and to threat scenarios common for at-home work, right? Is that fair or not?

Yeah, I would say so. I want to just clarify 2 things. Like, we in Google Workspace define hybrid as being both working from an office where you have access to a corporate network and then working from home or really, honestly, working from anywhere, right? Like, Workspace thinks about hybrid as You are now able to work from anywhere at any time on any device. And so prior to, I would argue, the pandemic, I think the pandemic really was a forcing function for hybrid work. People were able to be in an office, they were able to connect to the corporate network via a VPN, and data was not like— if you were not using cloud-based solutions, the data was being stored on a device. And that opens up a lot of security threats and vulnerabilities. Like, let's say, for example, this device gets stolen or lost, right? That would never happen, right? We would never accidentally leave our laptop or our phone or our tablet somewhere. Well, because the data resides on that device, whoever now has access to that device now could potentially have access to sensitive company data. That's huge. We also saw, because a lot of this data was not cloud-based, it was reliant on an IT department or a security team to patch for vulnerabilities. And so you were not always sure that those devices were up to date and safe from emerging threats. And so with hybrid and then also with Zero Trust, which we think about that approach in Google Workspace of making sure that end users have access to the right information, at the right time, under the right conditions. Workspace runs on the cloud, and it was born in the cloud. So not only is it secure by design, and with some of the things that Nikhil has mentioned, like we have built-in controls that you just get by being a Workspace user, we give additional security controls depending on your role. And also, we realize that every organization is unique and that some organizations, because of the vertical that they're in, they're going to have unique challenges that another one won't. So we give you certain controls. But now, because it's cloud-based, your data is easier to protect because the data is stored in the cloud and it resides. So let's say that a device gets lost. Well, you're not dependent on that device being found. It is stored and it is secure in the cloud. You also don't have to worry about using a bunch of different endpoint management solutions, right? That is also super time-consuming for a lot of a lot of our customers. With the cloud, you have this one centralized control plane that you can deploy and execute updates and monitor the security status of your devices. And the really, really important and crucial thing for us with Workspace is that just like when we were talking about with passwordless and wanting to make this experience frictionless for our users, we really want to eliminate security being seen as a burden or a huge responsibility by the security team, and as well as their employees. And we want to make sure that it is— it's simple, it's seamless. If we do bring them into the equation with security, like with our end-user nudges or things like that, that it's intuitive and it's simple so that they can really spend the majority of time doing what their organization employs them to do. So like if you are in IT or security, you have a ton of other proactive projects that you need to manage or If you are an end user, you need to email or work on a Google Doc with your peers. You need to build those relationships with your customers. And we want to see— we have built our products to enable that rather than interfere and impede with that.

Well, I love that. And I love security that just works and gets out of the way. And I think particularly there's a lot of benefit here for users when you think about the no need to update things and Google just taking care of it. care of that. We're getting on time, and so I want to ask our traditional closing questions. Nikhil, Kelly, do you have recommended reading for our audience? And then do you have one tip aside from adopting hardware security keys to help people improve their Workspace security experience?

Well, and of course, using Workspace, right? Don't forget that.

And of course, using Workspace.

I don't want you using some kind of 1990s typewriter or Office.

WordPerfect.

Or get your floppy disk out, right?

No.

You don't want your Office suite on a floppy.

So don't do that.

Oh God.

With all fond memories of floppy disks that I've used in the past, I would say that to answer your question, Tim, I would encourage our users to be aware of the BeyondCorp model that Google came up with, which has now been productized for Workspace customers through what is known as context-aware access and further enhanced with a recently launched product called BeyondCorp Enterprise. So if you use these as keywords, to your searches, you would find a lot of great information that with basically the fact that at the heart of all of this, there's a strong policy engine that evaluates context for each digital interaction within Workspace, right? This includes the context of working from home or some, you know, non-corporate network, working with a BYOD device, etc. But I would say if you take these 2 keywords, BeyondCorp Enterprise, context-aware access, and look them up. That would make up a fantastic read as you start thinking about securing your users within Workspace.

Kelly, any tips?

Yes. So I have to plug this because our awesome Workspace team has spent so much time working on this. We just had Google Cloud Next. If you have not had a chance, if you don't know what that is, that is Google Cloud's largest enterprise-centric event where we talk about the latest and greatest in Google Cloud. And Nick Hill was heavily involved in this presentation where we talk about how to implement a zero-trust approach with Workspace Security in your organization. And why I want to leave listeners with this is I feel like a lot of times, you know, we get on here and we're like, yeah, zero trust, you know, and I know it's a buzzword, like it's super important, but now what, right? Like, how do I actually make this a reality for my organization? And we explain that. And like I've been talking about earlier, one of our key tenets as a Workspace team is we want to make sure that security is seamless so that it doesn't interfere with productivity and collaboration. So I will make sure, Anton and Tim, to give you the link to this session, because even if you don't watch it, it is a fabulous listen.

We'll include that in the show notes. Naqil, Kelly, thank you so much for joining us today.

Thank you so much, Tim and Anton, for having us. It was great to be here.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @Anton_Chuvakinin. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. Thank you, Roni.