Next 2022 Google Cybersecurity Action Team: One Year Later!

Security.

Hi there. Welcome to the Cloud Security Podcast by Google for our final 2022 NEXT special episode. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered to you piping hot every Monday afternoon, or whenever we have a special episode, and listeners, there are at least a few more coming up this year, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we have your boss on the show today, which is super fun, and returning guest who I think I adore, and I hope our listeners adore, Phil Venables.

Exactly. And moreover, the topic is really exciting. It's Phil's reflections on 1 year of Google Cybersecurity Action Team, or GCAT. That's what we don't usually say. We use the full description.

You're not allowed to GCAT them, right? You have to say Google Cybersecurity Action Team.

I think we are allowed to GCAT it, but we are ultimately not doing it. We are choosing not to do it.

Well.

But of course, my reflection on GCAT, which I can do very quickly, was that— it's a bit of a secret, but I was sort of tasked with figuring out a way to make a logo for GCAT. So you can— if you have to blame somebody for GCAT logo, you kind of have to blame me.

Well, it's nice to know who to blame for that one. I have been really impressed with GCAT over the past couple— well, over the past year, in part as a source for some of the funding for some of the things we want to build. So I'm very grateful to GCAT as well. With that, let's turn things over to today's guest.

And with that, welcome Phil Venables, VP and Chief Information Security Officer at Google Cloud.

Hey, great to be here. Really great to be back again. I'm not sure how many episodes I've done now, but it's great to be back.

Perfect. And this is kind of an anniversary episode to talk about GCAT, Google Cybersecurity Action Team. And GCAT is your brainchild. I keep thinking of it as kind of you being the spiritual father of GCAT. So, And it's 1 year old. So what comes to mind first when you reflect on this?

Well, I think, you know, I wouldn't necessarily claim it was kind of all my invention. It's like a lot of things in any organization that, you know, a lot of good ideas come from the collective inspiration of the many. So yeah, we're 1 year into the Google Cybersecurity Action Team, which was really formed to provide a much more integrated set of support across the entire lifecycle of how any type of customer onboards and makes effective, secure use of Google Cloud. And so the way we kind of constructed GCAT, as we call it internally, is to make sure that all of our different teams that have different types of skills and expertise at various stages of the customer journey, whether it's the executive management, the engagement with the CISO, the planning of the security transformation, all the way through to things like working with auditors and regulators on control attestations, and then through to the customer engineering, the professional services, the solutions engineering. So, all of those things. And so, what we did with GCAT was really take all of those existing great teams, expand them, align them together so customers could consume one unified integrated service as part of their onboarding to the cloud. And I think, you know, one year in, we've expanded the teams, we've created that alignment, we have a much more integrated solutions catalog, and we're getting a lot of great feedback from customers, which is why we did it. So that's great.

Right. And I think to me it makes sense. And it's interesting, you mentioned helping customers, and sometimes We have clients come to us and they say, hey, how does Google do it? And then we give them this information and they say, but you're not Google. And it's almost like a bit of a paradox, right? They want to know how Google solved a particularly challenging problem. And then when we present our way of doing it, they say, but we are not you. So, what have we learned helping clients during this year? Like, I can probably remember the workshops around security operations, the autonomous security stuff. You see all of it, right? So, what kind of lessons we learned helping clients with security?

Yeah.

I mean, the main thing is, and this might be a little bit of a statement of the obvious, but certainly only became obvious to us in hindsight, was you've got to help customers in the right way at the right moment in how they're using the service. So, for example, if you have some great customer security engineering expertise that's helping a customer adopt a particular or migrate a particular workload securely into the cloud, then that's not necessarily the same type of people that are going to be helpful on sitting down with the auditors or regulators of a customer that can map the controls onto industry regulations. And they may not be the right people with the right experience that could, say, partner with the CISO on stepping back and thinking about how do you put in place the new governance structure for managing a large-scale migration to the cloud. And so, you know, the real insight here is that you've got to deploy the right people with the right expertise at the right moment on the customer journey, but you've got to do that in an integrated way so that one handoff from one specialist team to another is seamless so that the customer doesn't have to internalize that handoff amongst teams. And that, I think, was the big insight, was having these specialist teams as individual components of the GCAT organization, but align them in such a way that there's a smooth handoff between them and it's one integrated set of services for customers. And I think that has been what has been received pretty well by customers.

Yes. And I think that your point about helping them pretty— maybe I shouldn't say where they are, but kind of helping them the best way possible based on where they are and where they want to go, right? Because some of them are lower in maturity, some of them are quite high in maturity. That's probably an angle to this too, right?

No, no, exactly. And in many cases, some customers want to consume all of the GCAT services. Other customers may have already established their cloud governance, their cloud infrastructure, and maybe all they need is a very specific bit of professional services that goes deep on one particular product and they can have that. And other customers may want to focus for a period on how they get all of their audits and compliance attestations done correctly. And then another customer may be expanding a particular business and wants to go back and have the security transformation workshop again about how they're going to do it for that business. And again, one of the things we focused heavily on is how do we build the institutional memory of particular customers on particular teams so that if one customer that's worked with us comes back and needs more work, then we can redeploy the same or adjacent people that don't have to relearn, you know, what that customer's industry is, what that customer's business is, how that customer works and approaches things. And in many cases, because as we all know, most organizations are not solely on one cloud platform. It also helps us to make sure that we've got people we can redeploy that also understand the broader customer environment that is often on-premise and, in fact, multiple clouds.

Yes. And this kind of reminds me of the next question I wanted to ask about challenges because I think this type of transition and having a smooth transition hasn't always been easy for us, right? So while we are both— well, GCAT is kind of a daily reality, or Google Cybersecurity Action Team is a daily reality for us. So it's easy for us to track challenges internally. But like, What can we say to the outside world about what challenges we faced? To me, this is one challenge you highlighted. Of course, the customer journey wasn't always explicit and obvious sometimes, right?

Yeah. I mean, look, there's a couple of challenges. One, which is a challenge of success in the fact that, you know, in the sense that we're kind of almost constantly oversubscribed in terms of, you know, demand for what the team can do. And we've been responding to that by growing the team. We've also, to be fair, worked this by having a lot of other partners, whether it's kind of professional services partners or marketplace solutions partners, or just, you know, just partners in general that enable us to scale our ability to deliver these kind of end-to-end services to customers. And then in terms of the other set of things is we look at the challenges we see in our engagements with customers, And then we try and provide that as a fast feedback loop into which future solutions blueprints we'll develop that will optimize. And then again, as I know, you know, Anton, very familiar with all of the work we did on the Autonomic Security Operations Blueprint. You know, as you know better than me, because you were one of the authors behind it, is that a lot of that was originated from us doing deep engagements, helping customers think through their next-generation security operations in a hybrid multi-cloud environment. And it being a repeated exercise of applying the same advice that we then extrapolate not just into a white paper, but also into a whole solutions blueprint based on that learning experience. So I think we're getting better at this feedback loop of identifying issues in engagements that we can extrapolate into blueprints and even more so now extrapolating into particular product features we'll build into products. and particular changes in secure defaults that we can help customers with. So again, I kind of view GCAT as not just almost like a set of professional services for customers, but it's a fast feedback loop into blueprints and product based on direct experience in working with customers on their migrations.

Yes. And I think that your point about feedback loop is quite dramatically playing in kind of my own work, right, around ASO, Autonomous Security Operations. We're trying to quickly put together some of the lessons in our work on Autonomic Data Security, right? So we already know over some of where we would trip learning from ASO. So we're trying to make the data security journey to be smoother, and then eventually influences the products as well.

Yeah, no, I think that's exactly right. I mean, yeah, every engagement is a feedback opportunity, right?

So I want to shift gears briefly and mention the other proud achievement of GCAT, of Google Cybersecurity Action Team, namely Threat Horizons reports. By the time this airs, we would probably release our 4th report. So any lessons on threat research? People who assume that Google Cybersecurity Action Team is kind of an advisory function get a little bit surprised when we say that we also do heavy threat research. So what is your view on the future of such threat research here? I know we have a lot of plans. I probably wouldn't talk about them, but what's your view on the future of threat research here?

Yeah. So for those that don't know, one part of our GCAT team, they do other things than just contribute to GCAT, but they're part of GCAT, is a team we call our Security and Trust Center. And they help out on customer incident response and supporting customers in drills and exercises. But another thing that they do is provide and produce threat intelligence. And in particular, this report we call our Threat Horizons report. And you're right, but I think by the time this goes out, we'll have definitely published the 4th one. And, you know, we have a lot of really great threat intelligence across Google. And, you know, even more so now we have Mandiant as part of the Google family. But I think, you know, all of the listeners will understand there's different types of threat intelligence. And so, for example, our TAG group produces a lot of threat intel. We take a lot of threat intel and that provide— we provide that as almost like fuel for various of our products like Chronicle and Cloud Armor and other products. And then we have Mandiant that clearly do a lot courtesy of incident response and other things. But one of the things we wanted to do with the Threat Horizons report was to provide what we kind of think of internally as strategic threat intelligence. So it's threat intelligence for security leaders and their leadership teams, as opposed to specific IOCs for the security operations team or specific, you know, in-depth analysis of a particular particular APT group. You know, that we, you know, we have the capability, we do those kind of reports. But the Threat Horizons report was more about what can you take from looking at the world of threat activity, whether it's new attacker TTPs, lessons learned from incidents or close calls, what we're seeing from our collective intelligence of where we see certain types of events leading to certain types of customer compromises, and really synthesizing that together and saying, What can you as a CISO or another security leader take from this threat intelligence and apply that to your strategic planning to say, here's a set of investments we're going to make to mitigate whole classes of threats, whole classes of attacks, to take our security game to the next level? And interestingly, you know, one of the use cases, you know, we find, you know, we get a lot of good feedback on the Threat Horizons report that it does pitch straight down the middle at being useful for CISOs. But what we also hear a lot of is the intelligence and analysis we put in there is often supporting what the CISOs have already concluded, and they're able to use the Threat Horizons report as additional justification to their own leadership as to what might be the right course of action. And certainly, you know, while we strive to produce something new and useful, and often we do, It's also just as useful for us to be a corroborating evidence on why something that the CISOs have already concluded needs to get done. And so we think we're occupying that space and being quite effective at it. And it's very, very different from in-depth threat research or IOCs. It's sitting in the middle.

Right. I mean, we clearly would not impress people with just the volume of indicators because, I mean, We have an impressive bucket of indicators, but ultimately, that's not where the magic is.

Yeah, exactly.

So here's the other strange question, but I felt like there's no more perfect person than you to ask this question. And it's kind of, of course, our leadership, like Thomas Kurian, would sometimes point out that solutions win the day and not necessarily products or boxes or SaaS services. So in security, we sort of have the solution direction, like ESO is a solution. There are other solutions. But even a lot of CISOs, frankly, at least in my experience, are kind of box buyers. So, how do we change their minds? How do we remind people that ultimately, the success is connected to solutions and not just to buying more boxes or SaaS products? Is it too fuzzy? I know, sorry, it's a bit too philosophical to ask.

No, I think I know where you're going. I mean, essentially, I mean, like, as most people know, our kind of thesis is security that's built in, not bolted on after the fact. That while there will always be a market for security products, we really strive to have secure products. And so I think there's 2 ways of looking at this is really what we want to keep doing is producing a platform where customers can buy a platform or a solution that has security built in. But in an environment where they're living in multiple clouds, there's a combination of on-premise, there's probably multiple SaaS services. We know that while we can and should continue to provide security products for them to deploy across that environment, we also know that the arrangements of those kind of products and features, whether it's a combination of things like Security Command Center plus Chronicle plus CI Amplify for security automation, plus some of the things we've now got with Mendiant, plus some of the embedded tools like Cloud DLP that embeds in some of the data products. So, there's a whole set of components and features and products that exactly as you and Iman did with Autonomic Security Operations, and as you and John have talked about on kind of Autonomic Data Security, the real value you get is about the 1 1 is greater than 2. It's how do you— piece together the features and components in ways that provide even greater value than the individual parts.

Yes. So, in that sense, solution is almost like— I'm not sure why I'm using magic all that much today, but it's the magic that connects capabilities, products, secure products, secure defaults, and other things in the coherent story that customers can experience. The solution ultimately becomes that connecting tissue, connecting story, right?

Yeah, exactly. And it's thinking about the kind of the The end-to-end objective is the solution, which may be made up of, you know, individual product features or individual products. Now, of course, the interesting question for all platform providers is how much do we turn those solutions into singularly integrated solutions? How much do we further embed it in the platform? And so, At one level, having a solution is great, but at another level, having a solution might be a sign that we need to do more product and platform integration. And in fact, that tension that exists there is yet another feedback loop that will drive improvement in platform, and it'll actually drive improvement in even more solutions that can help piece together more things in a more end-to-end way.

Yes, actually, that does make sense to me. So, thank you for— this is actually, I have a picture in my mind now that's a lot crisper than it was before. So thank you for doing this. So hopefully our audience gets the same. So I want to shift gears a tiny bit and kind of remind everybody of Phil's favorite— well, it's kind of my favorite, and I'm sure it's Phil's favorite too— post about 8 megatrends. And personally, I've shoved it in a lot of faces to remind people that cloud is in fact more secure in many regards, and it's becoming more secure. And people have occasionally produced shocked reactions. But I feel like the post makes the crispest argument I've seen, kind of like, from all the arguments, that cloud is not only more secure, but it's becoming more secure. But the post is a few months old. So, how do you think it aged? So, do you think the insights are mostly current? Is there the 9th megatrend? Is there an update? Just curious about it. Everybody should read this post, by the way.

No, it's interesting. And we'll definitely link it in the show notes. And it's obviously, I think if you Google megatrends, it's up there in the top few of the Google links. But it's definitely, You know, the 8 megatrends that we identified, you know, which as you describe, Anton, are these kind of these things that just these basic forces that drive cloud to get more and more secure, you know, whether it's economy of scale or various other attributes. Definitely, you know, we've not seen that there's any more than these 8 megatrends so far at least. And we've definitely in every opportunity we talk about these and it's certainly a great means of explaining why cloud grows and evolves in a more secure way. And in fact, not just security, it's resilience, it's kind of other types of risk mitigation. And so, I think the megatrends have proven stable and actually continue to resonate with people as they think about that. But what's interesting is each event and each discussion point brings to the fore different types of megatrends. So for example, I was in a, in a conversation today where we were talking about cloud as the digital immune system, which is one of the megatrends. The fact that we ship hundreds of updates every month informed by threat research, customer feedback, some of the things we've been talking about today around feedback from customer engagements of where people want a particular product feature, we build that into a product and it isn't just that customer that benefits from that. By definition, the entire use of the cloud platform benefits from that. And this feedback loop is getting faster and faster over time. And again, that's just one example of a megatrend that continues to fuel this drive of more security. Another one that comes up quite a lot, and I was in Europe for the past couple of weeks spending a lot of time with EU customers and governments. And so the big topic of digital sovereignty comes up. Which is how do you think about localizing data in countries? And again, that's a useful construct and a useful megatrend for cloud. As cloud becomes more geographically dispersed because of its scale, it's able to support more digital sovereignty controls. And then because of the economy of scale that lets us invest in more advanced encryption technology and key management, we're able to support data residency controls implemented through cryptographic controls, which again is another thing that typically organizations have never really been able to justify the expense in an on-premise environment. So I think, you know, to answer, you know, the short version of that answer is I think the 8 megatrends remain consistent and continue to be a tool that, you know, an explanation that resonates with a lot of people about why these trends push cloud security forward.

Right. And I think even occasionally people bring up a counterargument about concentration risk, right? And we are planning to address it in new papers and new content. To me, this concentration risk doesn't really derail this. To me, concentration risk is a risk to handle, but ultimately cloud does reduce risks. The mega theme is that moving to cloud reduces your risk. This is kind of the story.

Yeah. Exactly right. And you're right. And we hear that question about concentration risk. And in fact, when we think about digital sovereignty and we break out digital sovereignty, not just into data sovereignty, where you store your data, or your operational sovereignty of where you get your support from, of which countries that support comes from, the third sovereignty element of software sovereignty. which is part of our megatrend of sovereignty, leads to portability, interoperability, adherence to open source and open standards, which ultimately is the path to mitigate concentration risk. So everybody has a choice of how concentrated or not they want to be across cloud providers, across on-premise. And the key to that is software sovereignty, which ultimately comes down to Portability of workload driven by open source and open standards and having all cloud providers, in fact, all IT providers really commit to open source and open standards in reality, as opposed to in name only, I think is ultimately going to be the answer to concentration risk.

I like that. And I think that's something that probably changes some of the security leaders' thinking because they're kind of stuck in this like, oh my God, all eggs in one basket. But that's not really the reality, it's much broader than that.

Yeah. Oh, no, no, exactly. I mean, it's interesting as well when we look across various industries, you know, it's not like concentration risk doesn't already exist in the form of telecommunications providers, some SaaS providers, some industry-specific SaaS providers.

OS vendors. How about OS vendors?

No, no, exactly. It's, you know, and people have been managing and dealing with that for a long time, right?

Yeah, yeah, exactly. So, I wanted to switch gears completely and kind of avoid Giket for a second. And highlight one really, really fun blog post which you wrote called Critical Questions from CISOs and Security Teams. And this is not connected directly to what we discussed, but I was really impressed by that because it felt like it's like a zeitgeist of the industry in one blog. At least that's how it's encoded in my head. And there was a question about hybrid cloud that probably means that for a lot of CISOs, hybrid cloud is still largely a mystery, right? Is this also your favorite question? It's number one in the blog.

Yeah. So it's interesting. And again, this blog post comes up with, you know, basically I've summarized kind of what I'm hearing from the CISO and security leader community across multiple industries worldwide. And obviously, there's a little bit of selection bias here because what I hear turning up in the context of being a cloud provider is probably going to be slightly different than maybe what's some other people will hear, but I think it's a reasonable summary of things. And yes, the first one is kind of hybrid multi-cloud, although I don't really think I put them in any priority order. But the question I get from CISOs and security teams, and in fact, risk and audit and other teams as well, is most enterprises now are really this kind of collection of on-premise environments, at least 2, if not more, cloud providers, and then dozens, if not more, of SaaS providers, and then dozens, hundreds, to maybe even thousands of other types of vendors. And then similarly upstream, there's all sorts of digital connectivity to customers because most customers of many types of organizations now don't just come through your mobile app or your web app or a physical interaction. They're coming through an API connection and you're an API that they program into their systems. So this whole extended enterprise means that CISOs and security teams are having to sit back and think, how do I make sure that all of my customer interactions, all of my data, all of my extended supply chain across that entire ecosystem is protected equivalently, is adherent to policy, is risk managed, is secure, private, resilient, et cetera. And when you pick any single tool, you can't drop a whole tool over that entire environment. Now, like, there's some startup companies that are going down that path and claim they're already there now, but frankly, nobody is. And, but I think it's definitely a challenge. And so what you see is security teams having to deploy multiple tools, some homegrown, that let them piece together this complete operating picture of their actual enterprise IT, which is much, much broader than one cloud or one data center.

Yes. And this also indicates that for us, our job, our profession would be really intellectually challenging for years to come. I mean, cloud is a huge contributing factor to reduced risk, but we won't magically fix it in the next years, decades. So, there's a good chance that in 20, 32, we'll be having a, hopefully not the same, but maybe a similar conversation at a higher level in the future. But ultimately, this stuff is not going to be solved for good. It would be fun.

Well, no, I think it's going to be a constant evolution. I think the good thing though is cloud, I think, will actually be a basis for how you solve that. So as more things move to the cloud and more cloud technology gets better at connecting back to on-premise and connecting in interoperable ways to various different SaaS services, I think we'll see more of a use of cloud as the control plane for all of that, even if everything isn't in cloud itself.

Yes. And this is actually a perfect optimistic note to finish our episode. Thank you very much for your time. And as always, it was really A huge pleasure and actually intellectually stimulating to me. This is kind of why I love working for Office of the CISO and Google. So thank you very much for leading us.

Yeah, no, it's great. It's a pleasure to be here and looking forward to next time.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity, Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter, @Anton_Chuvakin and @_TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. Bye.

Security. Security.