NEXT Special - Google Cloud NEXT Security: What to Watch?

Security.

Hi there. Welcome to a special edition of the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and esteemed member of the cloud security team here at Google. You can find and subscribe to this podcast wherever podcasts are sold and distributed, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. Really does start to roll off the tongue. If you enjoy our content and want it delivered piping hot every Monday morning, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Now, I mentioned this is a special next episode, and today is Monday, the week that Google Cloud Next is airing. It's a digital-only conference this year, but we're releasing a podcast episode every day of the week— Monday, Tuesday, Wednesday, Thursday this week. Anton, it's Monday. What are we talking about today?

Well, first thing, we have to warn our audience to not get used to a daily podcast. We are not doing daily podcasts during normal weeks. This is just our Next special. I just want to set expectations correctly because otherwise people on Friday would call us and say, Where's my Friday episode? And we're like, you have to wait until Monday.

So— So our normal programming will resume Monday of next week.

That's correct.

That's good.

But Next is kind of a big deal here at Google Cloud. So I wanted to talk about a few things that the conference attendees tomorrow and during the Next would see and hear. So Rob Sadovsky is a good person to highlight some of it because he's involved so deeply with a lot of security content that's been produced with keynotes, with presentations. So it's kind of interesting how we have so much breadth and depth in security. It almost feels like a separate conference. Of course, Next is about Google Cloud in general, not about security, but there's a lot of really good security content.

That's right. And security is just one of the tracks, but it does feel, at least from where I sit, that it's the big focus. We know that Google Cloud is all about security.

Indeed. And of course, both of us are speakers at Next as well. So this makes this episode a bit more self-serving for us, but at the same time, We want to highlight really good colleagues and peers we have here at Google, whether they're product managers or not, because there's actually genuine innovation at Google scale is happening, definitely in zero trust.

Yeah.

Probably in security monitoring, security operations, definitely in threat detection, and in a few other areas.

Supply chain.

Supply chain. Yeah, that's a truly Google-scale problem. As we highlighted at one of the episodes, this is not something you can just like do a random startup on and say, hey, we're going to fix this problem. No, sorry, buddy. That's not happening. You need to have a scale of a large company to do that.

That you do. So perhaps with that, let's turn it over to our guest today and hear what Rob's got to say. And with that, delighted to introduce today's guest, Rob Sadowski, Trust and Security Lead here at Google Cloud. Rob, I'll give you a softball to start out with. What are some of the big security themes at Next this year? Is security still, you know, visible? Are we invisible? Which way are we going with it this year?

Well, thanks for having me on, guys. I think the biggest theme is security itself, really, and how important it is. I think that for our customers and the people who aren't using Google Cloud yet, who are coming to next, cloud transformation isn't going to happen if they don't have trust, if they can't meet their security goals, if they can't protect their data or their apps or their brand, you know, they have concerns about that, they aren't going to move. But if we kind of click down in terms of more technology-centric themes, I think zero trust is just huge. I mean, how can we use zero trust models and thinking in architectures and technology that helps with that to protect not only employees but assets? You know, a lot of the focus on zero trust to date has been on using it for access with things like BeyondCorp, but applying that thinking to other domains like we do with BeyondProd, how we protect production systems and really that whole process, I think, is a big theme overall for us. I think related but separate and different where there's a bunch of focus is securing the software supply chain. A lot of that really ties into how companies think about protecting their intellectual property because, you know, their code really is their IP these days with so many organizations doing digital transformation, becoming digital businesses. So that's kind of the tech-centric side for themes. I think on the business side, it's a lot about how businesses, as they continue to move more and more processes online, more and more interactions online, how are they protecting their end users? And by extension, how are they protecting their brand? So what are the technologies that we can contribute and how are we helping them keep up the fight against things like phishing, bot fraud, other types of malicious activity that might target their online or their But back to your question, Tim, I think, you know, this is the what, but what about the how? And yes, invisible security is still our vision of how we make more of our security capabilities available and consumable so that even more organizations can benefit from the best of all our Google security goodness.

There's a lot of really interesting stuff in there. One thing, two things, maybe three things. One thing for listeners is we have a whole episode on supply chain security with Aparna and Eric. The second thing is we shouldn't be surprised that when we bring a marketing lead in, we bring things back to protecting brand and how important that is. But the third thing I want to pick at maybe is what do BeyondCorp and BeyondProd have in common, perhaps beyond the first word of their name?

It's the thinking behind them, that the idea that inherent trust in any single component of a complex system is a bad idea in terms of security. And instead, we need to build that trust through multiple layers of protection, multiple layers of assertion, and other things to really get there. It's that thinking. It's treating zero trust, which underpins both of those, as a mindset and not necessarily a collection of tools or a toolset. I think that's the common thread that runs between them at the core.

I really like that answer.

Yeah, and it makes sense to me because, again, zero trust has suffered from being blamed for being purely a buzzword. And to me, living at Google, we know it's not purely a buzzword. It's very buzzwordy, but it also reflects very real operational reality we have in both how we run our client machines and how we run our production assets. So in that sense, it's kind of peculiar to hear that zero trust is a buzzword, but we also live it. So we know it's real.

Absolutely. I mean, it underpins so much of what we do. It's not just ProdOps. It's not just access. Think of applying some of those principles to how we design operating systems like Chrome OS. Think of how we implement some of those principles in Chrome browser and other things like that. So it really does permeate so much and is at the core of so much of our security design and thinking here at Google.

Yeah, that makes sense. And I think to me, Zero Trust is something that will continue to be with us for the foreseeable future because many, many organizations are still learning how to approach it in their environments. So one thing to add to this is, of course, that invisible security still stays as a theme. But we also launched a few solutions that highlight the autonomic elements of security, not automatic, not without people, but autonomic, self-improving. So, what about the themes of invisible security versus autonomic security? How are we thinking about that?

You know, where those 2 really start to merge is when we think about security operations. You know, when we think about security operations, too much of what we do today is manual. And it's one of the biggest things that makes security challenging. It just requires a ton of manual labor by very smart people. And so, we want to move along a continuum first to make those operations that are very manual more automated. Like, we're already seeing that as a trend. I mean, something like SOAR, right, has automation in the acronym, right? So, it's a goal that the industry is moving towards, and everyone is buying tools like that. But the ideal end state, again, is much more autonomic and systemic, where there's more reaction to various situational inputs and not just making the steps in a runbook faster. How does the system adjust to itself and adjust to different stimuli? You know, that would be a really, really interesting and transformative kind of end state that we're working towards. But I want to point out that the operations piece is just one piece of our overall security vision, and that overall vision benefits from those different things. So part of it is also about how that security technology gets delivered, you know, having it be built in and intrinsic into some of the infrastructure rather than bolted on. Is going to make automation easier, is going to make this transition to more autonomic systems easier and more progress towards that autonomic end state. It has other impacts on talent, right? We talked about the very manual nature of things, but a lot of those manual tasks have to be performed by smart specialist resources. And the end state hopefully will reduce a lot of that manual labor and the need for specialization in those processes in areas that really don't even exist anymore. And I think the last piece that rounds it out is that in a cloud world, it's this transition to the idea that I think you've talked about before on the podcast around shared fate. Because as a result of the built-in controls and the automation and progress towards that autonomic end state, your security provider who's giving you that technology and the pieces that go around it winds up taking a much larger stake in hopefully what is much more positive security outcomes. So yes, invisible security is there, and there's steps towards an even more kind of advanced goal on the operations side, but there are other holistic pieces that fit around it that give us benefits as well.

I think what's really interesting on the, you know, making people more efficient front and helping runbooks operate faster when we are doing that is it frees up security talent where you have security talent really to do much more advanced investigative things. And it gets back to kind of what we were discussing with threat hunting, where that can be the last thing you invest in. If you're able to automate things downstream or earlier in your channel, you have more time for your security team to do interesting work like that. So I want to sort of look backwards in time rather than forwards in time and ask, is this your 4th or 5th Next? You've, you've been here a long time, it feels like.

I think it's actually more than that because we actually used to do multiple Cloud Next in a year, you know, not only here in the US but around the world. I think, Tim, that actually you and I did the security keynote at London Next a couple of years back.

We did, we did. I'll actually never forget the look on your face when my demo wasn't working during rehearsal. I've never seen a person so scared of a non-working demo. But I want to ask, like, what's different this year aside from it being virtual? What's new and exciting about this year's Next compared to past Next?

Yeah, I think in terms of what's new, it's how we've worked hard to replicate as much of the in-person experience that people value into the virtual setting. So like one example that we hear so often is that you get so many great conversations around product demos on the expo floor where you can actually ask the people who built the products about different features or how to do things in the product that they want to do or accomplish. So this time around, we have 20-minute live demos of some of our key products. There you go, Tim. You know, we still preserve that risk of the live demo here in the setting, and we're going to have audience interaction where you can guide the course of the demo by voting or polling. So I think that's pretty interesting and pretty cool.

Well, I guess I know why I didn't get invited to do one of those, huh?

And then we're also following up with live Q&A sessions with some of our product and solution leads. So you can get some of the interaction that you'd get in, you know, coming up to a speaker after their session, again, asking them those interesting questions Or something they didn't cover in the prepared slides or prepared remarks or the demo that they did up on stage.

Well, that's awesome.

Yeah, yeah. And I think the last thing that we've found in the virtual setting is that shorter sessions are either easier to consume or whatever, that they're more highly rated. So we've kept the breakouts to 20 minutes or less, which means one of the biggest challenges at a huge event like Next, where you have so many interesting sessions and not enough time to go to them all in a physical setting, setting, you know, sometimes you get 2 things at the same time. Well, I really want to go to that. I really want to go to this. And you have to kind of choose. Well, this is going to be reduced. You can get an overview of the same or even more topics in the same amount of time this time around. So, you know, it's certainly different whether it's better or worse, you know, we'll see, but certainly we're trying to replicate as much of the parts that people like so much about going to cons like this and getting together with peers and experts and things like that and trying to transition and replicate some of that in this setting.

At the same time, while we are doing this as a sort of a magical virtual event, I'm assuming it's not just a technology conference because there are some things that are uniquely Google about it. Of course, from the security highlights, you mentioned Zero Trust, which isn't uniquely Google, while BeyondProd and BeyondCorp are. Anything from the security that, in your opinion, is uniquely Googley, anything that can only come from Google?

I think you hit on a couple of them, Anton. One thing that we're going to do is kind of go a level deeper on some of the investment commitment we made at the US White House Cybersecurity Summit back in August. You know, we announced that Google is going to invest $10 billion over the next 5 years to strengthen cybersecurity. And 2 areas we highlighted for that spend are expanding zero trust programs and securing the software supply chain. And we've got deep dive sessions on both those topics that kind of speak to our approach and give a little bit more color and sense of that. So I think those will be particular highlights and really allow people to delve deeper into those areas.

Those sound awesome. I want to ask, we have a lot of CISOs on the podcast, and I hope we have some CISOs listening. What would you recommend next if you're a CISO joining us for the sessions?

The most important is our security kind of mini keynote. It's really talking about the invisible security vision that we talked about a little bit earlier and how we can help organizations, number one, protect their employees, number two, protect their intellectual property. We touched on that a bit, and then protect their users and their brand. So really seeing, you know, how are we relating security that is relevant to the business right now and making that connection. So for an executive who deals and works very closely with the business side as well as the technology side, I think that's a really nice session to bridge those together. And it's how we've thought about it.

Yeah, it makes sense. And I think that to me, the keynote and a few other presentations that highlight some things that are uniquely Google, some things that are uniquely strategic, some things that require deep fundamental approach to security that we practice, they're good for CISOs. But we also secure things other than GCP. So we have sessions that are useful for you even if you are not a GCP client. Of course, I'm thinking of my own session on Chronicle, but maybe Robby have another idea. What are the good sessions to watch if you're not yet a GCP client?

Anton, you highlighted a number of sessions where we have capabilities in our portfolio that means you don't have to be on our platform. So things like Chronicle, Things like reCAPTCHA Enterprise, and there are sessions on those. I think my favorite to this question might be we have a really great session on why security companies have chosen to build on Google Cloud. And so you might not be a technology provider, but these are some of the most security-sensitive organizations in the world. You know, if they get compromised or have incidents, they're going to lose a tremendous amount of customer trust. So to hear in their own words why they trust Google Cloud and choose to work with us, I think is very illuminating. We've done sessions like this in the past and they've always been great. So this is a really good one.

On that topic, if you, you know, were an attendee who said, I've got time for 3 sessions, only 3 sessions, what are the 3 they should check out?

Wait a second, that's a dangerous question. Both Tim and me have sessions. So now we're gonna pressure Rob to highlight at least 2 sessions which are, well, one Tim's, one Anton's, right? And of course, third would be Sunil's because otherwise we'll get fired. So what's there to answer?

Okay, so they have time for 6 sessions, 3 of which we've covered. What are the other 3?

Now, I knew I was going to get pressure from the hosts, but I resisted that. So thinking about this, it really is so hard to choose. So aside from the spotlight that I talked about, again, our session on Zero Trust Access and how customers have been implementing it is a great one. It's a top priority for a lot of organizations that I talk to, and it's not just the technology, but how do you do it? And we have a great customer in that session speaking to their journey and what they have done and the benefits that they have seen. Another, we have a really great session on Shared Fate. You know, I talked about that concept, but what are all the things that Google can do to help you improve your security posture on our platform? And then finally, you know, very topically, there's a great session on cyber resilience and ransomware.

Hmm.

And we're going to share some brand-new research that comes out of VirusTotal that we're seeing in the market around ransomware and the various families and actors, as well as present ways that we can help with ransomware comprehensively that's aligned to the NIST Cybersecurity Framework. So those are my top 3 recommendations, of course, aside from you folks' sessions.

Those are really great suggestions, Rob, especially the one on Zero Trust. We've done a number of Zero Trust pieces on the podcast so far with John and Max, and they've been really well received by the audience. You mentioned that there are live demos and interaction with the product and solutions teams. Aside from that, what should attendees do to get the most out of this year's content?

You touched on it, Tim. It's interact, right? So for example, we have Q&A with the session owners when those sessions run live in various time zones, and for 48 hours after that, they'll also be answered. So you get to kind of ask the questions of the folks who delivered the content as they are delivering it if it's prerecorded. And so I think that's great. And you kind of alluded to another opportunity we have is we have some hands-on labs and learning content that you can sign up for. And again, as I mentioned, many sessions are short. You really have the opportunity opportunity to get a wide view on a variety of topics. So, you know, that's something else I would encourage. But really try to stay interactive because we've tried as much as possible to give you opportunities to do that.

Yeah, I hear you on the short sessions. Trying to squeeze all of our content in 20 minutes has been very much a case of what Voltaire said of, I would have written you a shorter letter if I'd had time. It's taken a lot of time to have very brief content.

Correct. And but also, I get why it's valuable to people to get this type of a full depth but also in a concise format. This is going to air one day before the show. So how do people sign up to attend? Can they still register? What's the URL? Just give us the full info here.

They absolutely can still register. And the URL to go to is cloud.withgoogle.com/next. And if you can't attend when the sessions are running live, even though we'll have some great opportunities, like I said, for interactivity, you'll be able to watch the sessions on demand afterwards. So go ahead and do that. And we really hope to see as many listeners from the podcast as we can there live or watching the replays if that's not going to work for you.

Well, Rob, this was super illuminating. Thank you so much for joining us today.

Great. Thanks, guys.

And now we are at time. Thank you very much for listening and of course for subscribing. See most of you tomorrow as the NEXT conference starts. The link would be in the show notes. Frankly, NEXT conference is a big deal for us, so we hope to see all of you there. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. And of course, your hosts are on Twitter as well, Anton_Chuvakin and _TimPeacock. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode. See you at the next Cloud Security Podcast episode. And of course, at our next conference tomorrow.

Security. Security.