NEXT Special - Google Cybersecurity Action Team: What's the Story?

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us for another special Next 2021 episode today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and esteemed member of the cloud security team here at Google. You can find and subscribe to this podcast wherever podcasts are sold, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday Pacific time, please do hit that subscribe button. You can follow the show and argue with your hosts on Twitter as well, twitter.com/cloudsecpodcast. Anton, we've got returning frequent flyer guest Phil Venables today talking about Cats? Is that what this is? Dogs?

No, no, no, no, no.

No, no, no.

We are not even supposed to say the acronym too often.

Oh.

But it's a thing that happens to abbreviate to GCAT, and the full name is Google Cybersecurity Action Team.

Wow.

Think about it. It's action. It's not about advising or telling people what to do. We are about action. This matters.

Is Phil wearing, like, a cape, and does he have a superhero outfit? This sounds really dynamic.

See, that's the vibe I want, not cats.

Yeah, cats are a little lazy. So, so what's this GCAT all about? Because I struggled to summarize it during the episode. Can you give a pithy summary of GCAT?

So to be honest, I'd rather Phil do that. He may repudiate this, but I feel like it's his brainchild. And even though I've been spending a lot of my time working on the effort in the last few, actually months, funny enough, I feel like Phil would do it justice. So let's hide the secret for another 2 minutes and have Phil present Google Cybersecurity Action Team initiative to everybody. Hello, Phil. Welcome to the podcast again. This is your 3rd or 4th time, I think.

I think it's, yeah, at least 3. So it's great to be back.

Perfect, perfect. And today, our topic is super exciting. And a lot of people are definitely spending a lot of their time, many hours in their lives, on the topic of Google Cybersecurity Action Team. So we know this is your brainchild. So please tell our audience the origin of the idea.

Yeah, so the Google Cybersecurity Action Team, or GCAT, as we affectionately call it, I wouldn't really say it was kind of my brainchild. Like a lot of great things here at Google, these things spontaneously come out of a collected team effort. But the real background of this is what we wanted to do was to bring together all of the different security teams, especially those that face off to our customers, and give cybersecurity advice and support and management of various different security issues. We've got a lot of great teams that do a lot of great work, but they're in different parts of our organization representing the different parts of where the customer engagement is. And so what we wanted to do with GCAT was really to kind of bring together all of these teams in a much more consistent framework so that when we interact with customers or in fact interact with the world in general, that we interact with them in a more unified way, even though this will still be made up of many different constituent teams. But the face we'll represent and build and grow is this unified front in GCAT to give customers and the world in general a much more integrated one-stop shop to get world-class cybersecurity advice, help, and support from Google vectored through cloud and other forms.

That makes a lot of sense. So we're bringing together in one voice. Are there specific GCP Enterprise customer-facing things we're thinking about here?

Well, so I think there's going to be a range of different services and capabilities. So you can start off and it almost like kind of translates quite well into the overall customer journey of going through a digital transformation or a cloud transformation. So we have a set of services around strategic transformation and advice and workshops to help customers start to plan their security transformation in the cloud. And then there's a set of trust and compliance services so that when they've figured out how to orient themselves to the cloud, there's often a bunch of compliance management, legal audit, and various other things that they have to go through. And we have a range of people and capabilities that can support that. And then there's the whole design and onboarding using our customer and security solutions engineering capability. And, you know, We have a lot of people around the world that have got significant experience and expertise in helping customers transition to the cloud as well as build natively in the cloud. And this is where, again, we've, you know, marshaled a lot of the work that has gone on and will continue to expand under the GCAT in building more secure blueprints, security solutions, design blueprints, and various other attributes. And then finally, we have a thing that we call our Security and Trust Center that's gonna be a significant part of GCAT, which is all about how do we curate and provide strategic threat intelligence to customers? How do we provide incident support, event support, drills and exercises to help customers get ready to manage their environment, and a whole range of other services? But it really kind of fits nicely along the whole journey of planning for transformation, ensuring the control environment, onboarding and expanding workloads in secure ways, and then setting up an overall enterprise incident event threat intelligence capability for the cloud.

You know, Phil, I like to think I'm good at summarizing things, but that's a lot of things to summarize. It's as if you're covering actually like every topic we've covered so far on the podcast. That's kind of fun. So this has me having a flashback to when I was at Stripe. Our mission was put as improve the GDP of the internet. Is this like an improve the security of the internet play? Like, where does it stop?

You know, occasionally, as you know, it's interesting your comment around it's kind of hard to summarize. And I think that's really representative of one of the reasons we set this up, which is we have all of this capability that maps across all of the stages in a customer's secure digital transformation. And making sure that those are brought holistically together is critical for the customer. And that really kind of expands our ability to support them. But to your point is, you know, when we think about more of Google Security, which, you know, I don't think there's really much of a debate that we're a leader in cybersecurity across all of our capabilities across the wider Google and Alphabet organization. When we think about this, the GCAT is a big part of bringing that Google security to the world in general, not just through our cloud products, but by being a bigger voice for standardization, security improvements, engagement with industry associations, partnering with government stakeholders and others around the world. And so, you know, the GCAT is going to continue to take a leading voice in advancing forward security for the internet through various different forums. And I think that'll be a good way we keep supporting the internet as a whole, not just those lucky people that are Google Cloud customers.

To continue on that theme, the C in GCAT is not cloud, it's cybersecurity. So we are really not focusing on telling people that once you migrate to GCP, you're good. We're trying to go with a much broader story. And we're not trying to say that this is of benefit only to GCP clients. So to further develop this theme, we do see, I guess both me and you and others see organizations that are sort of stuck a lot in a pre-cloud thinking, in very much data center on-premise thinking in their security approaches. So can GCAT help those clients as well? Can we help them with modernizing their thinking, not just their tools?

And again, this is why it was so important for us to bring all of our teams together that work with customers because there's a natural flow. For example, when we talk about doing the security transformations workshops that help customers think through security strategy, a big part of that to organize their cloud project governance, their ongoing governance and security management models, to get them to realize there's not just new ways of doing security in the cloud, but better ways, but also ways that enable them to manage their security and resiliency risks a lot better. And that flows really nicely into different ways of doing compliance, which flows really nicely into all the work our customer and security solutions engineering teams do onsite with customers, partnering with their teams, helping them transition. And so, all of this kind of flows together, and a big part of it is not just to keep hammering this message that you can do security in the cloud better and differently, but also to partner with customers that have existing workloads under older security models that often need to be transitioned, not totally re-architected. And again, this is where having really experienced people and the people that have grown not just in a cloud environment, but in an enterprise environment that now work for Google in the GCAT team, really providing not just theoretical expertise, but actual real hard-won on-the-ground experience of doing these things. And these teams will keep accumulating that experience from all of the work with all of our customers. And so every engagement is going to bring that accumulated value to every new customer. And it's all about Getting the most out of the cloud, transitioning what they've got, and really thinking about getting the best of what you get from the cloud in terms of security and resilience.

You know, that's one of the things that came up in our episode that we released, well, audience, on September 27th with Elliot Abraham. It was clear that Elliot had been down this road a lot of times. And as Google, we have this opportunity to really take what we learn in one place and help all of our users avoid those same mistakes and avoid those same skinned knees. with their digital transformations. So that's awesome. Anton pulled us in the direction of outside of cloud. Are there things inside of cloud that you're particularly excited to surface as part of GCAT? Like, what are the Sunil projects you're super stoked on?

One of the great things that, you know, because we've got adjacent to everything we do, we've got a great cloud security products business. You know, one of the things, again, when you look at how we're taking threat intelligence into our cloud security products, that in turn are embedded across the rest of our cloud environment. That's a great path for some of the threat intelligence work that comes from the wider Google into our products. But at the same time, as part of the GCAT, we're going to be partnering with the Cloud Security Products team to take that threat intelligence and curate that into more strategic outlook for large enterprise customers, and in various ways also kind of small to medium-sized businesses that want to ingest different ways of doing things driven by the opinions of us from the threat intelligence we collect. But partnering with security products to take that view of threat intelligence and then also to look at how our security products can fit with the rest of the cloud environment in ways that we can enable customers to get the most out of those products is just going to be an intrinsic part of all of the security advice that we give as part of GCAP.

So we're going to be seeing more of each other, not just on the podcast, you're saying?

Absolutely. And, you know, in fact, you know, a big part of this is we do a lot of this today on our customer engagements and also with what my organization does in our internal-facing role around product security and various other aspects is there's great opportunities for even better feedback loops from customers to advice to product and getting more and more of what we see that may be difficult for customers or opportunistic approaches for mitigating future risk. Getting that into product or into blueprints and solutions for the assembly of products to help mitigate that risk and just doing that quicker and quicker is what this is going to be all about.

Perfect. And I think that made sense to me because we do have some of the challenges of bringing Google product security to the world. So to me, the GCAT mandate, Cybersecurity Action Team mandate, definitely applies quite nicely to this. One other thing I wanted to bring up, and there's been a challenge, at least in my interactions with people outside of Google, Sometimes when we present our security innovations to clients or others, they say, but we're not Google. We know it's inspired by Google. We know it's built at Google. But we are kind of not Google. And sometimes they're nervous that they cannot implement it into metal, put it to reality. So is there anything in the Cybersecurity Action Team mission that helps bring more of Google security to the world, even though the world is not Google?

Well, it's kind of an interesting question because this does come up a lot. And it's kind of a compliment in a way. But you've got to remember, as we all know, that, you know, and this may sound a strange statement, but we weren't Google before we became Google. And so, a lot of these innovations that we drive are not born out of some theoretical environment. They're born out of the difficulties we have had in building a hyperscale environment, in meeting security challenges, whether it's the software supply chain, in managing open-source projects, in driving zero-trust architectures, whether it's zero trust for user access, or zero trust for production environments, around what we do on secure and confidential computing, application modernization, container security, and a whole range of things. These are things that we've come up with approaches because we've been challenged by them and have figured out ways of doing it. Now, we've solved them at scale because we run a massive-scale environment. But some people then take that to mean that that's not necessarily gonna be useful for them in their regular or even large-scale environment because it's not hyperscale. Whereas the reality is, you actually want a hyperscale company innovating because we can't take things for granted about how things work at scale. We also have to do things that are not just automated, but they're also autonomic, you know, because at scale, you can't be dealing with a lot of edge cases and manual configurations and dealing with large volumes of alerts because the scale will just kill you. And so also because we also have a very large number of engineers and projects, we also can't rely on conventional processes to manually review things. And so we have to have a lot of automated tooling. We have to make sure the secure path is the easiest path so that things are just done naturally with scale. So the net result of all of that is the fact that we develop for scale, means that when customers use these things, even at a small scale, they get the benefit of that tuning, that fact that they're more autonomic, or if not, then at least automated, that the security is baked in because that's the only way you can survive running at a large scale. And that embeds itself into product, but that philosophy of doing things and that advice that we encode in the security transformation workshops and the position papers and the blueprints, you know, all of that gets funneled by the GCAMP And one of the things we'll be doing even more of is looking across all the rest of Google and saying, like, is there more capabilities and advice we can bring that will be of use to customers of all sizes, in all industries, in all sectors that can really learn from that? And I think that's where you want Google innovating for this at scale, because that benefits you at a smaller scale.

One key idea I want to kind of like extract out of your answer is that some of the organizations are sort of moving in the same direction we were moving, even though they're not Google. Like, for example, the automation point, like we cannot scale manually, but some companies perhaps can scale manually, but should they? Why can't they learn some of our lessons? Funny enough, I've been reading the SRE book as my bedtime reading. And I see a lot of parallels with that in security, where certain lessons we used and we had to apply, customers perhaps should apply today. Of course, we had to apply them in 2010. And customers should apply them in 2022. So there's a bit of a lag, but the idea is that the lessons are still relevant even though they're not Google.

Absolutely. And we're going to have to buy you some different bedtime reading, but the SRE books are fantastic. And so, you know, it's definitely not a bad read. You've got to look at, assume you're going to be larger scale, whether or not you're going to be larger scale, you're going to get the benefit of automation and the baked-in platform capabilities even at a small scale. And so there's just really no downsides to adopting those approaches.

At the risk of asking a question that I will again find difficult to summarize, how should companies engage with the GCAT? Is it like one of those, you sort of wave the fish in the air toys? How do you get the GCAT to help you out?

So most of it is going to come through the customer relationship channels. And so when somebody wants to work with us and to onboard to cloud, then, you know, that's a pretty straightforward kind of journey from the transformation through the engineering and beyond that. There's also the means of just kind of reaching out to me and a lot more other people on the team will become a lot more externally visible for when people want us to engage on topics in the industry. We're also getting more visible in various different trade associations and other external organizations where we're going to bring this more focused voice to different communities to make sure that we're bringing all of Google to, you know, all of Google security to the world through the GCAT and through other means that we already have. And so you kind of see us being more present. But it's through the customer or prospective customer relationship or by reaching out to various of us that lead this group that are visible.

Perfect. Thank you very much for this. And of course, I'm super excited to see it come to life finally, because frankly, too many of my hours were spent on this. But again, this is the day. This is being aired during Next. And at that point, Google Cybersecurity Action Team is already a reality.

Traditional closing questions for you, Phil. First, I assume laser pointers are actually the best way to engage with the GCAT. But second, Do you have recommended reading for listeners? We hate to leave people empty-handed, so something that they could go read up on, presumably better than Anton's bedtime reading.

Well, look, having said that, it's interesting. Now I've been mentally primed to be thinking of SRE, and one of the things increasingly, we spend a lot of time internally with our SRE colleagues on optimizing security operational capabilities, and there's a lot to be applied from SREs. That's definitely worth reading. I think the other thing as well is we're spending a lot of time, and you'll see more content from us on this, thinking about kind of risk governance and the integration between the technology teams, the business teams, the security teams, the risk teams, the compliance teams. And so we're putting out more content on that that I think people are going to find useful in addition to some of the existing content we've produced on that. And then we've got some work coming up as well on board engagement. especially how to engage your boards, both private and public company boards, on the digital transformation journey in the cloud. So, you know, we've got a number of people working on that. And so that'll be coming out soon as well.

Perfect. Thank you very much. And again, hope to see you on another episode soon.

Yeah, no, it's always good fun. I'll be back anytime.

And now we are at time. Thank you very much for listening. And of course, for subscribing. Please make sure to attend the rest of the Google Cloud Next conference at cloud.withgoogle.com/next. Watch the presentations, interact with other people, have fun. Of course, also go to the Google Cybersecurity Action Team website. You can find the link in the notes. You can also find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever you get your podcasts. We seem to be in more and more apps every day. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. Our normal cadence would come back next week after we are done with the conference. You can follow us on Twitter, twitter.com/cloudsecpodcast. And of course, your hosts are also on Twitter, Anton_Chuvakin and _TimPeacock. Tweet at us, email us, argue with us. And if you like or hate what we hear, we can invite you to the next episode. See you at the next conference. And of course, see you at the next Cloud Security Podcast episode.

Security. Security.