Preparing for Cloud Migrations from a CISO Perspective, Part 1

Security. Hi there, welcome to the Cloud Security Podcast. Thank you for joining us today. Your hosts here are myself, Tim Peacock, Product Manager for Threat Detection here at Google Cloud, and Anton Chuvakin, a tamed and reformed former Gartner analyst and member of the cloud security team here at Google. You can find this podcast wherever podcasts are distributed and at our website when we promise eventually launch it. Until then and after, you can follow us on Twitter, twitter.com/cloudsecpodcast. Our guests today, I couldn't be more excited about them. We've got Phil Venables, Vice President, Chief Information Security Officer, CISO, CISO, I don't know if we wanna hard or soft C here, at Google Cloud, and Nick Godfrey, Director of Financial Services Security and Compliance, both, and a member of the office of the CISO, here at Google Cloud.

Thank you, Tim. And I want to give a quick inspiration for this episode. So one of the challenges I've encountered is that many security leaders, CISOs, directors of security, are kind of still struggling with migration to the cloud. And sometimes what I've observed is they struggle specifically with the on-premise thinking that sort of pervades their migration to the cloud. So they kind of move to the cloud, but in their minds, they're still in the data center. So we wanted to chat with our CISO experts about how to solve those problems. It's probably going to be a 2-part episode. We want to chat with our CISOs here about cloud migration challenges and hopefully help our clients, prospects to migrate to the cloud with security in mind and using the Cloud Playbook. So our first question is, why do you think so many CISOs of traditional organizations fear cloud migrations?

Let's be honest, and I'm being perhaps slightly cynical here, but anyone that's been a CISO In any sizable organization like Nick and I have for a long time on the enterprise side, have learned through kind of lots of experience that new is rarely something great from a security perspective. And so I can empathize with a lot of the careful reaction of CISOs when faced with kind of anything new, in particular cloud. And I think in that same vein, a lot of CISOs have had experience of migrations and large-scale change that have historically also not been pleasant experiences. And I would say up until the past few years, cloud migrations were often especially difficult migrations. Again, up until recently, there's also been quite a significant absence of tools and services to help not just IT teams, but specifically security teams in that whole migration. So I can definitely understand the fear, and in my prior roles, I've certainly had quite a high degree of trepidation about doing some of these migrations. The one thing I would say, though, over the past at least 2 years, I would say all of the cloud providers, but of course, especially Google Cloud, we've done a lot more in terms of helping CISOs think through that whole security transformation journey and then to help people realize the security opportunities that do actually come with a cloud migration, given the capabilities and tooling. And I think also we've made a lot more advances in making available more secure defaults, more layered defense in depth, and also broader tools and services for their IT colleagues and business colleagues to help with the whole migration. So I actually think there's, like with any change, there's reason to be cautious and plan appropriately. But I think ultimately now the balance has tipped and we see this in a lot of major customers that are starting to realize the significant opportunities that they get in terms of improving security by cloud migration. And I think we're starting to see many CISOs now realizing that they should get behind this and push as fast as they can because that's their path to improving security.

But does it mean that they've kind of become more aware of the cloud playbook rather than an on-prem playbook for moving to the cloud?

I think, again, as part of the security transformation, I think many people are realizing that there's a different and often improved way of doing security in the cloud. And in many respects, they're starting to try and bring that back into the on-premise environment for environments that may not be transitioning soon or that are staying where they are but are connected to the cloud environment. So I think the cloud playbook is making its way inside the enterprise.

So Nick, got anything to add?

Phil's hit it spot on. I think one thing I'd add is the period of transition for the CISO is pretty daunting as well as even if you can understand and accept that the end state of being cloud native is better, as Phil said, you know, there's no CISOs I've ever met that feel that their work here is done as regards managing their current environments and the current complexities and the technical debt and the threats and everything. And so they're already very, very busy. And what transitioning to the cloud means in some respects is instead of having that mess to manage, that complexity to manage, you've also now got a new control paradigm, a new control plane to oversee as well, the cloud and on-premise concurrently. And you may have that for some period of time before you get to a majority cloud-based environment. So that's quite a daunting thing for a CISO to work through, I think.

That makes a ton of sense. And Nick, the next question's for you. Aside from perhaps some therapy for the years of accumulated cloud trauma, what's your advice for a CISO who wants to migrate to the cloud using a more traditional approach? Like, what would you say to somebody who's trying to do a lift and shift?

Irrespective of what you think your approach is, I think the first thing that the CISO's gotta do is kind of look up and out at what's actually gonna be going on within their wider company, right? So what's driving the cloud migrations is often a kind of a digital transformation of some shape and form. and all the benefits you get from a digital transformation in terms of the changes to the way business products and services are delivered and the speed and iteration around that. And as part of all of that, the IT organization is trying to move to a more agile way of delivering IT and higher release frequencies and cycles. And so you start thinking about what's going to happen there with those parts of the businesses and those IT functions. And when the infrastructure in my environment is now just code that's declared into cloud rather than physical stuff that's managed. As a security leader, you think you need to be thinking, what are the consequences of those changes on the security organization and security operating model? And if you try and apply existing, you know, sometimes highly centralized security operating models and security techniques and approaches to that, you'll get potentially one of two bad outcomes. The first being the organization becomes overly constrained in its use of cloud, and we don't realize the benefits of cloud in terms of speed and agility and responsiveness to the customers and the markets. And the other is you get circumvented and the organization starts doing cloud in a kind of less safe way. So you've got to take a step back and understand what's going to be going on around you and how that's going to have a bearing on you. Once you understand that, then you can start thinking about, you know, your org model and your operating model. And, you know, to give you one example of the types of things that you need to think about, in many CISO functions, there'll be a team that does pen tests and they do a pen test of an application before it's deployed. It's a good independent check and balance. And in traditional IT delivery approaches, that kind of handoff process doesn't really matter because the whole lifecycle of delivering IT is longer and slower. Arguably, in a cloud-enabled IT team and an app dev team, they'll be wanting to release that application much more frequently. And so having a kind of centralized pen test team with a handshake is not necessarily going to get them where they want to. So you might need to be thinking about how do you move the pen testing function, people, tooling, and everything else back into the app dev team so that it's done right at the point at which it needs to be done. That's kind of your org and your operating model. And then once you've figured out that at a high level, you can get into the tools and the techniques and the skills you need, and you can focus more on designing the right control environments to enable that federated approach to security. And you can focus on building higher quality assurance approaches so that you can validate that what's in the cloud has been through those security and control gates and that the configurations are the configurations you expected to see. So at the end of the day, your team structure, shape, and operating model is going to evolve because of the nature of what's going on with the business and IT functions. And you need to double down on making sure that the design of the controls is such that you can operate them in that more federated fashion and that you've got a very, very solid approach to the assurance of the security in the cloud driven through the data that you can discover about that cloud environment compared to what you would have expected to see.

Let me ask you for a quick clarification on this. So, your tools would change, your practices would change, your people's skills may change, but you mentioned the word operating model. Could you connect the operating model to this stuff that I mentioned? So, operating model kind of implies all of this, correct?

Yeah, operating model implies all of it. I mean, what I was talking about in terms of operating model is there are 2 ways of describing how the CISO executes, if you like, discharges his or her responsibility. One is it owns an organization that's called the CISO organization and has skill sets and teams and remits and responsibilities. The other is kind of the broader kind of security operating model for the organization where the CISO still has that overarching remit to make sure that the operating model is fit for purpose and getting you where you need to be. But that does not necessarily mean the CISO owns all of the staff, the people, the tooling, everything else that goes into making that operating model work.

Perfect. Thank you for that. Phil, got anything to add to this one?

Often more and more it's about taking advantage of new solutions, whether it's high-performance data analytics, more business-focused solutions, different ways of digitizing businesses and supporting customers. So there's a whole array of things that is a compelling reason to move to the cloud. And one of the things that many security organizations for many years have always been looking for is that means of enabling business through security, that means of enabling agility in the organization. And the cloud migrations from what we're seeing for many, many organizations is exactly that. It's delivering a whole range of new means of supporting customers and encouraging business agility. And this is just a tremendous opportunity for CISOs and the security teams in general to be a visible part of enabling that in a secure, resilient, and risk-managed way to deliver on their business promises. And it's almost like, you know, everything what Nick was saying about the frameworks of how to do this, it's almost too good an opportunity for the CISOs to not get behind 'cause it checks all the boxes about what leading-edge CISOs are and want to be around business, using security to enable business. It's exactly what a cloud migration is.

This is a case for CISOs of never waste a crisis where they can really grab this thing by the horns and become a business enabler. How does their team structure have to change when they do that? Do we see CISO teams changing with the cloud migration?

You know, I'll let Nick comment as well, but I mean, I think many large enterprises are quite well positioned in how they've started embedding security roles in business lines, how they've shifted left in the software development process to get security embedded more in the design lifecycle. I think though, what they are finding to many security teams is they're learning how to integrate with a cloud infrastructure engineering team that manages the orchestration layer from the enterprise to one or more clouds. I think as well, and again, Nick touched on this, is one of the big challenges we see in many organizations is not so much on the business enablement and the developer engineer enablement in the use of the cloud. It's how they factor in that kind of hybrid security operations model from on-premise to cloud or even across multiple clouds. And that's something where again, many of the products that we're pushing out and many of the advice we're pushing out is not so much only on the migration, but also on the post-migration security operations advice. And I think everybody will see more content from us coming out on that in the future.

The point you made at the top of that was the teams needing to work with the cloud-focused, cloud-skilled infrastructure engineering teams. The phrase that we use, your policy is embedded in code that is used to manage your infrastructure, is a nice phrase to use, but actually the mechanics of translating policies and standards that are oriented towards human beings into code that's managed as part of your infrastructure, I think, is quite a sizable thing for teams to get their head around. It's kind of the new bit that's cloud that's different to doing other forms of more agile IT, I guess, isn't it?

That makes sense to me. And I see why this is challenging for enough organizations to kind of shift into that. So if people still cling to the old mindset, there are trade-offs, presumably. So for example, I may be a leader and I have some familiar tools. So I want to go to the cloud with those tools in my hands. So what are the real trade-offs in this decision, such as using familiar tools, using maybe familiar practices versus achieving full cloud benefits? How do you do this kind of scaling weighing exercise where you think, yeah, but I have people now who are skilled in this. Yeah, I know I need to have that, but I don't have that. How do I do this balancing act?

One of the interesting challenges, this whole concept of revalidating your mental model for how a security design pattern works on-premise versus in the cloud. And the classic example is a DMZ. DMZ. So many large enterprises on-premise have multi-tier DMZs in which there's basically perimeter firewall and other infrastructure, then the web server, then another layer, then the app server, and then another layer, then the internal network and data servers. And I think the interesting thing about that is occasionally you see customers try to replicate that physical infrastructure logically in the cloud. And that doesn't necessarily mean they end up with bad security, but it's actually more importantly, is missing the opportunity to take advantages of much deeper levels of finer-grained control that you can construct the same security objective in the cloud. And you see similar things with the cloud and more particular, many of the application-level technologies that you would get from a cloud-based service give you a lot of opportunities to do more finer-grained segmentation, integrating more security into your software lifecycle, doing things like binary authorization to make sure that the software you produced is exactly the software that ends up in production, a whole different level of monitoring and consumption of logging and other stream data from your environment to let you do anomaly detection. So there's a whole host of opportunities, and I think it requires organizations to shift their mental models, just like when you think about zero trust architectures that were codified at Google under the Beyond Core and the Beyond Prod banners. They similarly have a whole capability that you can deliver that you probably can't always do on-premise. And so I think a big part of that environment is for CISOs to really think about what does it take and what models can they use in the cloud. And in fact, in many cases, in my former role as a CISO on the enterprise side, some of the capabilities that we can offer now in cloud services, and again, particularly Google Cloud, because we're talking about Google, is I would love to have been able to deploy those at scale across all of the on-premise environment. but I can only get to take advantage of them during and after a cloud deployment. But one of the nice things you see in the cloud space now is a lot of these cloud technologies being made available on-premise and across hybrid clouds. So you don't have to choose that cloud versus on-premise anymore. And so I think looking at all of the new technologies that are available to implement security objectives gives you a lot richer set of tooling, a lot more flexibility than I think has been available in the past. And it's almost like it's too good an opportunity to waste not to go back to first principles and say, can we do this even better in the cloud? Because you've got a richer set of tooling.

Nick, do you have anything to add on the trade-offs?

No, I think Phil's covered it well. There are so many things you can do with cloud that you just can't really economically or commercially or technically do on-prem. I think it's just a case of how do we, with our peers in the industry, sort of really figure out the paradigm shifts and get ourselves comfortable with the wider organization around us, you know, the risk functions, the compliance functions, the audit functions. regulators and so on and so forth to be as comfortable with those new paradigms as they are with kind of the old ones that we sort of built our stories around, like perimeter-based security and the patch strike. I think there's a lot of work to do there.

The conversation for a CISO around a cloud migration doesn't end at the end of our podcast. What would you recommend as reading material or an advice column for a CISO who's about to do this for the first time, this being a cloud migration?

I think a couple of things, and I'll be selfish and talk about Google Cloud and Google, but Phil and I recognize that the security and risk transformational aspects of a successful cloud migration are very important, almost as important as the broader digital transformation that gets a lot of airtime, a lot of press. And so we've published a paper and we're going to publish other papers on the same sort of topics around how do you think about effecting a security transformation. So there's a CISO's Guide to Security Transformation whitepaper. And then to learn a little bit more about how generally Google Cloud inclusive operates and thinks about security, there is a very good book called Secure and Reliable Systems, which our Google security teams published, I think last year. That's a very long read with a lot more detail about some of the things that we've talked about today and lots of case studies and examples of how we've tackled some of these challenges within Google.

You know, in the same kind of SRE-type series, there was another book our Google SRE team just put out recently, Practical Cloud Migration, which we should obviously kind of make sure goes in the show notes, which is actually a really good book. I mean, it's obviously more broadly about how to organize an overall migration, but all the way through it are various kinds of tips and practical guidance on not just security steps to take, but broader risk mitigation and control practices that can manage all of the risks of the migration. Because I think we all recognize that CISOs in most organizations these days are not just on the hook for security, they probably also have other broader technology risk responsibilities, usually resilience responsibilities, and perhaps even some compliance responsibilities. And so, thinking about all of those things and a lot of the material Nick referenced as well as this practical cloud migration guide really go through a lot of that information. And I think it's definitely worth a read. And they're usually written by people, not only Google engineers that have been at Google a long time, but a lot of people like us that have spent most of our careers on the other side of the fence consuming these services. And so they're written from a perspective of how to do this from experience as well as being informed by the services that we have at Google.

Thank you very much for this. I think that the second book is a great reminder. I completely forgot about it, but it's a great resource. I've downloaded it. I'm going to be reading it because the risks and mistakes covered there kind of go beyond the domain of cyber, right? There are other things that can go very wrong in cloud migration. So to me, this is a very useful resource indeed. So one thing I wanted to say that we're going to do a second part to this podcast, likely focusing on how to actually teach the quote unquote on-premise CISOs to speak cloud. How do you teach those mental models? How do you learn to do what Phil just did with, say, DMZ, or with a SOC, or with other pre-cloud constructs? How do you translate them to the cloud language? How do you make people more cloud-native or cloud-focused? So, to me, this is a useful second part we're going to record later. So, thank you very much for being here, to both of our guests. We will post links to all the materials we discussed at the podcast site and in the show notes. As we said before, you can find this podcast at Google Podcasts, Apple Podcasts, or wherever else you get your podcasts.

Thank you.

You can follow us on Twitter, twitter.com/cloudsecpodcast. You can also find our individual handles at Anton_Chuvakin and _TimPeacock. Tweet at us, email us, argue with us, and if you like what you hear, we will— might just invite you to a new episode here at Cloud Security Podcast. See you at the next Cloud Security Podcast episode. Thank you very much for listening.

Thank you.

Security.

Security.