Last week, the European Commission and U.S. Government agreed on a new E.U.-U.S. data transfer framework. Earlier today, Google shared that it welcomes these efforts by the U.S. government to enhance privacy protections for E.U. data and facilitate trusted transatlantic data flows. For our Google Cloud customers, we intend to make the protections offered by this new framework available once it is implemented.

Last year, we reaffirmed our commitment to E.U. businesses after the European Data Protection Board (EDPB) issued its Recommendations on Supplementary Measures, following Europe’s top court ruling invalidating the E.U.-U.S. Privacy Shield Framework and upholding the E.U. Standard Contractual Clauses (SCCs).

Since then, we’ve continued to help our customers meet stringent data protection requirements by offering industry-leading technical controls, contractual commitments, and risk assessment resources. We’ve also continued our advocacy to create more legal certainty around transatlantic data flows.

Today, we would like to provide an update to our customers on this work.

A customer-controlled cloud

Google Cloud1 continues to be a leading provider of technical and security controls to help meet customers’ data protection requirements, as well as their increasing data sovereignty expectations.

We are committed to building our Cloud on Europe’s terms, including by offering customer-managed encryption and data localization for a growing list of key products and collaborating with local partners to provide the highest levels of sovereignty, all while enabling the next wave of growth and transformation for Europe’s businesses and organizations.

Google Cloud Platform

We recently announced the general availability of Assured Workloads for the E.U. This product helps Google Cloud Platform (GCP) customers protect their data by allowing them to:

• Store their data in their choice of E.U. Google Cloud region(s)
• Ensure that only E.U. persons – located in the E.U. – have access to the data and provide customer support
• Deploy cryptographic control for data access, including customer-managed encryption keys

Cloud External Key Manager (EKM) enables customers to encrypt data in a variety of services with keys that are stored and managed in a third-party key management system deployed outside of Google’s infrastructure. Google Cloud continues to be the only cloud provider to enable customers to store and manage encryption keys for cloud-resident data outside the provider’s infrastructure with customer’s control over decryption based on specific justifications, including government access requests.

Key Access Justifications greatly advances the control that GCP customers have over their data by giving customers a justification every time their externally hosted keys have to be used to decrypt data. Signed Access Approval (SAA) adds a layer of extra assurance that requires explicit customer consent for any administrative access to customer data or configurations.

Google Cloud’s Confidential Computing portfolio is a breakthrough technology that allows customers to encrypt their most sensitive data in the cloud while in-use. Ubiquitous Data Encryption further extends data protection by providing cryptographic protection for this data at-rest, in-transit, and in-use. The keys used to encrypt customer data outside of GCP using Cloud EKM are securely shared with applications operating within Confidential environments.

Google Workspace

Our Google Workspace (including Workspace for Education) customers can choose to store their covered data in Europe. Additionally, with Client-Side Encryption, we offer customers direct control of encryption keys and the identity service they choose to access those keys. With Client-Side Encryption, customer data is indecipherable to Google, while users can continue to take advantage of Google’s native web-based collaboration, access content on mobile devices, and share encrypted files externally. Client-Side Encryption is currently available in Public Beta for Google Drive, Docs, Sheets, and Slides, and we plan to extend it to Gmail, Calendar and Meet. Additionally, customers can also benefit by choosing third party solutions that offer similar encryption capabilities with select Google Workspace services.

Legal Basis for International Data Transfers

We updated our data processing terms for GCP and Google Workspace and Cloud Identity to reflect various modules of the new E.U. Standard Contractual Clauses (SCCs) approved by the European Commission on June 4, 2021, as well as separate U.K. SCCs.

Google Cloud plans to adopt the new E.U.-U.S. data transfer framework and offer it as a transfer solution to our cloud customers, as further detailed in our data processing terms.

Advocacy and Additional Helpful Resources

We have adopted the Trusted Cloud Principles with industry peers to demonstrate our commitments to protect the rights of our Google Cloud customers. We will continue to support the ongoing work of the Organisation for Economic Co-operation and Development on government access to data and the negotiation of CLOUD Act Agreements — including between the U.S. and E.U. — as vehicles for surveillance reform.

We will continue to publish additional materials on our Cloud Privacy Resource Center, such as our whitepaper on safeguards for international data transfers with Google Cloud.

Millions of organizations with users in Europe rely on our cloud services to run their businesses every day, and we remain steadfastly committed to helping them meet their regulatory requirements by maintaining a diverse set of compliance tools.

Together we can solve for the future of cloud security. Join us to learn how you can stay ahead of the next generation of threats with Google Cloud – whether you need to keep your organization secure in the cloud, on-premises, or in a hybrid environment. Get fresh insights from industry leaders and engage in interactive sessions that can help you solve your most critical security challenges. 

Our digital event has ended, but you can still explore our sessions on demand.
The Security Summit is part of our digital Google Cloud Summit series. Check out the other events in the series to explore Google Cloud technology applications in various industries and dive into our latest digital innovations.Original air date:20 July 2021 21:30 Register to watch on demand.

Yesterday we held our final Google Cloud Security Talks event of 2021. Our event focused on zero trust and covered everything from Google’s history with BeyondCorp to our strategic thinking when it comes to applying zero trust principles to production environments. We shared product updates across the portfolio and talked about how zero trust fits into our invisible security vision.

In case you missed the event, we’ve put together a brief recap below. Of course, we’d also encourage you to check out the sessions on-demand for all the details!

Our opening keynote highlighted many recent security launches, including:

• the general availability of Cloud IDS, which helps detect network-based threats, including attempts to exploit the Apache Log4j vulnerability; 
• the new Mute Findings feature for Security Command Center which helps organizations more effectively manage their security posture on GCP based on their policies and requirements;
• and the Threat Horizons report, a new report by the Google Cybersecurity Action Team (GCAT) describing recent threat intelligence observations from teams across Google.

We then brought together security leaders across Google for a panel discussion of our zero trust vision. Our panelists emphasized the need to embrace the fact that security is not static which makes adoption of a zero trust mindset where trust is established via multiple mechanisms and verified continuously an imperative. The session also highlighted how even taking small steps – such as prioritizing specific applications as you begin your zero trust journey – can still have a large impact on improving your security posture.

Next, we covered some recent product announcements from the BeyondCorp Enterprise team, including the new Policy Troubleshooter feature. This session gave users a closer look at new product features across access, signal integrations, and threat and data protection capabilities leveraging machine-learning in real-time.

We then pivoted the conversation and two of our speakers shed more light on Google’s BeyondProd approach. First, we shared our learnings from building a cloud-native security model, which provides significant benefits to both application development and security teams. We outlined different principles you can apply to your infrastructure design and operations in order to strengthen the deployment of your workloads, better secure their communications, and limit their exposure to other workloads, in ways that can ultimately reduce the burden on individual developers.

We discussed how customers can bring BeyondProd to life in their own environments and offer zero trust protection for workloads with Google Cloud capabilities. These sessions featured customers who shared their experiences with VPC-Service Controls and Certificate Authority (CA) Service. We also announced some exciting news: CA Service now supports third-party identity federation and can issue certificates to attest to on-premises third-party identities using Google Cloud workload identity federation. Certificates can be issued for both users and workloads. 

Next, in light of the White House effort to deploy a zero trust model across the US federal government, we spent some time sharing how Google Cloud can support government guidance. Google recently announced a $10 billion investment to strengthen cybersecurity, including expanding zero-trust programs, helping secure the software supply chain, and enhancing open-source security. This session gave an overview of how different Google Cloud services align to federal cybersecurity priorities.

Our last session provided an overview of how we are strengthening security and privacy across the Google Workspace platform applying zero trust principles to the applications that allow customers to collaborate effectively with features such as Trust Rules for Drive.

These sessions will be available on-demand on our Google Cloud Security Talks page for you to reference. If you’d like to speak with a representative about Google Cloud’s zero trust access solutions, please fill out this form. Lastly, if you are planning to attend the 2022 RSA Conference in San Francisco (February 7-10, 2022), check out goo.gle/rsa-2022 to arrange a meeting with our team at the event.