B2B marketplace IndiaMART aims to help businesses escape the restrictions of traditional supply chains. By providing access to a digital platform optimized for access from desktops and mobile devices, businesses can improve their operations and generate more revenue. IndiaMART’s suite of services includes web storefront, enquiry support, priority listings, premium number services, a lead management system, and payment facilitation.

IndiaMART also provides “behavior-based matchmaking” that identifies the supplier best equipped to meet buyer needs by product or service, category and location. IndiaMART then matches the designated suppliers with the buyers. Finally, IndiaMART operates as a “horizontal marketplace”—enabling suppliers to market to a large number of potential buyers—presenting a compelling offering for both groups.

Amarinder S. Dhaliwal, Chief Product Officer of IndiaMART, says once IndiaMART grew to a certain size, it benefited from a network effect—as more buyers used the marketplace, more suppliers came on board, prompting yet more buyers to access the service and so on. Suppliers becoming buyers and using IndiaMART to purchase products is another growth driver. “There is not just a network effect, but a community effect as well, as a supplier becomes a buyer,” says Dhaliwal. “This increases affinity, and supplier and buyer ‘lock-in’ to the marketplace increases multifold.”

Positioned to address challenges

IndiaMART’s proactive approach positioned the business well to address the challenges presented by new trends and market conditions. Traffic from mobile devices to its business-to-business marketplace has grown from about 30% to 75% over the last four years.

“Mobile traffic has grown at a compound annual growth rate of almost 100% over the same period,” says Dhaliwal. “The proliferation of smartphones and other mobile devices has brought a considerable number of new users onto the internet and these users look for value—the right price from the right supplier,” he adds. “Furthermore, they can connect at any time and from any location they can access a network.”

The mobility revolution also challenged IndiaMART to provide a user interface and experience optimized for devices of various types and sizes—and that incorporated screens much smaller than the screens incorporated in desktops. The organization also had to help users overcome issues such as inconsistent network coverage and quality—particularly in remote areas.

Becoming a mobile-first organization

IndiaMART is responding by becoming, for buyers, a “mobile-first” organization that meets the group’s technical and user experience requirements.

IndiaMART is also adapting its marketplace to support two key trends:
• Buyers using long, conversational sentences to conduct online searches rather than simply typing in keywords
• Non English-users—the vast majority of people in India—stepping up their use of the marketplace

“We expect that, within a few years, we will have more non-English users than English users on IndiaMART,” says Dhaliwal.

IndiaMART is also benefiting from Indian government measures to reform taxation and stimulate the digital economy. “There has been a huge focus on areas such as digital payments and the digitization of identity,” says Dhaliwal. “We have embraced elements of this agenda by implementing a digital payment platform and are continuing to look at ways of providing new digital services to suppliers.

“Meanwhile, the Indian government’s recent implementation of GST allows us to validate suppliers’ businesses and bring more qualified, more verified suppliers on our platform—improving the experience for buyers and suppliers.”

Speed and reliability an issue

IndiaMART had started operations with servers, storage, networking, and associated systems co-located in a data center in the United States. However, as buyers and suppliers increasingly used mobile devices—over occasionally unreliable networks—to access the marketplace, access speeds and reliability became an issue. With most requests traveling between India and the United States, network latency was unacceptably high. Furthermore, business growth meant IndiaMART needed an environment that could scale to meet demand for the next five to 10 years.

IndiaMART opted for a multi-cloud architecture and established criteria for cloud providers to win its business. “We required an infrastructure that could scale and meet our demand for fast response time without putting our business at risk,” says Dhaliwal. “This meant taking a phased rather than one-shot approach to the migration. We also needed to minimize any wasteful duplication of infrastructure and reduce latency. In addition, as we scaled, we needed to protect our systems, transactions and information, including the details of buyers and suppliers.”

Google Cloud team’s high-quality support

The organization performed proof of concept with the three largest multinational cloud services providers and found Google Cloud was best positioned to act as the cornerstone of its multi-cloud architecture. “The Google Cloud team gave us considerable support in helping us run a proof of concept of its services,” says Dhaliwal.

“The proof of concept also illustrated that Google Cloud was superior to the other cloud services we looked at.

“We could run our marketplace across multiple geo-locations under a single IP address, avoiding duplication, and users in India could connect to Google Cloud via the closest access point, with their traffic passing quickly across the Google network.

“In addition, Google Cloud’s load balancing service would enable encryption between load balancing layers and back ends to ensure security, while all communication would move across Google’s own protected network.”

Being one of India’s early users of G Suite, the organization was also familiar with Google Cloud applications and services.

IndiaMART then opted to work with the Google Cloud team and a certified partner on a step-by-step implementation that minimized any risk of disruption.

Deep engagement from Google

“We engaged very deeply with both Google and the partner to complete this migration,” says Dhaliwal. “The Google team worked very hard to understand our requirements and provide a solution that catered to our needs and could be deployed in a phased manner.” The team ran workshops and technical sessions with IndiaMART and, at a Google Summit, connected the marketplace provider to Google experts in databases and infrastructure.

“These discussions really helped us formulate a strategy moving forward,” says Dhaliwal.

Based on input from Google and its own evaluation, IndiaMART developed an architecture comprising virtual machine instances delivered through Compute Engine, Google Cloud’s infrastructure-as-a-service offering; Cloud Load Balancing to support cloud resources distributed across multiple locations; Cloud Pub/Sub to provide enterprise messaging; and Cloud Dataflow to transform and enrich data.

Cloud Armor works with Cloud Load Balancing to defend against distributed denial of service (DDoS) attacks; and Geocoding API helps the organization convert geographic coordinates into readable addresses and vice versa. Cloud AutoML allows IndiaMART to train machine learning models to meet its requirements. With Geocoding API, IndiaMART can matchmake buyers and suppliers based on location—providing a high quality experience for both parties. Finally, AutoML Translation allows the organization to create a custom machine learning model that converts product names from English into Hindi and other languages, effectively opening up new markets for buyers and suppliers.

Phase one complete

IndiaMART has completed phase one of the migration that involved moving its web properties across to Google Cloud. The organization is now experimenting with moving its APIs and databases to the service and anticipates completing the exercise over the coming year.

Average page load time down

The initial phase of the project has already delivered considerable benefits to IndiaMART. The organization has cut average page loading time from five seconds to three seconds, and Dhaliwal attributes close to one second of that reduction to the move to Google Cloud. “With Google Cloud, buyers and suppliers can access our marketplace much faster than previously,” says Dhaliwal. “This impacts positively on engagement, time spent on our marketplace, and the user’s entire journey with us.”

DDoS attack repelled

Google Cloud’s security features have already passed their first test. As IndiaMART undertook stage one of the migration, the business experienced a DDoS attack that generated request loads more than 400 times greater than normal. “Because we were on Google Cloud infrastructure, we could develop a solution to combat this severe DDoS attack,” says Sunil Parolia, Sr. VP at IndiaMART. “From a security perspective, this really justified our decision to go with Google Cloud.”

Google Cloud is also helping deliver the availability required by IndiaMART and the scalability to support growing demand. “As the number of people in India who access the internet grows from about 500 million to 700-800 million over the next couple of years, we will continue to build our traffic and be the dominant business-to-business platform,” says Dhaliwal. “On the supplier side, we expect to see more and more businesses come onto our marketplace—ranging from small-to-medium businesses up to larger brands. Google Cloud will enable us to accommodate this traffic without compromising the experience we provide.”

This past year brought both new challenges and successes for our customers around the world. We thought life was going to return to normal… and then it didn’t. Despite the uncertainty, it was exciting to see customers make huge transformations in when, where, and how they run their businesses, with cloud infrastructure as a major enabler. 

According to IDC, “by 2024, 50% of organizations will use applications built on abstraction provided by managed services including cloud-native technologies to enable consistency in running in any and many locations.”¹ Over the past year we were honored to work with so many of you to start to make this prediction a reality.

Let’s take a deeper look at where our infrastructure progressed in 2021, and where we’re headed in the new year.

Google Cloud is recognized by independent experts for its leadership

For the fourth consecutive year, Google Cloud was named a Leader in the Gartner Magic Quadrant for Cloud Infrastructure and Platform Services.

The Forrester Wave for AI infrastructure placed Google at the topmost position, a testament to Google’s investments in tomorrow’s AI-first world. 

Google Cloud also won the HPC Wire Editor’s Choice award for the best use of HPC in the cloud.    

We made it easier to migrate enterprise applications

To support enterprises in their transformation journeys we focused on expanding our support for enterprise applications in our cloud. The Home Depot just wrote about its successful migration of SAP to Google Cloud, highlighting how crucial it is to have good processes and strong partnerships. For other companies using SAP applications we also launched Filestore Enterprise, which delivers 99.99% regional availability ​​backed by an SLA. 

Our partner NetApp deepened its integration with Google Cloud to enable easier and faster Windows-based application migration, and provided flexible deployment options to modernize workloads. We also added new Network Connectivity Center partners to include companies like Cisco, Palo Alto Networks, and VMware, so as you migrate over time you can easily connect all your networking resources together in one place. 

For those of you considering migration to cloud, Forrester dove deeper into the economics of migrating enterprise applications to cloud. (Spoiler alert: companies are finding major cost savings and performance benefits!) It’s so important to us that companies trust that their biggest, most complex applications will run smoothly and securely with us, and we’re pleased at the progress we’ve made toward supporting more enterprise applications this year.

We also made it easier for you to migrate VMware workloads to the cloud by expanding Google Cloud VMware Engine to 12 regions worldwide and enabling several new capabilities across networking, compliance, and scale. Customers such as Mitel and Carrefour migrated their VMware estates to Google Cloud to transform their applications with Google services to increase agility, save money (up to 45%) and reduce energy costs (about 35%) compared to running on-premises. 

For High Performance Computing (HPC), we continued to add capabilities such as optimized VM images for HPC, enhanced integration with schedulers such as SchedMD, Slurm, and Altair PBSPro.    

New cost and performance options

To further support customers doing high performance computing for things like real-time advertising, dynamic e-commerce, and gaming, we launched a new VM family: Tau VMs. Tau VMs offer 56% higher absolute performance and 42% higher price-performance compared to general-purpose VMs from any of the leading public cloud vendors.  We are seeing companies such as Nylas switching from other cloud platforms to Google Cloud to make the most of Tau VMs.

That isn’t the only VM advancement we made. For customers with higher levels of fault tolerance and looking for greater cost efficiencies, we launched Spot VMs, which open up access to Google Cloud’s idle capacity so you can run your application at the lowest price possible. With Spot VMs, you save anywhere from 60-91% off the price of on-demand VMs. 

We also launched more options for the highest performance ephemeral block storage — 6TB and 9TB Local SSDs, which offer greater IOPS per dollar when attached to general purpose N2 Compute Engine VMs. 

Distributed cloud brings us closer to you

For years, the industry has been telling companies, “move to cloud!” but not all workloads can move to the public cloud immediately or entirely. Factors include industry- or region-specific compliance and data sovereignty needs, low latency or local data-processing requirements, or the need to run applications close to other services. 

In October, we expanded our distributed cloud strategy and announced Google Distributed Cloud, a portfolio of fully managed hardware and software solutions that extend Google Cloud’s infrastructure and services to data centers and the edge. This is a major step forward in our ability to meet you where you are, in private data centers and at the edge, and we’re excited to see how this helps you as we move into 2022.

Data protection and security that never sleeps

This year we worked hard to help improve your data protection capabilities. We doubled down on our Actifio acquisition by launching several releases that deepened its integration with Google Cloud. For customers with containerized applications, we took a big step forward with the launch of Backup for GKE. We’re particularly excited about how this new option for GKE users allows you to more easily meet your service-level objectives, automate common backup and recovery tasks, and show reporting for compliance and audit purposes. 

We also enhanced Cloud Storage with data protection features like custom region selection for dual-region buckets. Previously, Google Cloud assigned dual-region pairs for you to choose from. With this release, you can  select your own region pairs that meet your regulatory or compliance requirements, or optimize your app performance. We also launched Turbo Replication for dual-region buckets, which replicates 100% of your data between regions in 15 minutes or less, backed by a Service Level Agreement, a first from a leading cloud provider. 

Security is a key area of focus for us and we partnered with Palo Alto Networks to deliver their industry-leading Intrusion Detection System (IDS) solution natively on Google Cloud. With the recent Apache Log4j vulnerability, we automatically updated Cloud IDS to help detect exploit attempts and protect our customers’ environments quickly. We also integrated Cloud Armor with reCAPTCHA Enterprise to deliver a best-in-class bot and fraud management solution to prevent volumetric attacks. Cloud Armor is deployed with our Cloud Load Balancer and Cloud CDN, extending its security benefits at the network edge for traffic coming into Google Cloud. 

We made it easier to build and manage applications

Developers want to focus on code, not configuring, managing or scaling infrastructure. To help, we worked on simplifying networking with new services such as Private Service Connect, which allows you to connect VPCs to applications and services securely without configuring all the network underlay. To make it easier to run workloads in hybrid environments, we introduced BYOIP so you don’t need to change your IP address, and we enhanced Cloud Load Balancer with advanced traffic management, regional and hybrid app delivery to load balance traffic between on-prem and cloud workloads. We also introduced IPv6, DNS policy manager, Cloud Domains, GKE Gateway Controller, eBPF data plane, and Service Directory, all with the goal of making networking easier for developers.

We continue to invest in visibility and observability for efficient day 2 operations. Network Intelligence Center now has dynamic reachability within the Connectivity Tests module, interconnect and VPN visualization in Network Topology, and the Firewall Insights module, which provides visibility into firewall rules to ensure they are being used appropriately and as intended. 

And while not new this year, developers continue to tell us how much they love the ease of architecting storage using Cloud Storage. See how easy it is to configure a dual-region bucket. As a result, developers can treat a continent like a single bucket, dramatically simplifying the application programming model. Google Cloud is unique in offering this capability among major public cloud vendors.

We continue to be the most sustainable cloud for you

Another area Google has invested in deeply and that is becoming increasingly important to more organizations is sustainability. Many cloud providers have a vision for a sustainable future, and many aim to match their electricity consumption with 100% renewable energy by 2025 or 2030. We accomplished 100% renewable energy in 2017, which means we’re the only hyperscale cloud to do this today and on data centers that are twice as energy efficient as the average data center.

We also announced a number of new features like our new Carbon Footprint tool. Every Google Cloud user — that means you! — can see the gross carbon emissions associated with the services you use in Google Cloud. This means picking the data center that meets your sustainability goals, and reducing the overall emissions tied to your infrastructure and applications. And we have some pretty big goals for the future. For more, don’t miss our full sustainability recap.

A big thank you to our customers

While we were busy building out our infrastructure in 2021, we’d be nowhere without the partnership of our amazing customers. It’s hard to pick from all the exciting stories we heard this year, but here are just a few: Pega migrated its SAP applications to Google Cloud with zero downtime. Paypal exited its non-strategic data centers and achieved major cost savings. And Wix used our network to serve tens of millions of requests per day. 

I’m proud to look back at how our cloud infrastructure has evolved this year to support each of our customers on their transformation journey. As we head into 2022 I’m excited to continue to partner with you to solve your most difficult challenges together. 

Interested in hearing more about Google’s vision for the future? Listen to Thomas Kurian’s thoughts from Google Cloud Next ‘21.

^{1. IDC FutureScape: Worldwide Cloud 2022 Predictions}

Many people are visual learners; I am definitely one of them, and judging by the tremendous response you all showed to Google Cloud Sketchnotes on LinkedIn and Twitter, you are too.

-Priyanka Vergadia, Lead Developer Advocate, Google

“A picture is worth a thousand words”

Shortly after I started creating and sharing visual explanations of Google Cloud concepts in late 2020, I began receiving overwhelmingly positive feedback from fellow cloud architects and enthusiasts. That feedback led me to think about pulling these sketches together into a reference guide — a one-stop shop for cloud learning fun. So here it is!

🥁 Introducing “Visualizing Google Cloud: 101 Illustrated References for Cloud Engineers and Architects”

🤔 What is this book about?

This book is my way of making Google Cloud technical concepts fun and interesting via visual storytelling. It covers Google Cloud essentials from end to end, with a visual explanation of each concept, how it works, and how you can apply it with other concepts to meet the needs of your real-world use case. After reading thousands of pages of Google Cloud documentation and experimenting with virtually every Google Cloud product, I distilled that experience down to this book of accessible, bite-sized visuals.

The sketches are spread across five broad categories:

• Infrastructure, storage, and databases: Run and scale applications seamlessly
• Data analytics and machine learning: Derive actionable insights from data
• Networking: Connect, scale, secure, modernize, and optimize your infrastructure
• Application development and modernization: Build apps using containers and microservices
• Security: Protect data, users, and applications in cloud

🙋‍♀️ Who is this book for?

It is for all cloud enthusiasts. It is for anyone who is planning a cloud migration or new cloud deployment, preparing for cloud certification, or looking to make the most of Google Cloud. If you are a cloud solutions architect, an IT decision-maker, or a data and machine learning engineer, you will find this book a good starting point. In short, this book is for YOU!

When you get the book you’ll not only help yourself, you’ll also help provide meals for schoolchildren who need them. All the books’ proceeds go directly to the awesome folks at Wiley and a charity that fights malnutrition and supports the right to education.

🪜 Next Steps

I hope this book helps you on your Google Cloud journey by making it both easier and more fun. Are you ready to dive in? Order here, learn more about how the idea of the book came about here and please share your thoughts with me on Twitter or LinkedIn.

Since Aristocrat’s founding in 1953, technology has constantly transformed gaming and the digital demands on our gaming business are a far cry from challenges we faced when we started. As we continue to expand globally, security and compliance are top priorities.

Managing IT security for several gaming subsidiaries and our core business became more complex as we entered into new markets and scaled up our number of users. We needed a centralized platform that could give us full visibility into all of our systems and efficient monitoring capabilities to keep data and applications secure. We also needed the ability to secure our systems without compromising user experiences.

We turned to Google Cloud and Splunk to better manage complexity and support highly efficient, secure, and more dynamic gaming experiences for everyone. We are committed to using today’s modern technologies to give players more optimal experiences.

Bringing our digital footprint into the cloud

When we set out on our digital transformation, we looked to address many business requirements.

These requirements included:

• Regulation: We wanted a platform that could efficiently address our industry’s stringent and global regulatory compliance requirements.
• Player experience: Our IT environment must support smooth gaming experiences to keep users engaged and satisfied.
• Scalability: As we grow and diversify, meeting the changing demands of an increasingly global gaming community, we need an easily scalable platform to align with our current and future needs.

Google Cloud offered us the perfect foundation through solutions such as Compute Engine, Google Kubernetes Engine, BigQuery, and Google Cloud Storage. These acted as the right infrastructure components for us for the following reasons:

• Google Cloud is globally accessible and supports compliance, helping to streamline security and regulatory processes for our team.
• With Google Cloud, we can manage our entire development and delivery processes globally with fast and efficient reconciliation of regional compliance requirements.
• When we need to adjust existing infrastructure or deliver new capabilities, Google Cloud accelerates the process and takes the heavy lifting off of our team.
• Google Cloud allows us to support tens of thousands of players on each of our apps while experiencing minimal downtime and low latency. The importance of this support can’t be underestimated in an industry where players have little to no patience if lags in games occur.

We migrated our back-office IT stack alongside our consumer-facing production applications to Google Cloud given our positive experiences with compliance, security, scalability, and process management. This migration has significantly accelerated our digital transformation while streamlining our infrastructure for faster and more cost-effective performance.

In many ways, Google Cloud has been, with maybe a pun intended, a game-changer for us. For instance, when we suddenly had to support a lot of remote work during the COVID-19 pandemic, native identity and access management tools in Google Cloud allowed us to retire costly VPNs used for backend access and quickly adopt a more easily managed, cost-effective zero-trust security posture.

Accessing vital third-party partners and managed services

Aristocrat has many IT needs best addressed in a multi-cloud environment. Google Cloud is particularly attractive given its strong cloud interoperability, as well as the many products and services available on Google Cloud Marketplace. The marketplace accelerated our deployment of key third-party apps including Splunk and Qualys.

Given the personal information we store and the global regulatory compliance statutes we must oblige, security lies at the heart of our business. Splunk is a critical component of our digital transformation because it offers solutions that provide the enhanced monitoring capabilities and visibility we need. The integration between Splunk and Google Cloud gives us confidence that our data is secure. We know our data can be secure in Google Cloud, while simplified billing through Google Cloud Marketplace makes payments and license tracking easier for our procurement team.

As part of our protected environment, we use the Splunk platform as our security information and event management system, leveraging the InfoSec app for Splunk that provides continuous monitoring and advanced threat detection to significantly improve our security.

We can manipulate and present data in Splunk in a way that provides us with a single pane-of-glass for our hybrid, multi-cloud environment and our third-party apps and systems. Splunk observability tools have likewise helped us to track browser-based applications like our online gaming apps to monitor details related to security and performance.

Splunk and Google Cloud have transformed how we operate. We can now quickly ingest and analyze data at scale within our refined approach to security management by offloading software management to Splunk and Google Cloud. This ability enables us to approach security more strategically, and positions us to integrate more AI/ML capabilities into our products for even greater governance and performance.

This is just the beginning of our journey with Splunk and Google Cloud. We’re excited to see the innovation we can continue bringing to the gaming community worldwide.

May is a big month for the security industry. It’s been over a year since we gathered for RSA in San Francisco for one of 2020’s last major in-person events. While we likely won’t be together in person this year, it’s an important time for the security community to come together and reflect on many accomplishments, and to consider the challenges still ahead of us. As the world focuses on security incidents and all the risks that still need resolving, it is important to stand back, on occasion, and also note that immense progress has been made by large numbers of small, medium and large enterprises to protect themselves and their customers against increased threats. What is also amazing is to see organizations do this while accelerating their digital transformations, supporting and protecting customers and managing ongoing remote working challenges. We are privileged to play our part in supporting those great teams. 

It’s also been a busy month for us here at Google Cloud since our inaugural CISO perspectives blog post in April. Today, I’ll recap our cloud security and industry highlights, a sneak peak of what’s ahead from Google at RSA and more. 

Thoughts from around the industry 

• Risk Governance of Digital Transformation in the Cloud – In our latest Office of the CISO whitepaper, we shared guidance on both the challenges and opportunities of cloud transformation for Chief Risk Officers, Chief Compliance Officers, Heads of Internal Audit and their teams. A misconception we sometimes see among these executives is that moving to the cloud creates more risk to manage. Having held these leadership positions in previous roles, I believe that the cloud is as much a means of managing security, resilience and other risks as it is a risk in its own right. The whitepaper dives deep into considerations for each of these leadership functions as their organization embarks on a digital transformation journey. 
• The importance of meeting global compliance requirements – Compliance is critical for building trust with customers in regulated industries, especially the public sector. It is worth remembering that in any critical industry, where there can be material impact from incidents, strong industry practices and standards to protect customers are vital (I wrote about this last summer). At Google Cloud, we’re regularly adding new compliance and security certifications to meet our customers’ needs globally. Recently, we expanded our list of FedRAMP High-certified products to include Cloud DNS, and helped our customers in the Asia-Pacific region address various compliance requirements to meet new government regulations for security and data protections. Google Cloud was also the only cloud service provider to complete an annual pooled audit with the Collaborative Cloud Audit Group (CCAG), which is a syndicate of 39 leading European financial institutions and insurance companies who depend on cloud infrastructure and technologies to deliver innovative solutions and experiences for their customers. Having spent most of my career in the financial services industry, I know firsthand the importance of managing risk assessments for outsourced vendors to provide the necessary assurances customers need from their cloud providers. 

RSA 2021 

We have a great lineup of speaking sessions and keynotes from Googlers at RSA this year. Below are the highlights you don’t want to miss: 

• I’ll be doing a session on May 20 about supply chain resilience, where a panel of experts will dive into how we can adjust risk and security initiatives to handle the next “punch to the supply chain.” Additionally, on May 18 I’ll join many of my esteemed CISO leaders from various industries and governments for a keynote discussion on our top security insights, lessons learned and best practices for how we move forward as an industry to address the next wave of challenges. 
• Google’s Senior Director of Information Security Heather Adkins will deliver a session on how to build secure and reliable systems at scale, which will cover principles from Google’s Site Reliability Engineering book with the same title (available for free download here). I’m most looking forward to Heather’s advice for how we as an industry can reshape our security thinking, based on modern architectures and technologies that can help organizations design scalable and reliable systems that are fundamentally secure.
• Nelly Porter, Senior Product Manager at Google Cloud Security, will participate in a panel discussion with security experts on the importance of Confidential Computing technology, how it’s changing the security landscape and where it’s headed. Google Cloud has made great progress in delivering a Confidential Computing portfolio for our customers in regulated industries over the past year, and we’re excited for new milestones in 2021. 

Google cloud security highlights

• Infrastructure and SRE spotlight – Before I joined Google Cloud, I always admired the infrastructure and benefits this organization delivers that are uniquely Google – from the subsea cable innovations to SRE inventions and principles. Security and resiliency are baked into every layer of our infrastructure. Many of the Googlers who build and support our platform have sat in the same seat as our customers, so they understand those needs intimately. Over the last few months it’s been amazing to watch our technical infrastructure team grow, and the direct reliability, operational resilience and security benefits that team brings to our customers. For example, we’ve opened a new region in Poland, announced the first subsea cable that will directly connect the U.S. to Singapore with fiber pairs over an express route, and released an SRE book focused on how organizations can complete a successful cloud migration.
• New security foundations blueprint guide – As part of our mission to deliver the industry’s most trusted cloud, we strive to operate in a shared-fate model for risk management in conjunction with our customers. This includes sharing opinionated step-by-step guidance with key decision points and focus areas for how our customers deploy workloads in Google Cloud. This is why we’ve updated our Google Cloud security foundations guide and corresponding Terraform blueprint scripts. These blueprints are tremendously helpful to many stakeholders within an enterprise, like a CISO that needs to understand our key principles for cloud security, or a C-Suite business leader that needs to quickly identify the skills their teams need to meet an organization’s security, risk, and compliance needs on Google Cloud. 

When we think about the types of features to build into products, we have many principles we follow. But the two that I keep coming back to as crucial are:

1. The need for secure products not just security products. All products should have security built in and while we do build great security products our security and other teams remain focused on constantly enhancing the base levels of security and the security features in all our products. 
2. Defense in Depth. We don’t just focus on defense in depth from attacks – for ourselves and our customers. We also prioritize defense in depth from configuration errors or other hazards. 

As you see below in some of the highlights of new features and products, these represent our commitment to secure products and all forms of defense in depth. 

• Workload identity federation – Service account keys are powerful credentials, and can represent a security risk if they are not managed correctly. A safer approach is to use workload identity federation, using IAM to grant external identities IAM roles, including the ability to impersonate service accounts. This lets you access resources directly and eliminates the maintenance and security burden associated with service account keys. We also offered related overall guidance on the best way to use and authenticate service accounts on Google Cloud.
• VPC-SC Directional Policies – With VPC Service Controls (VPC-SC), admins can define a security perimeter around Google-managed services to control communication to and between those services. Using VPC-SC, you can isolate your production GCP resources from unauthorized VPC networks or the internet. But what if you need to transfer data between isolated environments that you’ve set up? VPC-SC directional policies is a new secure data exchange feature that allows you to configure efficient, private, and secure data exchange between isolated environments. 
• Anthos service mesh supports VMs as well as clusters – Most enterprise compute resources are still in VMs and many will remain there for a long time to come. In Anthos 1.7,  your VM-based workloads can now take advantage of the same mesh functionality as your container-based workloads.
• Cloud Spanner CMEK and Access Approvals – Cloud Spanner is Google Cloud’s fully managed relational database that offers unlimited scale, high performance, strong consistency across regions and high availability. Spanner now supports customer-managed encryption keys (CMEK) and Access Approval, Google Cloud’s industry-leading controls to require approval before access to your content by Google support and engineering teams.
• External Key Manager enhancements – In early 2020 we launched Cloud External Key Manager (Cloud EKM), the industry’s leading Hold-Your-Own-Key (HYOK) product. Using Cloud EKM, the keys used to protect your data stored and processed in Google Cloud are completely hosted and managed outside of Google Cloud infrastructure. Cloud EKM initially launched with support for BigQuery and GCE/PD;  we expanded support for Cloud SQL, GKE, Dataflow Shuffle, and Secret Manager, with CMEK support currently in beta. We also provided in-depth documentation on the functionality, architecture and use cases for Cloud EKM in a new whitepaper.
• Web App and API Protection solution –  Web applications and public APIs are increasingly important to how organizations interface with their customers and partners, and we’ve seen increased investment in tools to protect these resources from fraud and abuse. Google Cloud’s new Web App and API protection solution is based on the same technology Google uses to protect its public-facing services against web application exploits, DDoS attacks, fraudulent bot activity, and API targeted threats. It provides protection across clouds and on-premises environments.
• Threat Intel for Chronicle – Most threat intelligence feeds require security teams to do the implementation and legwork. With our new Threat Intel for Chronicle offering, however, our intelligence insights are applied automatically across your security telemetry to present unique observations within your environment. Threat Intel for Chronicle is exclusively curated for enterprise customers by Uppercase, Google Cloud’s intelligence research and applications team to provide our perspective on threats across the internet and surface them as relevant alerts.

That wraps up another month of thoughts and highlights. If you’d like to have this Cloud CISO Perspectives post delivered every month to your inbox, click here to sign-up, and we’ll see you in June!