State and local government (SLG) agencies are reeling from a combination of unbudgeted COVID-related expenses and reduced tax revenue caused by unemployment and business closures. Any way you look at it, the situation is challenging. To understand how SLG agencies are coping, Google Cloud collaborated with MeriTalk to survey 200 SLG IT and program managers, uncovering some revealing trends in SLG technology innovation. Unsurprisingly, approximately 84% of SLG organizations report making budgetary tradeoffs to bridge funding the gaps the ongoing pandemic has created. 

However, researchers discovered a silver lining: The pandemic has also been a catalyst to modernize the legacy infrastructure in states and cities. The majority of survey respondents (88%) reported that their agency made greater modernization progress this past year than in the prior 10 years.

Walking a tightrope between innovation and budget pressure

According to 89% of state and local leaders, now is the time to invest in technology modernization. But 80% are experiencing a funding gap due to unbudgeted expenses related to the pandemic and declining tax revenue, which makes finding that balance between innovation and budget a serious challenge.

Some agencies are achieving the impossible, though. For example, the City of Pittsburgh Department of Innovation and Performance is working with Google Cloud to migrate  and modernize its legacy IT infrastructure. By decommissioning their data center and moving to Google Cloud, the city can build new data analytics tools to drive smart city initiatives and create entirely new applications to improve digital service delivery for its residents. As a result, the city will save costs, abandon its brittle legacy IT structure, and create a cloud-based technology platform for the future—becoming the region’s leader in cloud-native software development.

Google Cloud is enabling the city’s IT team by curating and delivering our certification training at no cost. The program includes live training sessions as well as on-demand training. 

Bridging funding gaps

In their drive to modernization, many SLG leaders are turning to grants as an important source of funding. Approximately 84% of those surveyed report making tradeoffs to bridge funding gaps, such as moving resources away from operations and maintenance (37%), increasing reliance on pandemic-related funding (31%), and delaying internal modernization efforts to enable remote work for employees (29%). One way that states are dealing with this tension between budget gaps and the need for innovation is to turn to Google Cloud for cost savings and improved capabilities.

For example, Google Cloud is helping the State of West Virginia innovate and enhance IT security despite decreased state funding. The state entered a multi-year agreement to ensure full access to enterprise-level Google Workspace capabilities for 25,000 state employees, keeping the state at the forefront of technology advancements at a projected cost savings of $11.5 million.

Similarly, Google Cloud helped build the Rhode Island Virtual Career Center to help the state’s constituents get back to work. Using familiar productivity tools within Google Workspace, employees can access new career opportunities quickly, while employers can reach more candidates. Skipper, the CareerCompass RI bot, uses data and machine learning to connect Rhode Islanders with potential new career paths and reskilling opportunities.

Enhancing services

Google Cloud is also helping agencies enhance services, including working with the State of Illinois to get unemployment funding to constituents in need.The state is using Contact Center AI to rapidly deploy virtual agents that help more than 1 million out of work citizens file unemployment claims faster. Capable of engaging in human-like conversations, these intelligent agents provide constituents with 24/7 access and enable government employees to focus on more complex, mission-critical tasks—such as combating fraud. In summer 2020, the virtual agents handled more than 140,000 phone and web inquiries per day, including 40,000 after-hours calls every night. The state anticipates an estimated annual savings of $100 million from the solution, which was deployed in just two weeks.

Working with Google, Ohio also uncovered $2 billion in fraudulent unemployment claims. We will continue to partner with the state to find fraudulent claims, and prioritize the processing of legitimate claims.

 Focusing on cybersecurity

Despite expanding security threats topping NASCIO’s list of 2021 State CIO priorities, more than one in three IT managers (35%) say their organization reduces security measures to expedite timelines. Partnering with Google Cloud has enabled many agencies to enhance their security measures while modernizing and staying within budget, investing in support for remote work devices, digital services for residents, and cybersecurity.

NYC Cyber Command works with city agencies to ensure systems are designed, built, and operated in a highly secure manner. NYC3 followed a cloud-first strategy using the Google Cloud Platform. The virtual operations demanded by the pandemic have increased the importance of security and compliance in SLG. Google Cloud is committed to act as a security transformation partner and be the trusted cloud for public sector agencies. 

Finally, to strengthen public and private partnerships, SLG organizations told MeriTalk that they need vendor partners to support modernization efforts for flexibility and collaboration (46%), need innovation-focused leadership groups to help balance technology needs with budget constraints (41%), and they expect significant returns on investments in cloud computing (38%), and data management/analytics (33%).

Google Cloud is helping SLG customers across the country invest in innovation to walk the tech tightrope—balancing innovation and budgets—and helping to build a more resilient future. Visit the State and Local Government solutions page to learn more.

When it comes to cloud security, 2022 will be the year that the past catches up with the future. Trends that businesses have been ignoring for too long will force organizations large and small to confront and control their security debt. 

That’s according to Google Cloud’s own cybersecurity experts, who have identified four security trends that organizations need to watch out for—and get ahead of. We have predictions on what to expect in the coming year from MK Palmore, director of the Office of the CISO; Brian Roddy, vice president of engineering for Cloud Security; Tim Dierks, engineering director for data protection; and Panos Mavrommatis and Vikram Makhija, senior directors of security engineering for Google Cloud.

Supply chain shenanigans

“We will see continued asymmetric attacks from adversaries as they exploit supply chains and other previously ‘trusted’ third-party entities,” says Palmore. 

Supply-chain problems in cloud computing should be easily solvable, right? Software versions and any vulnerabilities they contain should be trackable and patchable, but the reality of fixing software is that “just patch it” is hard to execute—just look at the challenges posed by the Log4j 2 vulnerability. Supply chain is such a huge problem that President Biden addressed it in an Executive Order in May 2021. Customers can expect the issue to be top of mind at Google Cloud.

Not exactly many happy returns (to the office)

“Return to office around the world will drive changes as office infrastructure has not been invested in for a year and a half while the focus has been on remote users. This likely will drive a short-term boom in traditional on-prem security, but it will be the last boom for that as people adapt their remote, zero-trust style strategies to a more modern on-prem approach,” says Roddy.

The misconception that on-prem infrastructure is categorically more secure than cloud is driven by the desire to have physical access to servers and backups so that only the organization which owns the data controls it and has access to it, even in cases of a catastrophic failure or successful cyberattack. In the early years of cloud computing, that may even have been true. But the conditions that drove the myth of on-prem security primacy changed years ago, and the needs driving secure cloud infrastructure help ensure that cloud stays more secure. 

Paying down your security debt

“While there’s all the new hotness of cutting-edge concerns, many enterprises still carry security risks and security debt from not yet fully adopting controls which have been broadly accepted as important for years. For example, loads of companies are still not using phishing-resistant two-factor authentication such as FIDO keys,” says Dierks.

Authentication keys such as those made by Yubico and Google’s own Titan Security key support the zero-trust security principles that require user identities to be authenticated, authorized, and then continuously validated before they can access applications and data. Strong authentication is such an important part of contemporary user security that even weaker forms of it that rely on text messages are significantly more secure than not using it at all. That said, why use a less-secure standard when you can reduce risks to your data and bottom line even further by requiring a phishing-resistant hardware key?

Dierks stresses another challenging but important part of eliminating security debt: using social connections to encourage best security practices. “It’s important for CISOs to use their business relationships to emphasize the importance of baseline controls [such as 2FA] for their partners. Enterprises have close relationships that attackers can leverage, so it’s critical that partners hold each other accountable to maintain high security.” 

KYD (Know Your Data)

The impact of a data breach can harm organizations as they currently are as well as far into the future. Current tough-to-crack encryption standards protecting data could become easier to decode in the years ahead, so even if cybercriminals can’t access stolen data now there’s no guarantee that paradigm will hold. This means it’s crucially important that organizations understand what data they’re storing, how they’re storing it, and where they’re storing it, say Mavrommatis and Makhija.

“You can’t secure what you don’t know about, and not all data breaches are equal. Stolen machine logs are not as bad as customer data. But how many security teams know the difference? So you have to crawl your own data to automatically classify and discover where sensitive data lives,” they say.

Makhija adds that the shared fate model requires the cloud providers and cloud customers to have a mutual understanding of the quantitative risks each faces. “Shared fate models will pick up significantly in 2022,” he says, as more organizations move to the cloud, and those already using cloud infrastructure improve their security postures. 

“To date, there’s been a disparate set of tools for understanding your posture. It’s difficult for third-party tools to stitch together what cloud services should be providing from the start,” he says. 

What you can do to make your organization more secure

One cloud security trend that’s ever-present is the ever-increasing importance of keeping cloud deployments secure. As cloud infrastructure becomes more commonplace across businesses and industries of all sizes, it will continue to grow as an attractive target for cybercriminals and other threat actors.

• Because enterprise data has expanded exponentially, the ability to identify and detect threats have become increasingly challenging. To better secure the enterprise software supply chain, use advanced threat detection and analysis tools—especially those designed to catch anomalies. 
• The faster that organizations adopt a zero-trust architecture, the more secure the new normal can be. Zero trust helps limit the blast radius of any potential intrusion, while maximizing new enterprise access expectations. Part of adopting zero trust means many end-users can abandon legacy technology like VPNs, but the benefits of segmentation and context-aware access for both identity and device will make all the difference for large scale enterprises. When coupled with a full zero-trust approach and the use of a zero-trust maturity model for improvement, organizations will be better positioned to manage their digital risks.
• Security debt can come in many forms and one critical payoff that needs to be made is for organizations to migrate en masse to hardware two-factor authentication keys. They make user accounts significantly more resistant to takeovers, and are much harder to circumvent than two-factor authentication over SMS. 
• It’s past time to get to know your data, and a bouquet of flowers and a bottle of red wine won’t help. There are third-party tools that can do this, but for Google Cloud customers who use BigQuery there’s automatic Data Loss Prevention. It continuously monitors existing tables and profiles new ones; it can be customized for selected folders or projects, or for an entire organization; and it generates data profiles in the same geographic region as the original data.

Understanding and managing the security challenges of cloud infrastructure helps maximize its benefits, and makes for a safer security landscape in 2022—and beyond.

Risk managers know there is one assessment type that’s foundational for every risk management program: the vendor risk assessment. Understanding the risk posture of your vendors and third parties, including your cloud providers, is an important part of an effective risk management program. While collecting and analyzing information can often be time-consuming for risk managers, Google Cloud collaborates with third-party risk management (TPRM) providers to make the process easier. 

These TPRM organizations provide independent due diligence services and platforms to help automate vendor risk management based on their inspection of security, privacy, business continuity, and operational resiliency controls, aligned with industry standards and regulation compliance. The ultimate goal is to help our customers scale and accelerate their assessments of Google Cloud.

We enable trusted TPRM providers, like CyberGRX, to examine the CyberGRX controls (such as privacy, operational, and management) and operations. Based on their observations, CyberGRX provides a validated cyber risk assessment of Google Cloud’s security posture. Like assessments performed by individual customers, the CyberGRX assessment of Google Cloud details our adherence to industry standards and the security protocols built into our infrastructure. 

Using a standardized approach like this, CyberGRX can quickly provide access to a security assessment of Google Cloud. CyberGRX’s validation process focuses on measuring the accuracy of a third party, such as Google Cloud’s assessment answers. CyberGRX analysts and partners evaluate evidence provided by Google Cloud to confirm we have implemented certain critical controls as indicated by their assessment. The assessment of Google Cloud is available to organizations via the CyberGRX website. 

How Google Cloud stacks up

CyberGRX’s assessment covers more than 200 controls, and integrates Google Cloud’s responses with analytics, threat intelligence, and risk models. Additionally, CyberGRX’s Framework Mapper provides further functionality by mapping the cyber risk assessment of Google Cloud to more than 20 commonly used industry frameworks and standards. This enables our customers to view the cyber risk assessment of Google Cloud against customers’ specific, local compliance regime requirements including the MITRE ATT&CK framework.  

CyberGRX’s Framework Mapper has broad standards and requirements coverage, including: 

The CyberGRX mapping technology enables customers to see a mapping that is based on their specific needs, aggregated into a single assessment. This saves customers time and effort by eliminating the need for customers to create and repeatedly perform customized assessments of Google Cloud. Customers can now map the cyber risk assessment of Google Cloud to the frameworks they’re accustomed to using.

Integrating the MITRE ATT&CK™ framework 

MITRE ATT&CK is a strongly-supported knowledge base that helps model security adversarial behavior, tactics, and techniques which currently includes 13 tactics and 192 techniques.

In June 2022, Google Cloud announced our support and investment in a research partnership with MITRE Engenuity Center for Threat-Informed Defense, which included facilitating the mapping of the MITRE ATT&CK framework to Google Cloud security capabilities.

CyberGRX also recognizes the value of the MITRE ATT&CK framework and maps their foundational assessment to the MITRE ATT&CK framework. This allows organizations to review their security controls and gain visibility into gaps in their defenses. Security leaders can rapidly and easily identify critical problems for remediation. 

There are multiple benefits to using the MITRE ATT&CK framework when accessing Google Cloud’s risk assessment through CyberGRX, including: 

• Uncovering previously unreported gaps by leveraging MITRE techniques to create kill chains or use cases.
• Integrating results into internal risk and threat management programs that already align with MITRE ATT&CK.
• Increasing credibility and defensibility to CyberGRX risk findings to support third-party decisions and relationships due to connection to MITRE-based analytics.

Take advantage of the Google Cloud and CyberGRX collaboration

CyberGRX’s independent security assessment of Google Cloud is available to Google Cloud customers, and is an easy way for organizations to scale and accelerate their cloud assessments. CyberGRX provides a comprehensive and objective view of Google Cloud’s security posture based on a number of local compliance regime requirements and the MITRE ATT&CK framework. CyberGRX’s centralized assessment supports our customers’ annual vendor risk management processes and reduces the review time.

Today, we published a new Google research report on software supply chain security because we’ve seen a sharp rise in software supply chain attacks across almost every sector —and expect these trends to continue for the foreseeable future. We urge all organizations to act now to improve their software supply chain security.

Among the report’s conclusions, there are two key findings we want to highlight. First, the lessons we’ve learned from various security events call for a more holistic approach to strengthen defenses against software supply chain attacks. Second, we have worked with the security community to develop and deploy a common Supply-chain Levels for Software Artifacts (SLSA) framework that can mitigate threats across the entire software supply chain ecosystem. These frameworks can help organizations securely build and verify the integrity of software. You can find more information on the report’s conclusions here.

We know that modern day software supply chains continue to grow deeper, wider, and more complex. That complexity can make it challenging for customers to even know where to begin analyzing their supply chains for security issues. Our research shows that organizations must deal with these same complex issues regardless of which environments they operate in.

At Google Cloud, we’re deeply committed to working with our customers to help ensure that they have the support they need to evaluate their security posture, resiliency, and hygiene. Below, we suggest five steps to protect software across processes and systems, and tap into relevant Google Cloud products and services. These recommendations can enable customers to benefit from Google’s extensive security experience and reduce their need to develop, maintain, and operate complex processes to secure their open source dependencies.

Implementing best practices with Google Cloud

Customers who are interested in improving their software supply chain security can take immediate steps to implement best practices.

1. Enhance your existing Google Cloud security features with the Google Cloud security foundation guide. The guide can help you weigh important considerations including organizational structure, authentication and authorization, resource hierarchy, networking, logging, and detective controls. You can further engage Mandiant experts to assess your readiness.

You can also view centralized information about vulnerabilities and possible risks using Google Cloud services like Security Command Center, and get information about your service usage with Recommender, including recommendations that can help you to reduce risk. For example, you can identify IAM principals with excess permissions or unattended Google Cloud projects. You can also find additional resources from the Google Cybersecurity Action Team (GCAT), our premier security advisory team, here.

2. Explore fast software delivery and reliable and secure software with Google Cloud’s DevOps capabilities. You also should review foundational practices for designing, developing, and testing code that apply to most programming languages.

We strongly recommend you evaluate how you distribute software and the terms of software licenses in all of your dependencies. For more information on Google’s approach to helping organizations address vulnerabilities in open source software, see Appendix B in the research report.

3. Document the policies for your organization and incorporate validation of policies into your development, build, and deployment processes as you implement best practices. For example, your organization’s policies might include criteria for deployment that you implement with Binary Authorization. GCAT has published additional information on security policies and other cloud security transformation tips for CISOs here.

You can also explore Minimum Viable Secure Product, a security checklist of controls to establish a baseline security posture for a product. You can use the checklist to establish your minimum security control requirements and to evaluate software by third-party vendors.

Tapping into new Google product and service offerings

At Google Cloud, we continue to focus on delivering new and innovative security capabilities to help customers address the latest security threats. From the attack on SolarWinds to the community response to open source vulnerabilities such as Log4j, we’re seeing a spike in demand from customers on what we can do to help them manage software supply chain risk. We’ve made several recent announcements on that front that can help customers get started with Google Cloud today.

4. Use Google Cloud’s Software Delivery Shield. It provides a fully managed software supply chain security solution that offers a modular set of capabilities to help equip developers, DevOps, and security teams with the tools they need to build secure cloud applications. Software Delivery Shield spans across a family of Google Cloud services from developer tooling to runtimes including GKE, Cloud Code, Cloud Build, Cloud Deploy, Artifact Registry, and Binary Authorization. To learn more about Software Delivery Shield, check out the solution page, or watch this Google Cloud Next session to get a quick overview of Software Delivery Shield.
5. Enable our Assured Open Source Software (OSS) service, which can help enterprise and public sector open source software users to easily incorporate the same OSS packages that we use at Google into their own developer workflows. Packages curated by the Assured OSS service:

• are regularly scanned, analyzed, and fuzz-tested for vulnerabilities;
• have corresponding enriched metadata incorporating Container/Artifact Analysis data;
• are built with Cloud Build including evidence of verifiable Supply chain Levels for Software Artifacts (SLSA)-compliance;
• are verifiably signed by Google;
• and are distributed from an Artifact Registry that is secured and protected by Google.

If you are interested in learning more about software supply chain security in general, please contact us or reach out to your sales representative to schedule a software supply chain security workshop.