Whether driven by government policy, industry regulation, or geo-political considerations, the evolution of cloud computing has led organizations to want even more control over their data and more transparency from their cloud services. At Google Cloud, one of the best tools for achieving that level of control and transparency is a bit of technological magic we call Cloud External Key Manager (EKM).

Cloud EKM can help you protect your cloud data at rest with encryption keys which are stored and managed in a third-party key management system that’s outside Google Cloud’s infrastructure, and ultimately outside Google’s control. This can help you achieve full separation between your encryption keys and your data stored in the cloud. Cloud EKM works with symmetric and asymmetric encryption keys, and offers organization policies that allow for fine-grained control over what types of keys are used. Via Key Access Justification (KAJ) it also offers a way for clients to control each key use.

At their core, many cloud security and cloud computing discussions are about the kinds of trust that Cloud EKM specifically and encryption more broadly can help create. While the concept of digital trust is much bigger than cybersecurity and its tripartite components of security, privacy, and compliance, one of the most crucial themes of cloud computing is the cloud trust paradox. In order to trust the cloud more, you must be able to trust it less, and external control of keys and their use can help reduce concerns over unauthorized access to sensitive data.

How it works

From our Cloud EKM documentation, you can use keys that you manage within a supported external key management partner to protect data within Google Cloud. You can protect data at rest in services that support CMEK, or by calling the Cloud Key Management Service API directly.

Cloud EKM provides several benefits:

• Key provenance: You control the location and distribution of your externally-managed keys. Externally-managed keys are never cached or stored within Google Cloud. Google cannot see them. Instead, Cloud EKM communicates directly with the external key management device for each request.
• Access control: You manage access to your externally-managed keys. Before you can use an externally-managed key to encrypt or decrypt data in Google Cloud, you must grant the Google Cloud project access to use the key. You can revoke this access at any time.
• Centralized key management: You can manage your keys and access policies from a single location and user interface, whether the data they protect resides in the cloud or on your premises. The system that managed the keys is entirely outside Google control.

In all cases, the key resides on the external system, and is never sent to Google.

Here’s how it works:

1. Create or use an existing key in a supported external key management partner system. This key has a unique URI.
2. Grant your Google Cloud project access to use the key, in the external key management partner system.
3. Create a Cloud EKM key in your Google Cloud project, using the URI for the externally-managed key.

The Cloud EKM key and the external key management partner key work together to protect your data. The external key is never exposed to Google and cannot be accessed by Google employees. Furthermore, Cloud EKM can be combined with Key Access Justifications (KAJ) to establish cryptographic control over data access.

KAJ with Cloud EKM can give customers the ability to deny Google Cloud administrators access to their data at rest for any reason, even in situations typically exempted from customer control, such as outages or responses to third-party data requests. KAJ does this by providing customers a clear reason why data is being decrypted, which they can use to programmatically decide whether to permit decryption and thus allow access to their data.

Previously, we’ve discussed three patterns where keeping the keys off the cloud may in fact be truly necessary or outweighs the benefits of cloud-based key management. Here’s a brief summary of those three scenarios where Cloud EKM can help solve these Hold Your Own Key dilemmas.

Scenario 1: The last data to go to the cloud

As organizations complete their digital transformations by migrating data processing workloads to the cloud, there is often a pool of data that can not be moved to the cloud. Perhaps it’s the most sensitive data, the most regulated data, or the data with the toughest internal security control requirements.

Finance, healthcare, manufacturing and other heavily-regulated organizations face myriad risk, compliance, and policy reasons that may make it challenging to send some of their data to a public cloud provider. However, the organization may be willing to migrate this data set to the cloud as long as it is encrypted and they have sole possession of the encryption keys.

Scenario 2: Regional regulations and concerns

Regional requirements are playing a larger role in how organizations migrate to and operate workloads in the public cloud.

Some organizations are already facing situations where they are based in one country and want to use a cloud provider based in a different country, but they aren’t comfortable with or legally allowed to give the provider access to encryption keys for their stored data. Here the situations are more varied, and can include an organization’s desire to stay ahead of evolving regulatory demands or industry-specific mandates.

Ultimately, this scenario allows organizations to utilize Google Cloud while keeping their encryption keys in the location of their choice, and under their physical and administrative control.

Scenario 3: Centralized encryption key control

The focus here is on operational efficiency. Keeping all the keys within one system to cover multiple cloud and on-premise environments can help reduce overhead and attack surface, thus helping to improve security. As Gartner researchers concluded in their report, “Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data1,” organizations are motivated to reduce the number of key management tools.

“By minimizing the number of third-party encryption solutions being deployed within an environment, organizations can focus on establishing a cryptographic center of excellence,” Gartner researchers said

Given that few organizations are 100% cloud-based today for workloads that require encryption, keeping keys on-prem can streamline key management. Centralizing key management can give the cloud user a central location to enforce policies around access to keys and access to data-at-rest, while a single set of keys can help reduce management complexity. A properly implemented system with adequate security and redundancy outweighs the need to have multiple systems.

Do I need Cloud EKM?

Whether protecting highly sensitive data, retaining key control to address geopolitical and regional concerns, or supporting hybrid and multi-cloud architectures, Cloud EKM is best suited for those Google Cloud customers who must keep their encryption keys off of the cloud and always under their full control.

To learn more about Cloud EKM, please review these resources:

• Our research explaining why Google Cloud users can benefit from Cloud EKM
• The most recent updates to Cloud EKM
• Take a deeper dive into the cloud trust paradox

1. Gartner, Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data, David Mahdi, Brian Lowans, March 2022.

The home lending journey entails processing an immense number of documents daily from hundreds of thousands of borrowers. Currently, home lending document processing relies on some outdated digital models and a high dependency on manual labor, resulting in slow processing times and higher origination costs. Scaling a business that sorts through millions of documents daily, while increasing efficacy and accuracy, is no small feat. When it comes to applying for a mortgage loan, consumers expect a digital experience that’s as good as the in-person one. Roostify simplifies the home lending journey for lenders and their customers.

No time to spare: Overcoming document processing challenges with AI

Roostify provides enterprise cloud applications for mortgage and home lenders. In order to empower its customers to deliver a better, more personalized lending experience, they needed to automate and scale their in-house document parsing functionality.

As a key component of its document intelligence service, Roostify is leveraging Google Cloud’s Lending DocAI machine learning platform to automate processing documents required during a home loan application process, such as tax returns or bank statements with multi-language support. This partnership delivers data capture at scale, enabling Roostify customers to automatically identify document types from the uploaded file and to extract relevant entities such as wages, tax liabilities, names, and ID numbers for further processing, and make things move faster in the cumbersome lending process. 

Roostify’s solutions leverage Google Cloud’s Lending DocAI, which is built on the recently announced Document AI platform, a unified console for document processing. Customers can easily create and customize all the specialized parsers (e.g., mortgage lending documents and tax returns parsers) on the platform without the need to perform additional data mapping or training. All Google Cloud’s specialized parsers are fine-tuned to achieve industry-leading accuracy, helping customers and partners confidently unlock insights from documents with machine learning. Learn more about the solution from the GA launch blog and the overview video.

Integrating Lending DocAI’s intelligent document processing capabilities into the Roostify platform means more innovation for their customers and tangible results: faster loan processing times, fewer document intake errors, and lower origination costs. Additional support in Google Lending DAI for other languages and more documents like global Know Your Customer (KYC) documents or payroll reports is in the near future.

Full integration of AI solutions

Working together with Roostify’s platform team, we were able to help them solve their document processing challenge through integration of various GCP products such as Lending DocAI (LDAI), Data Loss Prevention (DLP) for redacting sensitive data, BigQuery for data warehousing and analytics, and Firestore for API status. To make it very safe and secure, all data was encrypted end-to-end at Rest and in Transit. LDAI won’t require any training data to process. It is an easy plug and play API.

Here is a sneak peek in the high level deployment architecture for LDAI in Roostify environment:

Here are the steps for processing data:

1. Receives document processing request from the client.
2. API Function directs requests to the pre-processing service. For Async requests a processing ID is generated and returned to the caller.
3. Pre-processing service sends the request for further processing (Long/short PDF conversion), calling other microservices and receives back the responses. Any error in the response received is then sent to the response processing service. 
4. If the response is synchronous, the pre-processing service directs it to the LDAI Invoker service. 
   1. If the response is asynchronous, the pre-processing service feeds it into the Cloud Pub/Sub service.
5. Cloud Pub/Sub service feeds the response back to the LDAI Invoker service.
6. LDAI Invoker service routes the request to the Google LDAI API for classification if there are multiple pages in the document.
7. Document will be split based on LDAI response and then saved in a GCS bucket for temporary storage.
8. LDAI entity interface for single page processing and then LDAI Invoker sends LDAI results to LDAI Response Processing
9. If a request is a synchronous request the LDAI Response Processor sends results to the API Function so that it can complete the synchronous call and respond to the rConnect caller.
   1. If the request is an asynchronous request the LDAI Response Processor will respond to the caller’s webhook and complete the transaction.
10. Finally, Data stored in the GCP bucket will be deleted.

All the responses that come from the LDAI API can optionally feed into BigQuery via the Response Processor, after parsing it through Data Loss Prevention (DLP) API to redact the PII/sensitive information.  Throughout the processing of both asynchronous and synchronous requests all transactions are logged using Cloud Logging.  For asynchronous transactions, the state is maintained throughout the process using Cloud Firestore.

Roostify currently uses this technology to power two different solutions: Roostify Document Intelligence and Roostify Beyond™. Roostify Document Intelligence is a real-time document capture, classification, and data extraction solution built for home lenders. It ingests documents uploaded by borrowers and loan officers, identifies the relevant documents, and extracts and classifies key information. Roostify Document Intelligence is available as a standalone API service to any home lender with any digital lending infrastructure already in place. 

Roostify Beyond™ is a robust suite of AI-powered solutions that enables home lenders to create intelligent experiences from start to close. It combines powerful data, insightful analytics, and meaningful visualization to streamline the underwriting process. Roostify Beyond™ is currently available only to Roostify customers as part of an Early Adopter program and will be rolled out to the market later this year.

Through this partnership, Roostify has enabled its customers to adopt a data-first approach to their home lending processes, which will lead to improved user experiences and significantly reduced loan processing times.

Fast track end-to-end deployment with Google Cloud AI Services (AIS)

Google AIS (Professional Services Organization), in collaboration with our partner Quantiphi, helped Roostify deploy this system into production and fast-tracked the development multifold to generate the final business value.

The partnership between Google Cloud and Roostify is just one of the latest examples of how we’re providing AI-powered solutions to solve business problems.

“Nude” comes in all shapes, sizes and colors. But for Ade Hassan, finding undergarments to match her skin tone took more effort than necessary. Born in the U.K. to Nigerian parents, Hassan searched unsuccessfully for underwear and swimwear that matched her skin—a problem that continued to frustrate her through college and into her professional life. 

“My nude isn’t the nude I see in shops,” Hassan says. 

Like many other black entrepreneurs, she created her own solution. Hassan founded Nubian Skin, a company that sells lingerie, hosiery, and swimwear for women of color.

With shades like “cafe au lait” and “berry,” Nubian Skin products reflect diverse skin tones and are sold in shops located in the U.K., Nigeria and the U.S., as well as online. Beyoncé and her dancers even asked Nubian Skin to outfit them for their  2017 “Formation” tour. 

Since nearly the beginning, Hassan has used G Suite to keep her business humming.

From managing meetings with retailers and manufacturers, to coordinating publicity efforts with fashion press, to keeping track of retail invoices, G Suite has helped Hassan scale her business as quickly as people have demanded her products.

“There are so many pitfalls and so many things that are hard about business,” Hassan says. “It’s really amazing to have something like G Suite that is easy and intuitive.”

Nubian Skin’s fashion fame arrived seemingly overnight. When Hassan posted the company’s first campaign images, its Instagram followers jumped from 50 people to more than 20,000 in just a few weeks.

“People called asking, ‘Can we have the contact for the press department?,” says Hassan. “But at the time, it was just me.” To easily handle media requests, she set up a press@nubianskin.com email address through the G Suite Admin console. And because she had used Gmail for several months before launching the company, using the business version of Gmail came naturally.

“Having that nubianskin.com address gave the business an air of professionalism, which we wouldn’t have had otherwise,” Hassan says. “Usually you need a whole IT department to set up new emails and passwords, but the Admin console removes the hassle of that process.”

Because Nubian Skin employees aren’t always in the showroom together, they need to be able to access business documents—like model photos and customer invoices—from anywhere.

To help, Hassan securely stores business documents in Google Drive (which can be accessed on mobile, too) and works collaboratively with her finance team to process orders using Google Sheets.

“Everyone has access to the spreadsheet so we can fill in what we need at any given point,” says Hassan. “This way, nothing slips through the cracks.”

And when she needs to connect with colleagues quickly or face-to-face, she uses Hangouts Chat or Hangouts Meet. Chat makes it so employees are only a message away, and Meet helps her connect with people as if they’re in person at the office.

Five years after launching Nubian Skin, Hassan is a recognized entrepreneur who’s influenced other retailers to create more inclusive designs.

“Even if you’re small, you want people to see you as a professional business,” Hassan says. “If you’re still growing, you need the building blocks to get you where you want to be. I can’t imagine working without G Suite.”

The holiday season is upon us! If you are making your list and checking it twice, we’ve got a few learning gifts you can tick off the list and share with others too. For the season of giving, we’ve wrapped up some of our most popular training and certification opportunities and made them available at no-cost.

This December we’re aiming to offer something for everyone, whether you’re just getting started with cloud, or knee deep in preparing for a professional certification exam. Start with the fundamentals to gain a deeper understanding of cloud whether you’re in a business or technical role. Perhaps you’re looking to flex your data analytics and ML muscle with BigQuery and SQL, earn a Google Cloud skill badge, or enhance your technical cloud skills. Or jump into a hot topic like sustainability and learn about Google’s commitment to a clean cloud, and how to use sustainability tools. Read on to find something on your learning wishlist.

We also have a variety of learning formats to fit your needs. Complete hands-on labs, view courses and webinars, or jump into competitions like the Google Cloud Fly Cup Challenge or our most popular #GoogleClout Challenge of 2022 – and let the fun begin!

Are you ready to learn? Take a look at the training we’ve recommended below to work towards your goals as we head into the new year, with new skills, to make the most of new opportunities.

We’re giving plenty of learning gifts to choose from this month, so take your pick from the topics below:

ML, AI and data analytics

Who it’s for: ML, AI and data engineers
What you’ll take away: A deeper understanding of working in BigQuery and SQL.
Level: Foundational
Start learning now:

• Introduction to SQL for BigQuery and Cloud SQL – Get started with this one hour and 15 minute hands-on lab to learn fundamental SQL querying keywords, which you will run in the BigQuery console on a public dataset, and how to export subsets of a dataset into CSV files, then upload to Cloud SQL. You’ll also learn how to use Cloud SQL to create and manage databases and tables, with hands-on practice on additional SQL keywords that manipulate and edit data.

• Weather Data with BigQuery – In this 45 minute lab, you’ll use BigQuery to analyze historical weather observations, and run analytics on multiple datasets.
• Insights from Data with BigQuery – Earn a shareable skill badge when you complete this five hour quest. It includes interactive labs covering the basics of BigQuery, from writing SQL queries, creating and managing database tables in Cloud SQL, and querying public tables to loading sample data into BigQuery.
• The Google Cloud Fly Cup Challenge – This is a three-stage competition in the sport of drone racing in the Drone Racing League (DRL). You will use DRL’s race data to predict outcomes and give performance improvement tips to pilots (these are the best drone pilots in the world!). There’s a chance to win exclusive swag, prizes, and an expenses paid trip to the DRL World Championship. Registration closes on December 31, 2022.

CI/CD

Who it’s for: Software Developers
What you’ll take away: Take part in our most popular #GoogleClout challenge of 2022! Build a simple containerized application.
Level: Fundamental
Start learning now:

• GoogleClout – CI/CD in a Google Cloud World – Flex your #GoogleClout in this cloud puzzle that challenges you in a lab format to create a Cloud Build Trigger to rebuild a containerized application hosted on a remote repository. Register it in the Artifact Registry and deploy. You’ll be scored on your results and earn a badge to share.

Preparing for Google Cloud certification

Who it’s for: Cloud engineers and architects, network and security engineers and Google Workspace administrators
What you’ll take away: Explore the breadth and scope of the domains covered in the cloud certification exams, assess your exam readiness and create a study plan.
Level: Foundational to advanced
Start learning now:

• Preparing for Google Cloud certification – These courses are for Associate Cloud Engineers, Professional Cloud Architects, Professional Cloud Network Engineers, Professional Cloud Security Engineers, and Google Workspace Administrators preparing for Google Cloud certification exams. You’ll also earn a completion badge when you finish the course.
• Preparing for the Cloud Architect certification exam – Join this 30 minute on-demand webinar to learn about resources to maximize your study plan, and get tips from a #GoogleCloudCertified Professional Cloud Architect.

Intro to Google Cloud for technical professionals

Who it’s for: Software Developers
What you’ll take away: Boost your Google Cloud operational and efficiency skills to drive innovation by navigating the fundamentals of compute, containers, cloud storage, virtual machines, and data and machine learning services.
Level: Foundational
Start learning now:

• Getting Started with Google Cloud Fundamentals – This on-demand webinar takes a little less than three hours to complete. Navigate Compute Engine, container strategies, and cloud storage options through sessions and demos. You’ll also learn how to create VM instances, and discover Google Cloud’s big data and machine learning options.

Intro to Google Cloud for business professionals

Who it’s for: Business roles in the cloud space like HR, marketing, operations and sales
What you’ll take away: A deeper understanding of cloud computing and how Google Cloud products help achieve organizational goals.
Level: Foundational
Start learning now:

• Cloud Digital Leader learning path -There are four courses in this learning path covering digital transformation, innovating with data, infrastructure and application modernization, and Google Cloud security and operations.

• Preparing for the Cloud Digital Leader certification exam – In this 30 minute webinar continue your learning journey by preparing for the Google Cloud Digital Leader certification exam. The webinar covers all the resources we’ve made available to help you prepare.

Sustainability

Who it’s for: Software Developers
What you’ll take away: Learn how the cleanest cloud in the industry can help you save your cloud bill, and save the planet.
Level: Foundational
Start learning now

• A Tour of Google Cloud Sustainability -Work through this one hour, hands-on lab, to explore your carbon footprint data, use the Cloud Region Picker, and reduce your cloud carbon footprint with Active Assist recommendations.

Keep connected and learning with us in 2023

Accelerate your growth on Google Cloud by joining the Innovators Program. No-cost for users of Google Cloud (including Workspace), it’s for anyone who wants to advance their personal and professional development around digital transformation, drive innovation, and solve difficult business challenges.

Continue your learning with Google Cloud in 2023 by starting an annual subscription¹ with Innovators Plus benefits. Gain access to $500 in Google Cloud credits, live learning events, our entire on-demand training catalog, a certification voucher, access to special events, and other benefits.

Build your skills, reach your goals and advance your career with 12 no-cost ways to learn Google Cloud!

1. Start an annual subscription on Google Cloud Skills Boost with Innovators Plus for $299/year, subject to eligibility limitations.