What to Look for from Cloud CISO Perspective

6626
Of your peers have already read this article.
2:30 Minutes
The most insightful time you'll spend today!
May is a big month for the security industry. It’s been over a year since we gathered for RSA in San Francisco for one of 2020’s last major in-person events. While we likely won’t be together in person this year, it’s an important time for the security community to come together and reflect on many accomplishments, and to consider the challenges still ahead of us. As the world focuses on security incidents and all the risks that still need resolving, it is important to stand back, on occasion, and also note that immense progress has been made by large numbers of small, medium and large enterprises to protect themselves and their customers against increased threats. What is also amazing is to see organizations do this while accelerating their digital transformations, supporting and protecting customers and managing ongoing remote working challenges. We are privileged to play our part in supporting those great teams.
It’s also been a busy month for us here at Google Cloud since our inaugural CISO perspectives blog post in April. Today, I’ll recap our cloud security and industry highlights, a sneak peak of what’s ahead from Google at RSA and more.
Thoughts from around the industry
- Risk Governance of Digital Transformation in the Cloud – In our latest Office of the CISO whitepaper, we shared guidance on both the challenges and opportunities of cloud transformation for Chief Risk Officers, Chief Compliance Officers, Heads of Internal Audit and their teams. A misconception we sometimes see among these executives is that moving to the cloud creates more risk to manage. Having held these leadership positions in previous roles, I believe that the cloud is as much a means of managing security, resilience and other risks as it is a risk in its own right. The whitepaper dives deep into considerations for each of these leadership functions as their organization embarks on a digital transformation journey.
- The importance of meeting global compliance requirements – Compliance is critical for building trust with customers in regulated industries, especially the public sector. It is worth remembering that in any critical industry, where there can be material impact from incidents, strong industry practices and standards to protect customers are vital (I wrote about this last summer). At Google Cloud, we’re regularly adding new compliance and security certifications to meet our customers’ needs globally. Recently, we expanded our list of FedRAMP High-certified products to include Cloud DNS, and helped our customers in the Asia-Pacific region address various compliance requirements to meet new government regulations for security and data protections. Google Cloud was also the only cloud service provider to complete an annual pooled audit with the Collaborative Cloud Audit Group (CCAG), which is a syndicate of 39 leading European financial institutions and insurance companies who depend on cloud infrastructure and technologies to deliver innovative solutions and experiences for their customers. Having spent most of my career in the financial services industry, I know firsthand the importance of managing risk assessments for outsourced vendors to provide the necessary assurances customers need from their cloud providers.
RSA 2021
We have a great lineup of speaking sessions and keynotes from Googlers at RSA this year. Below are the highlights you don’t want to miss:
- I’ll be doing a session on May 20 about supply chain resilience, where a panel of experts will dive into how we can adjust risk and security initiatives to handle the next “punch to the supply chain.” Additionally, on May 18 I’ll join many of my esteemed CISO leaders from various industries and governments for a keynote discussion on our top security insights, lessons learned and best practices for how we move forward as an industry to address the next wave of challenges.
- Google’s Senior Director of Information Security Heather Adkins will deliver a session on how to build secure and reliable systems at scale, which will cover principles from Google’s Site Reliability Engineering book with the same title (available for free download here). I’m most looking forward to Heather’s advice for how we as an industry can reshape our security thinking, based on modern architectures and technologies that can help organizations design scalable and reliable systems that are fundamentally secure.
- Nelly Porter, Senior Product Manager at Google Cloud Security, will participate in a panel discussion with security experts on the importance of Confidential Computing technology, how it’s changing the security landscape and where it’s headed. Google Cloud has made great progress in delivering a Confidential Computing portfolio for our customers in regulated industries over the past year, and we’re excited for new milestones in 2021.
Google cloud security highlights
- Infrastructure and SRE spotlight – Before I joined Google Cloud, I always admired the infrastructure and benefits this organization delivers that are uniquely Google – from the subsea cable innovations to SRE inventions and principles. Security and resiliency are baked into every layer of our infrastructure. Many of the Googlers who build and support our platform have sat in the same seat as our customers, so they understand those needs intimately. Over the last few months it’s been amazing to watch our technical infrastructure team grow, and the direct reliability, operational resilience and security benefits that team brings to our customers. For example, we’ve opened a new region in Poland, announced the first subsea cable that will directly connect the U.S. to Singapore with fiber pairs over an express route, and released an SRE book focused on how organizations can complete a successful cloud migration.
- New security foundations blueprint guide – As part of our mission to deliver the industry’s most trusted cloud, we strive to operate in a shared-fate model for risk management in conjunction with our customers. This includes sharing opinionated step-by-step guidance with key decision points and focus areas for how our customers deploy workloads in Google Cloud. This is why we’ve updated our Google Cloud security foundations guide and corresponding Terraform blueprint scripts. These blueprints are tremendously helpful to many stakeholders within an enterprise, like a CISO that needs to understand our key principles for cloud security, or a C-Suite business leader that needs to quickly identify the skills their teams need to meet an organization’s security, risk, and compliance needs on Google Cloud.
When we think about the types of features to build into products, we have many principles we follow. But the two that I keep coming back to as crucial are:
- The need for secure products not just security products. All products should have security built in and while we do build great security products our security and other teams remain focused on constantly enhancing the base levels of security and the security features in all our products.
- Defense in Depth. We don’t just focus on defense in depth from attacks – for ourselves and our customers. We also prioritize defense in depth from configuration errors or other hazards.
As you see below in some of the highlights of new features and products, these represent our commitment to secure products and all forms of defense in depth.
- Workload identity federation – Service account keys are powerful credentials, and can represent a security risk if they are not managed correctly. A safer approach is to use workload identity federation, using IAM to grant external identities IAM roles, including the ability to impersonate service accounts. This lets you access resources directly and eliminates the maintenance and security burden associated with service account keys. We also offered related overall guidance on the best way to use and authenticate service accounts on Google Cloud.
- VPC-SC Directional Policies – With VPC Service Controls (VPC-SC), admins can define a security perimeter around Google-managed services to control communication to and between those services. Using VPC-SC, you can isolate your production GCP resources from unauthorized VPC networks or the internet. But what if you need to transfer data between isolated environments that you’ve set up? VPC-SC directional policies is a new secure data exchange feature that allows you to configure efficient, private, and secure data exchange between isolated environments.
- Anthos service mesh supports VMs as well as clusters – Most enterprise compute resources are still in VMs and many will remain there for a long time to come. In Anthos 1.7, your VM-based workloads can now take advantage of the same mesh functionality as your container-based workloads.
- Cloud Spanner CMEK and Access Approvals – Cloud Spanner is Google Cloud’s fully managed relational database that offers unlimited scale, high performance, strong consistency across regions and high availability. Spanner now supports customer-managed encryption keys (CMEK) and Access Approval, Google Cloud’s industry-leading controls to require approval before access to your content by Google support and engineering teams.
- External Key Manager enhancements – In early 2020 we launched Cloud External Key Manager (Cloud EKM), the industry’s leading Hold-Your-Own-Key (HYOK) product. Using Cloud EKM, the keys used to protect your data stored and processed in Google Cloud are completely hosted and managed outside of Google Cloud infrastructure. Cloud EKM initially launched with support for BigQuery and GCE/PD; we expanded support for Cloud SQL, GKE, Dataflow Shuffle, and Secret Manager, with CMEK support currently in beta. We also provided in-depth documentation on the functionality, architecture and use cases for Cloud EKM in a new whitepaper.
- Web App and API Protection solution – Web applications and public APIs are increasingly important to how organizations interface with their customers and partners, and we’ve seen increased investment in tools to protect these resources from fraud and abuse. Google Cloud’s new Web App and API protection solution is based on the same technology Google uses to protect its public-facing services against web application exploits, DDoS attacks, fraudulent bot activity, and API targeted threats. It provides protection across clouds and on-premises environments.
- Threat Intel for Chronicle – Most threat intelligence feeds require security teams to do the implementation and legwork. With our new Threat Intel for Chronicle offering, however, our intelligence insights are applied automatically across your security telemetry to present unique observations within your environment. Threat Intel for Chronicle is exclusively curated for enterprise customers by Uppercase, Google Cloud’s intelligence research and applications team to provide our perspective on threats across the internet and surface them as relevant alerts.
That wraps up another month of thoughts and highlights. If you’d like to have this Cloud CISO Perspectives post delivered every month to your inbox, click here to sign-up, and we’ll see you in June!
How to Get Your Cloud Migration Journey Started Off on the Right Foot

3603
Of your peers have already read this article.
2:30 Minutes
The most insightful time you'll spend today!
When moving to the cloud, many organizations concentrate their focus on the change in technology, and overlook an area just as complex: cultural change.
At Google, we’ve spent years nurturing our culture and workforce to best operate in the cloud, and the Google Cloud Professional Services team leverages the lessons we’ve learned for the benefit of enterprise customers embarking on their own cloud journeys.
While it can be tempting to believe in a universally ‘correct’ strategy for change management, there is no one-size-fits-all answer. Every organization will have its own unique considerations. But with that said, there are some core strategies we’ve found to be relevant and useful across a broad range of businesses.
1. Define your purpose for moving to Cloud
While pockets of cloud use and experimentation can evolve independently and in parallel across an organization, it’s important to make some deliberate decisions before starting a larger migration. At this stage, we recommend having a detailed answer to two key questions to ensure a successful cloud migration:
- Where do you want to go? (Or “What’s your cloud vision?”)
- How do you plan to get there?
Start by having a conversation with leaders and those who will be key to the journey about how far you want to push your cloud vision. This alignment ensures everyone is on the same page—and will provide greater direction, allowing more deliberate action.
2. Find the change path which is right for you
Whether a ‘lift and shift’ approach to the cloud is right for you, or a more transformative approach with a lot of re-architecting—the most important thing is to find the flavor of change which is appropriate to your context and level of ambition.This will both shape your key migration activities, but also the level of impact to be managed within your organization.
There are many ways to embark on a change journey for cloud migration (which one can find in the chart below). It is important to deeply understand the needs of your business and its people and determine what strategy makes the most sense.

3. Learn from best practices
Based on the lessons we’ve learned along our own journey, and the work we’ve done with customers, there are a number of recommendations we can share that can make a cloud migration more successful. We go into these in more detail in our new whitepaper, but below you can find the ones we think are most relevant:
- Share the vision—and measure, measure, measure. Once you’ve crystallised your cloud vision with leadership and key stakeholders, share that vision widely. Set success goals and communicate them to hold yourself accountable.
- Be clear about the capabilities you will need in the future—and where you’ll get them. For example, if your vision is to become a cloud-first, data and AI-led organization, ensuring you have the right data science skills and machine learning capabilities in your organization to achieve that vision becomes a critical step—be they home-grown or bought-in.
- Find the right balance between capabilities that should be under central control, and capabilities that should be decentralized, or agile. For example, should machine learning be something that sits centrally, or should it be spread across your organization? For every business, the solution will be a little different, and there’s no “one true answer.” There’ll be lots of different opinions about this, so the sooner the conversation starts, the better.
- Start thinking about the needed tech and non-tech skills now, and how you’ll fill the gaps. Building the tech skills will take time, and not everyone will feel comfortable with the future picture of collaboration, innovation, and agility.
To help businesses navigate their own cloud journeys, Google Cloud Professional Services has released a new whitepaper that can help guide organizations. “Managing Change in the Cloud” is closely aligned with the Google Cloud Adoption Framework and is a practical guide for organizations looking to maintain momentum in their cloud adoption. You can download the whitepaper here.
Trading and Investment Companies will Increase Consumption of Cloud Services: Study Confirms

4887
Of your peers have already read this article.
3:00 Minutes
The most insightful time you'll spend today!
While some traditional financial services companies have more slowly transitioned to the cloud, capital markets firms have embraced cloud computing across their entire value chains — front-, middle-, and back-office. We wanted to understand the dynamics behind this rapid adoption, the most common use cases, and the types of technology most in use, particularly as it relates to market data. Google Cloud commissioned Coalition Greenwich to survey 102 institutional capital markets professionals — at exchanges, trading systems, data aggregators, data producers, asset managers, hedge funds, and investment banks — in the United States, Canada, France, Germany, Italy, the Netherlands, Switzerland, and the United Kingdom.
Our research found that while there are many drivers, demand for easier accessibility is fueling widespread adoption of cloud-based market data services, and associated trading infrastructures, across the buy side and sell side. In fact, 68% of sell-side and buy-side users find it critical for market data providers to offer public cloud-based data services. At the same time, exchanges, market data providers, aggregators, and trading systems are embracing the cloud as a delivery model by offering access to data directly via their own cloud services, APIs or partners.
Here were five noteworthy takeaways from the study:
1. Cloud services are becoming ubiquitous for data delivery. Today, the cloud is pervasive, with 93% of exchanges, trading systems and data providers offering cloud-based data and services, according to surveyed executives. Moreover, 100% of those surveyed intend to offer new cloud-based services, such as derived data, in the next 12 months.

2. Commercial and investment banks are offering additional connectivity, real-time data feeds, and trading applications delivered via the cloud,demonstrating that it’s not only exchanges, trading systems, and data providers that are moving rapidly to the cloud. Internal use cases abound as well, with 67% of those surveyed consuming cloud-deployed market data, primarily for data analytics. 88% of surveyed sell-side firms intend to consume cloud-based market data services, with digital transformation, data science and quant research as the top use cases.

3. Buy side firms will consume even more cloud-deployed data. Today, 90% of surveyed buy-side firms are consuming cloud-deployed market data, mostly for portfolio management. 70% of buy-side firms intend to consume more public cloud-based market data services in the next 12 months, adding services such as compliance and regulatory reporting.

4. AI/ML, powered by cloud, is moving out of the pilot phase and into mainstream use. Today, 50% of exchanges, trading systems, and data providers are offering data products or services powered by AI/ML, and of those, 42% intend to offer AI-powered trade execution and trading analytics services in the next 12 months. Within commercial and investment banks, 55% said they are currently using AI/ML in the cloud, and while that was true for only 14% of overall buy-side respondents, 44% of large buy-side respondents are using it.

5. Exchanges, trading systems, and data providers are prioritizing public cloud for internal insights. 71% of these firms are using the public cloud, mostly for data transmission, processing, analysis, and long-term data storage. Over the next 12 months, 33% of new public cloud workloads will focus on data mining, data insights and advanced analytics, while 28% of new AI/ML tooling and infrastructure investments will focus on faster analytics and risk reviews, and 27% on data quality maintenance.

“We see new, dramatic shifts on the adoption of cloud across market data,” said David Easthope, Senior Analyst for Coalition Greenwich. “And we expect further proliferation of cloud-based services and greater consumption across the trading and investing lifecycle.”
Conclusions and future predictions
Based on the survey results, Coalition Greenwich predicts five following trends over the next 12 months:
- Exchanges and trading systems will continue to launch a wide array of new cloud-based and possibly cloud exclusive data services across derived data, end of day data, reference data and pricing data.
- Data providers will launch new data products such as pre-trade analytics powered by AI/ML in the cloud.
- Commercial and investment banks will offer additional connectivity, real-time data feeds, and trading applications delivered via the cloud.
- Buy-side firms will consume even more cloud-deployed data, including real-time market data, portfolio management data, and risk analytics.
- Exchanges, trading systems and data providers will explore proof-of-concepts around core systems on the cloud. Improvements to AI/ML tooling or infrastructure will ramp up as firms seek more rapid responses to risk initiatives.
To learn more about these findings, download our two full reports, The Future of market data: Distribution and consumption through cloud and AI and Exchanges and data providers: Prioritizing the cloud and AI for internal insights or our short infographic.
Research methodology
The survey was conducted online by Coalition Greenwich on behalf of Google Cloud from March 2021 to April 2021 among 102 executives in North America (n=82), EMEA (n=17) and other (n=3) who are employed full-time and who are participants or influencers in decisions around cloud and/or senior management with a role at a company which is an institutional asset manager, hedge fund, alternative investment manager, exchange and/or trading system, information provider, information aggregator, or other asset manager/asset owner. The survey included wide perspectives from a range of firm size and asset class focus, including equity, fixed income, FX, commodities, multi-asset, and other asset classes.
Foot Notes
1. We defined market data as direct feeds, consolidated feeds, terminal and desktop products, security and reference data, pricing data, historical data, alternative data, and index data.
2022 is a Big Year for the Gaming Industry!

3858
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
Editor’s note: This post was originally published in TechPulse Belgium, where Jack Buser, Google Cloud’s Director of Game Industry Solutions, shared his trends for the industry this year.
The year 2022 will hold many surprises (with a few already dropping!), but there’s one near certainty: By this time next year there will be millions more gamers worldwide. It’s thanks to the industry’s little-noted technology growth drivers, which are getting stronger.
Games are no longer a niche hobby; it’s global, mainstream entertainment. There were 3.1 billion gamers worldwide in 2020. It’s estimated that by 2024 there will be another 500 million. With a global population of 7.7 billion, that’s nearly half the planet. Revenues in 2021 may reach $175 billion—likely more than movies, music, and books combined.
It’s a strength unique to the games industry, driven by the way its creators deploy new technology. Advances we see in everything from pricing and emerging markets, to backend computing and delivery suggests it will grow from here, on things like artificial intelligence and planet-scale networks.
Games forever, game better
It’s no surprise that videogames have become a huge business. Playing games is one of our deepest human expressions. There is a 4,500 year old board game that people still play, a testimony to the human love of testing cleverness, honing reactions, building trust, or just enlivening a day.
Video games do all that and for decades game makers have taken the most cutting-edge computing tech to make things better. We’ve seen electronic ping pong become shooting asteroids, to simple (yet iconic) 2D sprites evolve into believable, expressive 3D characters, all leading to today’s immersive worlds hosting tens of millions of players worldwide.
There’s more to come. I work at technology’s cutting edge for games, offering the world’s leading game creators access to powerful cloud computing, a low-latency global network, Machine Learning and AI, and much more. As usual, game innovators are taking up all these tools, building new narratives, new ways to play, new markets, and new jaw-dropping moments.
And game creators aren’t just thinking about players; they’re also thinking about viewers. More and more people are watching eSports, and creators are using the games medium to engage their viewers in increasingly immersive ways.
Streaming like never before
AI and ML are sharpening games and attracting new players in other ways. These technologies increasingly power everything from network performance to global player matching. The delicate but essential work of encouraging newcomers and discouraging bad actors, optimizing monetization, or building and scaling up new player environments.
Another important area we’re seeing cloud tools being put to use is in coordinating the workflows of global teams of developers. It’s not just a question of building faster anymore, but of collaborating and responding more effectively. The distributed work trends that featured so strongly during the pandemic had already featured in much of the game industry, increasingly it’s an industry standard. This will likely mean even faster and more diverse game development, addressing the needs of new markets where we’re seeing double-digit growth.
Tools like cloud streaming, 5G, and edge computing are likely to accelerate the use of Game Streaming, Augmented Reality, and other types of immersive gameplay. If my metaverse doesn’t have games, count me out! We’re looking at some exciting new developments in coming months with some major industry players. Stay tuned.
A big year for the games industry
As a premier provider of solutions, tools and services to games companies, our engineering job is complex and global. Fortunately, our mission is simple: Help game companies transform to meet new global opportunities with planet scale solutions. Technology has brought the gaming industry to astonishing heights, and is the perfect compliment to great storytelling and creative ingenuity.
As a decades-long industry veteran, I’ve never been more impressed with what technology can do for our industry. Looking past 2022, when we’ll see more compute, more AI, more AR, and more innovation around healthy and exciting game play, there is just one near certainty: More growth.

3362
Of your peers have already downloaded this article
3:30 Minutes
The most insightful time you'll spend today!
The need for agility and flexibility in the face of accelerating innovation and disruptions from competitors is the primary driver for cloud adoption across businesses both big and small. However, simply moving and shifting legacy system to the cloud does not sufficiently meet enterprise needs.
The systems and applications running in production environment that are built with a monolithic architecture are often not the best fit for complex cloud-based systems and are holding the companies back from realizing their goals.
What is needed is a cloud-native approach with microservices that helps in migrating a working monolithic system and transform it for the cloud world to derive the true business benefits that organizations truly desire.
Download this whitepaper and understand why a different architecture is needed to maximize the cloud investments and how this new architecture is better suited for the cloud.

The Cloud-First Imperative to Accelerate Digital Transformation in BFSI
DOWNLOAD WHITEPAPER3382
Of your peers have already downloaded this article
1:30 Minutes
The most insightful time you'll spend today!
In a study of 60 business and technology decision makers and influencers from Indian BFSI organizations, conducted by Forrester Consulting, it is revealed that public cloud adoption in India is on the rise with 78% of the organizations intending to increase the number of secure or compliance-sensitive workloads in the cloud.
According to the study, public cloud platforms help BFSI organizations to:
- Improve customer experience
- Free up IT time to focus on core differentiators instead of commodity workloads
- Reduce reliance on legacy infrastructure
- Help to scale business faster and more easily
Download this infographic to understand why Indian BFSI organizations are adopting a cloud-first approach to accelerate digital transformation.
More Relevant Stories for Your Company

The Tech Tightrope: How the U.S. State & Local Agencies Strive to Balance between Innovation and Budget
State and local government (SLG) agencies are reeling from a combination of unbudgeted COVID-related expenses and reduced tax revenue caused by unemployment and business closures. Any way you look at it, the situation is challenging. To understand how SLG agencies are coping, Google Cloud collaborated with MeriTalk to survey 200

HSBC Looks to Google Cloud to Transform Banking
HSBC, a global bank that is a central part of global commerce with a presence in 67 countries, serving 38 million customers ranging from individuals to small businesses to corporations and governments, and having over $2.5 trillion assets in its balance sheet, had a vision of being a cloud first

Go Green with Google’s Latest Tool and Pick the Most Sustainable Cloud Region
As a Google Cloud customer, your carbon footprint is already carbon neutral: Google first achieved carbon neutrality in 2007, and has been purchasing enough solar and wind energy to match 100% of its global electricity consumption since 2017. Now, Google is targeting a new sustainability goal: operating on carbon-free energy (CFE) 24/7,

Achieving Scale, Intelligence and Speed with Google Cloud VMWare Engine for Retailers
COVID-19 drastically changed the way consumers purchased goods and services, but these changes merely accelerated trends that were well underway. While many retailers were caught off guard with the suddenness of the transition, most are stepping up their cloud transformation initiatives in response to changes in consumer behavior and expectations






