One of the fundamental questions that retailers constantly ask themselves is how well they know their customers and how they can build deeper relationships. Knowing who their customers are can have a direct impact on improving customer engagement, which can lead to increased conversion rates, customer loyalty, lifetime value, and higher return on marketing spend. 

Retailers have started to use innovative new methods like identity graphs, which connect information from multiple sources such as internal databases, marketing systems, online interactions and social media platforms. While these new methods have shown promise, the best and most effective approach remains customer self-identification through an authentication process.

As a result, retailers require a sophisticated user identity platform that protects customer information with proper authentication and authorization, one which incorporates advanced mechanisms like multi-factor authentication and intelligent account protection, to ensure customer information is protected throughout its lifecycle. 

Google Cloud Identity Platform (GCIP) is a customer identity and access management (CIAM) solution that can enable retailers (and any other organization) to add identity and access management capabilities to online applications. GCIP is easy to administer and develop with, and is able to grow with an organization’s online user base.

With a customer identity and access management (CIAM) solution like GCIP, a retailer can quickly and easily implement powerful identity management and security capabilities such as:

• Advanced authentication through email or SMS/text messaging.
• Quicker onboarding with social logins from Google, Facebook and others.
• Flexibility to support external identity providers through identity federation.
• Support for multi-tenant B2B use cases with the ability to create unique silos of users and configurations.
• Easy to use interfaces and libraries to help web/mobile application developers quickly integrate and launch. 
• Broad authentication protocol support, including SAML 2.0, OAuth/OIDC or simple email- and password-based authentication.
• Built on Google Cloud’s planet-scale infrastructure to support a growing customer base.

How does it work?

GCIP allows end users to authenticate to web and mobile applications. For retailers, this could be their online shopping app for mobile devices or an ecommerce website accessible over the internet through a web browser.

Users can sign-in with their email/passwords, phone numbers or using their social logins . If the organization uses an existing OpenID Connect (OIDC) provider, a Security Assertion Markup Language (SAML 2.0) provider or even a custom authentication system which issues signed tokens, Google Cloud Identity platform can be used as the authentication orchestrator.

Using Google Cloud Identity Platform as the primary authentication system

GCIP can serve as the primary authentication system, meaning users are provisioned into GCIP. In this case, the end user identities are securely persisted in the “account store” database. The database is a part of fully managed GCIP services and needs no provisioning or scaling from the retailer as their end user base grows. A high level architectural overview of how this flow may look like is shown below:

Using Google Cloud Identity Platform with social logins

Google Cloud Identity Platform can also be used with popular social logins such as Google, Facebook and others. This gives users a familiar option and eliminates the need to provision users in the GCIP identity store. Below is a high-level architecture diagram showing how GCIP integrates with the social login providers.

Customizing user flows

Many organizations want to be able to customize their login flows. Sometimes, an organization wants to make data related to new user creation and user logins (barring the passwords) available to other systems. These systems can include analytical systems, recommendations or promotions engines (such as sending welcome emails and promotions upon new sign-ups,) security operations (for example, to run analysis on sign-in requests to help detect account takeover attempts,) customer master data management systems, and customer data platforms. GCIP supports blocking functions and asynchronous functions to help customize the login flows and enable syndication of the login or sign-up activity related data to external systems.

Next steps

Google Cloud Identity Platform can provide a robust, scalable, secure-by-design mechanism for managing and authenticating users to online apps. To learn more about GCIP and how it can benefit your organization, please check out the documentation.

Since Aristocrat’s founding in 1953, technology has constantly transformed gaming and the digital demands on our gaming business are a far cry from challenges we faced when we started. As we continue to expand globally, security and compliance are top priorities.

Managing IT security for several gaming subsidiaries and our core business became more complex as we entered into new markets and scaled up our number of users. We needed a centralized platform that could give us full visibility into all of our systems and efficient monitoring capabilities to keep data and applications secure. We also needed the ability to secure our systems without compromising user experiences.

We turned to Google Cloud and Splunk to better manage complexity and support highly efficient, secure, and more dynamic gaming experiences for everyone. We are committed to using today’s modern technologies to give players more optimal experiences.

Bringing our digital footprint into the cloud

When we set out on our digital transformation, we looked to address many business requirements.

These requirements included:

• Regulation: We wanted a platform that could efficiently address our industry’s stringent and global regulatory compliance requirements.
• Player experience: Our IT environment must support smooth gaming experiences to keep users engaged and satisfied.
• Scalability: As we grow and diversify, meeting the changing demands of an increasingly global gaming community, we need an easily scalable platform to align with our current and future needs.

Google Cloud offered us the perfect foundation through solutions such as Compute Engine, Google Kubernetes Engine, BigQuery, and Google Cloud Storage. These acted as the right infrastructure components for us for the following reasons:

• Google Cloud is globally accessible and supports compliance, helping to streamline security and regulatory processes for our team.
• With Google Cloud, we can manage our entire development and delivery processes globally with fast and efficient reconciliation of regional compliance requirements.
• When we need to adjust existing infrastructure or deliver new capabilities, Google Cloud accelerates the process and takes the heavy lifting off of our team.
• Google Cloud allows us to support tens of thousands of players on each of our apps while experiencing minimal downtime and low latency. The importance of this support can’t be underestimated in an industry where players have little to no patience if lags in games occur.

We migrated our back-office IT stack alongside our consumer-facing production applications to Google Cloud given our positive experiences with compliance, security, scalability, and process management. This migration has significantly accelerated our digital transformation while streamlining our infrastructure for faster and more cost-effective performance.

In many ways, Google Cloud has been, with maybe a pun intended, a game-changer for us. For instance, when we suddenly had to support a lot of remote work during the COVID-19 pandemic, native identity and access management tools in Google Cloud allowed us to retire costly VPNs used for backend access and quickly adopt a more easily managed, cost-effective zero-trust security posture.

Accessing vital third-party partners and managed services

Aristocrat has many IT needs best addressed in a multi-cloud environment. Google Cloud is particularly attractive given its strong cloud interoperability, as well as the many products and services available on Google Cloud Marketplace. The marketplace accelerated our deployment of key third-party apps including Splunk and Qualys.

Given the personal information we store and the global regulatory compliance statutes we must oblige, security lies at the heart of our business. Splunk is a critical component of our digital transformation because it offers solutions that provide the enhanced monitoring capabilities and visibility we need. The integration between Splunk and Google Cloud gives us confidence that our data is secure. We know our data can be secure in Google Cloud, while simplified billing through Google Cloud Marketplace makes payments and license tracking easier for our procurement team.

As part of our protected environment, we use the Splunk platform as our security information and event management system, leveraging the InfoSec app for Splunk that provides continuous monitoring and advanced threat detection to significantly improve our security.

We can manipulate and present data in Splunk in a way that provides us with a single pane-of-glass for our hybrid, multi-cloud environment and our third-party apps and systems. Splunk observability tools have likewise helped us to track browser-based applications like our online gaming apps to monitor details related to security and performance.

Splunk and Google Cloud have transformed how we operate. We can now quickly ingest and analyze data at scale within our refined approach to security management by offloading software management to Splunk and Google Cloud. This ability enables us to approach security more strategically, and positions us to integrate more AI/ML capabilities into our products for even greater governance and performance.

This is just the beginning of our journey with Splunk and Google Cloud. We’re excited to see the innovation we can continue bringing to the gaming community worldwide.

In every industry, in every part of the world, cybersecurity concerns continue to grow in the wake of attacks on critical infrastructure and the software supply chain. Governments and businesses of all sizes recognize that they must do more to protect their employees, customers and citizens. 

But doing more of the same, like putting security band-aids on legacy infrastructure, is no longer helpful or productive. We need an enduring commitment, in products, people and monetary terms, to drive meaningful improvements in our collective security posture. Google recently announced a $10 billion investment to advance the security of governments around the world, and by extension, help enterprises and organizations to do the same. 

Over the past year, Google Cloud has been delivering on our vision of Invisible Security for our customers, where capabilities are continuously engineered into both our trusted cloud platform and market-leading products to bring the best of Google’s security to wherever your IT assets are. But being a provider of best-in-class technology is not enough. We want to share our expertise to help organizations with their security transformation and offer even more ways to accelerate these essential improvements. This week, at Google Cloud Next ‘21, we’re sharing the first of what will be many more steps in advancing these efforts.

Introducing our Cybersecurity Action Team

While access to the latest, most advanced security technology is important, the expertise of what it will take to become resilient in the face of today’s risk and threat environment is foundational.  

Today, we’re announcing the formation of the Google Cybersecurity Action Team. The Google Cybersecurity Action Team marshals experts from across Google to form what we believe will be the world’s premier security advisory team. It has a singular mission to support the security and digital transformation of governments, critical infrastructure, enterprises and small businesses.

Building on existing security solutions engineering efforts, today the Google Cybersecurity Action Team announced a security and resilience framework that delivers a roadmap for a comprehensive security management program aligned with the National Institute of Standards and Technology’s Cybersecurity Framework using cloud technologies from Google Cloud and our partners. 

“Google Cloud has been a critical partner in the BBVA security journey, helping us protect our customers’ sensitive and proprietary data with modern frameworks like zero trust and secure-by-default products like Google Workspace,” said Alvaro Garrido, Chief Security Officer at BBVA. “We look forward to the strategic services and guidance the Google Cybersecurity Action Team will deliver as we continue on our security transformation.”

Learn more about the Cybersecurity Action Team here. 

Announcing a safer way to work

Bringing you the expertise and hands-on guidance to help with your security transformation is just one valuable step. We recognize that too many organizations can’t wait any longer to begin their modernization efforts – they need a new baseline, and they need it now. 

That’s why today, we’re announcing the launch of our Google Work Safer offering, designed to help organizations, their employees, and partners collaborate and communicate securely and privately in today’s hybrid work environment. Work Safer provides companies with access to best-in-class security for email, meetings, messages, documents, and more. It uniquely brings together the cloud-native, zero-trust solutions of Google Workspace with BeyondCorp Enterprise for secure access with integrated threat and data protection. For customers who want secure devices, Work Safer includes Pixel phones managed with Android Enterprise, Chrome Enterprise Upgrade, and HP Chromebooks. Customers can also leverage Google’s Titan Security Keys for account protection, reCAPTCHA Enterprise for website fraud prevention, Chronicle for security analytics, and a variety of migration services for a seamless transition.

The program is designed to meet the needs of all organizations, including small businesses, enterprises and public sector institutions, many of which are reliant on legacy technology and often lack expertise to fully address rising security challenges associated with hybrid work. To learn more, visit our Work Safer homepage. 

Advancing our trusted cloud with new security capabilities

Above all, security has been and continues to be the cornerstone of our product strategy. There are three critical areas where Google Cloud’s capabilities can make a meaningful difference for any business’ or government’s digital security transformation:

At Next’ 21, we’re introducing new security products and partnerships that will enable you to:

• Protect your employees with new zero trust access capabilities: We’re delivering new features that expand the surface area for our zero trust access solution, BeyondCorp Enterprise, to cover all your apps – both modern and legacy. The new client connector, now in preview, enables identity and context-aware access to non-web applications running in Google Cloud and non-Google Cloud environments. We are also making it easier for admins to diagnose access failure, triage events, and unblock users with the new Policy Troubleshooter feature. You can learn more about both of these new enhancements in the live BeyondCorp Enterprise demo on October 13.
• Improve your detection and response capabilities: We announced a new collaboration with Cybereason for Extended Detection and Response (XDR) across endpoints, networks, cloud and workspaces. The combination of these capabilities delivers a cloud-native XDR solution, Cybereason XDR powered by Chronicle, that automates prevention for common attacks, guides analysts through security operations and incident response, and enables threat hunting with precision at a pace never before achieved. We are also deepening the integration between Chronicle and Security Command Center (SCC) on GCP. New integrations in preview centralize alerts and investigative workflows across the two platforms, and enable threat-specific pivots by enriching SCC alerts with intelligence on associated threat actors and entities. 
• Automate and bolster protection of your sensitive data: Automatic DLP, now in preview, is a prime example of how we are making Invisible Security a reality. It’s a game-changing capability that discovers and classifies sensitive data for all the BigQuery projects across your entire organization without you needing to do a single thing. We’re also introducing Ubiquitous Data Encryption, a solution which combines our generally available Confidential Computing, External Key Management, and Cloud Storage products to seamlessly encrypt data as it’s sent to the cloud. Using your External Key Management solution, data can now only be decrypted and run in a confidential VM environment, greatly limiting potential exposure.
• Protect your IP and implement a zero trust software supply chain: Today, we’re building on our zero trust software supply chain with new launches. Cloud Build is SLSA Level -1 compliant by default, with scripted builds and available provenance. With the new Build Integrity feature, Cloud Build automatically generates a verifiable build manifest that includes a signed certificate describing the sources that went into the build, the hashes of artifacts used, and other parameters. Additionally, Binary Authorization’s integration with Cloud Build makes it easy to set up deploy-time constraints. You can also now easily pair Binary Authorization with Cloud Run to ensure only trusted images make it to production. These integrations are now generally available.
• Protect your users and brand: We recently announced the preview of Cloud Armor Bot Management, which integrates Cloud Armor and reCAPTCHA Enterprise. You can enable protection without any server-side changes to your applications, and because detection and enforcement happens in-line, at the edge of Google’s network, you can mitigate threats before they have a chance to impact your applications, whether they run on GCP, on premise, or in a hybrid or multicloud deployment.
• Ensure secure collaboration: Today, Google Workspace is also introducing new security features. Client-side encryption for Google Meet, in beta, gives customers direct control of encryption keys and the identity service used to access keys. Data Loss Prevention (DLP) for Google Chat, in beta, helps prevent sensitive information from leaking outside of your organization. Check out the blog post from Google Workspace to learn more. 

As we head into three days of great content and engagements from our security and technology teams across Google Cloud at Next ‘21, we want to leave you with this: You are not alone on your security journey. Our goal is to ensure that every day, you are making your organization safer because you have partnered with us. Please make sure to watch our security experts, customers, and partners in our track sessions to go deep on the topics and products that matter most to you.

Content production is increasingly happening in the cloud. While moving a creative process that spans three centuries into the modern era brings challenges and risks, MovieLabs is one organization that takes digital transformation seriously.

A nonprofit research and development group founded by a consortium of the major Hollywood studios, MovieLabs describes their mission as “exploring innovative solutions to industry challenges shared by both our member studios and the broader production, post-production and distribution ecosystem.”

In more than 50 pages of densely-packed ideas and principles, MovieLab’s The Evolution of Media Production lays out an ambitious and revelatory vision for streamlining media production in the cloud. The key themes are summarized in 10 declarative statements, which envision a new modality for media production by the year 2030:

1. All assets are created or ingested straight into the cloud and do not need to be moved.
2. Applications come to the media.
3. Propagation and distribution of assets is a “publish” function.
4. Archives are deep libraries with access policies matching speed, availability and security to the economics of the cloud.
5. Preservation of digital assets includes the future means to access them and edit them.
6. Every individual on a project is identified and verified, and their access permissions are efficiently and consistently managed.
7. All media creation happens in a highly secure environment that adapts rapidly to changing threats.
8. Individual media elements are referenced, accessed, tracked and interrelated using a universal linking system.
9. Media workflows are non-destructive and dynamically created using common interfaces, underlying data formats and metadata.
10. Workflows are designed around real-time iteration and feedback.

The four bolded statements above are further explored in a follow-up whitepaper from MovieLabs, The Evolution of Production Security, which likewise offers six statements about what secure production in the cloud should look like:

1. Security is Intrinsic and does not Inhibit Creative Processes
2. The Security Architecture Addresses Challenges Specific to Cloud Workflows
3. Production Workflows, Processes, and Assets are Secure, even on Untrusted Infrastructure
4. The Content Owner Controls Security and Workflow Integrity
5. The Security Can Be Scaled to Appropriate Levels and Can Integrate
6. The Security Architecture Limits the Spread of any Breach and is Adaptable

The key to understanding these two papers is repeated in their titles: Evolution. Neither document is meant to outline solely what’s possible today; rather they are beacons guiding us toward a future in which the movie business is truly transformed by the cloud operating model. That means a future where media productions run much more like software supply chains: with speed, agility, and scale, and without sacrificing availability or security.

The good news is that it is possible to deploy secure production workloads in the cloud today. Using some of the built-in security features of Google Cloud, content producers can achieve Common Security Architecture for Production (CSAP) “Level 100” security for their assets (using the CSAP scale L100-L300). 

However, we think that “evolution” word is important. As many companies have learned, operating an infrastructure cloud can be costly and often presents new threat vectors for attackers. Our mission at Google Cloud is to provide scalable, reliable services for traditional IT functions and to accelerate the abilities of every organization to digitally transform its business. 

We believe the era of the transformation cloud is dawning, and companies who have been successfully operating in the cloud for years are now looking for ways to reduce costs while maintaining the cloud-scale advantages of agility and global reach. This aligns perfectly with the evolutionary vision of the MovieLabs papers, which envision media workflows changing radically to embrace cloud dynamism without all the unnecessary asset movement and complexity.

An important part of that vision from Google Cloud is that cloud service providers should remain open and interoperable with other clouds and infrastructures.

Here is a quickstart guide to mapping the L100 CSAP requirements to Google Cloud:

As you can see in the diagram, external identity providers (IdPs) such as Okta or Active Directory can serve as core security components of a CSAP L100 architecture. Alternatively, Google Cloud services such as Cloud Identity or Managed AD could be substituted.

Next, Google Cloud’s Identity-Aware Proxy (IAP) can be used in combination with Access Context Manager (ACM) to act as the first Policy Enforcement Point. This is an optional step, since it is somewhat redundant with the routing and authorization function performed by the native HP/Teradici Connection Brokers. However, IAP and ACM are core components of Google Cloud’s BeyondCorp architecture, on which CSAP is based. Additionally, adopting IAP with ACM offers productions the ability to swap out the Teradici PCoIP protocol for an alternative, such as Unity’s Parsec, without sacrificing security.

The Teradici Connection Broker is also a Policy Enforcement Point, since groups and role membership can be used to enforce access to specific workstations. 

Finally, the identity context for each user is passed through to the storage layer. For some productions, Google Cloud Storage (GCS) buckets may offer enough functionality; GCS offers an S3-compatible API which should make it easy to immediately adopt OSS tools built for S3. Other options for this include the managed NetApp Cloud Volumes and Dell PowerScale for Google Cloud services. Both of these are managed shared storage services which offer file-level access controls using standard SMB/NFS permissions. There are also a variety of third-party filers available in the Google Cloud Marketplace, such as Nasuni. You can read more about those here.

For added security, both NetApp and PowerScale should be configured to use the private services access model in Google Cloud. This effectively limits any external access to these resources by only allowing traffic from user-managed VPCs into the Google-managed and peered VPC.

Following this architecture, you can see how to achieve CSAP L100 compliance by using either only Google Cloud services or a mix of managed and cloud-first services. In either scenario, access is managed through a unified control plane and based on both user identity and role. Zero Trust principles such as context-aware access and dynamic rulesets could further be applied to the Authentication step using either Google Cloud IAP or the equivalent services from Okta, Active Directory, or others.

At this weekend’s National Association of Broadcasters conference, Google experts will be talking about the cloud and content production, and the intersection of AI and media. The journey to 2030 is only just beginning.