Meeting the rapidly growing demands of our customers’ high performance computing and data-intensive workloads requires deep innovation — at Google Cloud, we know we can’t rely on ever-faster CPUs alone, like Moore’s Law has enabled in the past. Customers can either optimize their workloads for a given platform, or we can offer them a platform that is optimized for their specific needs. At Google Cloud, we choose the latter.

Today, we have an exciting new release resulting from these efforts: the new C3 machine series powered by the 4th Gen Intel Xeon Scalable processor and Google’s custom Intel Infrastructure Processing Unit (IPU). Along with the recently announced Hyperdisk block storage which offers 80% higher IOPS per vCPU for high-end database management system (DBMS) workloads when compared to other hyperscalers. C3 machine instances can deliver strong performance gains to enable high performance computing and data-intensive workloads. Customers such as Snap, for example, have seen approximately a 20% increase in performance for a key workload over the previous generation C2.

The C3 machine series is just the latest example of this architectural approach. For over two decades, Google has purpose-built and designed some of the world’s most efficient and scalable computing systems to meet the needs of our customers. We built the Tensor Processing Unit (TPU) to power real-time voice search, photo object recognition, and interactive language translation; unveiled Titan, a secure, low-power microcontroller to help ensure that every machine boots from a trusted state; and launched Video Coding Units (VCUs) to enable video distribution that addresses a range of formats and client requirements. We engineer golden paths from silicon to the console, using a combination of purpose-built infrastructure, prescriptive architectures, and an open ecosystem to deliver what we term workload-optimized infrastructure.

Getting to know the C3 machine series

The Compute Engine C3 machine series, now available in Private Preview, is the first VM in the public cloud with the 4th Gen Intel Xeon Scalable processor and with Google’s custom Intel IPU. C3 machine instances use offload hardware for more predictable and efficient compute, high-performance storage, and a programmable packet processing capability for low latency and accelerated, secure networking.

“We are pleased to have co-designed the first ASIC Infrastructure Processing Unit with Google Cloud, which has now launched in the new C3 machine series. A first of its kind in any public cloud, C3 VMs will run workloads on 4th Gen Intel Xeon Scalable processors while they free up programmable packet processing to the IPUs securely at line rates of 200Gb/s. This Intel and Google collaboration enables customers through infrastructure that is more secure, flexible, and performant.” – Nick McKeown, Senior Vice President, Intel Fellow and General Manager of Network and Edge Group

The System on a Chip hardware architecture introduced in C3 VMs can enable better security, isolation, and performance. In the future, this purpose-built architecture will also allow us to offer a richer product portfolio, such as support for native bare-metal instances.

Hyperdisk block storage and 200 Gbps networking

Block storage and VMs go hand in hand. Last month, we announced the Preview release of Hyperdisk, our next-generation block storage. The new architecture decouples compute instance sizing from storage performance to deliver 80% higher IOPS per vCPU than other leading hyperscale cloud provider. And compared with the previous generation C2, C3 VMs with Hyperdisk deliver 4x higher throughput and 10x higher IOPS. Now, you don’t have to choose expensive, larger compute instances just to get the storage performance you need for data workloads such as Hadoop and Microsoft SQL Server.

To enable high performance computing workloads, C3 VMs also feature 200 Gbps low-latency networking powered by our custom IPU, as well as line-rate encryption using the open source PSP protocol.

What our customers and partners are saying

“We were pleased to observe a 20% increase in performance over the current generation C2 VMs from Google Cloud in testing with one of our key workloads. These continued performance improvements enable better end user experience and application cost efficiency.” – Aaron Sheldon, Sr. Software Engineer, Snap Inc.

“Based on the initial performance data, running weather research and forecasting (WRF) on C3 clusters can deliver as much as 10x quicker time to results for about the same computational cost. This will significantly accelerate R&D for our customers in weather, environment, and engineering domains.” — Michael Wilde, CEO, Parallel Works Inc.

“In early testing with our flagship products, including Ansys Fluent, Mechanical and LS-DYNA, on the new Google Cloud C3 VM, we’re seeing up to 3x performance gains over C2 VMs due to higher memory bandwidth and lower network latency.” – Shane Emswiler, Senior Vice President of Products, Ansys

Where we are headed

With the exponential rise in the complexity of cloud infrastructure, we as an industry must turn to automation to manage these platforms efficiently at scale. Along with Infrastructure as Code, custom chips like the Titan, the TPU and the IPU, pave the way for a not-so-distant future where we’ll automate over half of all infrastructure decisions, configuring systems dynamically in response to usage patterns. At Google Cloud, we are committed to continuing our long history of hardware innovation with a focus on workload optimization and automation.

To learn more about C3 VMs and Hyperdisk, check out our session at NEXT ‘22, How Google Cloud optimizes infrastructure for your workloads. To request access to the C3 VMs or Hyperdisk, please reach out to your sales representative or account manager.

Enterprises today have a very broad mix of networks — from SD-WANs, dedicated WANs such as MPLS, cloud interconnects, to VPNs. At the same time, they’re moving those WANs to the cloud to take advantage of faster turn-up, lower cost, and increased feature velocity. As workloads migrate to the cloud and multi-cloud environments, we believe that it’s critical to simplify enterprises’ networking model.

Each major cloud provider uses distinct abstraction models to configure networks or connections between your resources. Some use gateways, some use connections or links. Network Connectivity Center, launched last year, provides a simple management solution for your network connection, and is now Generally Available.

In this post, we outline the typical connectivity use cases for customers to help you select and set up the best connectivity option for your environment.

Understanding cloud network connectivity

Cloud networking refers to the ability to connect two resources together inside a cloud, across clouds and with on-premises data centers. A cloud provider needs to provide three main types of connectivity:

• Site-to-cloud – Between on-premises equipment and cloud resources
• Site-to-site – To connect on-premises resources together
• VPC-to-VPC – Connectivity between cloud resources
• Let’s take a look at each one.

Site-to-cloud connectivity

Site-to-cloud connectivity traditionally is done via a cloud interconnect or a cloud VPN. The automatic exchange of routes between on-premises and multiple VPCs can be done using a transit VPC.

A newer approach is to add cloud providers into an SD-WAN mesh using a router virtual appliance in Google Cloud. Network Connectivity Center brings the capacity to synchronize the appliance routes dynamically via BGP to Cloud Router and hence their VPCs. It enables connectivity between on-premises data centers and branch offices and their cloud workloads via SD-WAN-enabled connectivity. This capability is available globally across all 29+ Google Cloud regions. Several of our partners also support this capability in their router appliances.

Site-to-site connectivity

Site-to-site connectivity enables network connectivity directly between two or more hybrid connection points (VPN, Interconnect or SD-WAN). Network Connectivity Center simplifies this model by automating the routing announcements in this environment, such that all sites connected to a single global Network Connectivity Center hub are able to communicate freely in any-any fashion. You can see an example of this for a specific market vertical use case in a recent blog, Voice trading in the cloud — digital transformation of private wires.

VPC-to-VPC connectivity

You can create a full or partial mesh of VPC connections using multiple technologies, with VPC peering being the most common. VPC peering provides highly performant, low latency, private connectivity for customer networks connected via hybrid connectivity and Network Connectivity Center to multiple VPCs containing workloads, which can be segmented via granular firewall policies as needed. Alternatively, you can use a transit VPC model to connect multiple VPCs together in a hub and spoke topology.

With tight integration with third-party router appliances as mentioned earlier, you can also leverage their third-party supported solutions such as next-generation firewalls to connect your VPCs together to meet specific compliance and segmentation requirements. Network Connectivity Center allows you to synchronize the routing tables of these appliances with your VPC’s routing table, simplifying the process of setting up redundant configurations.

What’s next for cloud networking connectivity in Google Cloud?

As enterprises continue to migrate different types of workloads to public cloud providers, networking topologies are becoming more complex. In summary, we have solutions for all connectivity needs. We aim to keep our models and solutions understandable and simple. Over time, look for Network Connectivity Center to become Google Cloud’s single point of configuration for all your connectivity needs, with capabilities to handle the most complex network.

About DB Corp

DB Corp is India’s largest newspaper publisher delivering 62 editions in four languages and selling about 62 million copies per day. The business also has an extensive online and mobile presence.

Industries: Media & Entertainment

Location: India

Headquartered in Bhopal, India, and listed on the Bombay Stock Exchange, DB Corp is India’s largest newspaper group. DB Corp publishes 62 editions in four languages and sells about 6 million newspaper copies per day. Beyond newspapers, DB Corp operates 29 radio stations, 13 portals and two mobile apps.

Like the media industry in general, DB Corp is having to adapt to readers’ increasing preference for accessing news content online – particularly on mobile devices. However, online advertising is yet to fill the gap left by the leakage of advertising revenues from print. Further disruption occurred when the Indian Government’s implemented a demonetization program in November 2016 that prompted a sharp surge in e-commerce transactions and online banking.

Facing a tsunami of change, DB Corp is developing and executing new strategies to engage consumers and build revenues. These plans include evolving from an IT-supported business to an IT enabled company, and finally to an IT-led business that complements its newspapers with online news and updates throughout the day. DB Corp is building e-commerce properties that leverage its print brands and is moving to increase advertising across its mobile services. Furthermore, the business is looking to capture information about readers and customers to tailor its publications and services more closely to their needs.

Expertise in managing large data volumes behind GCP selection

However, DB Corp’s on-premises infrastructure and traditional applications could not deliver the flexibility and agility needed to support the transition to real-time news delivery. In late 2015, DB Corp started evaluating public and private cloud services, including cloud-based application suites and platform as a service offerings. This process led the business to deploy G-Suite and start working with Google Cloud Platform (GCP). “We selected GCP due to Google’s experience in delivering cloud services, and because nobody else manages data volumes of the magnitude that they do,” says R D Bhatnagar, Chief Technology Officer, DB Corp. “We were also impressed by the fact GCP had a local team with the skills and expertise to educate us about how best to use its products.”

DB Corp is migrating its websites and key applications to GCP. The business is also upgrading its network to remove bandwidth restrictions that could impede the value provided by GCP services. The scale and scope of DB Corp’s G Suite and GCP projects has required the business to engage four partners and access technical expertise and support from Google itself. Technical and business experts from the platform as a service provider are providing monthly updates and training sessions with various groups within the organisation, including user communities and the board of directors.

The Google projects at DB Corp are driving a sharp increase in the speed, agility and performance of the business. “As a senior leader within the organisation, I see the key benefits of GCP and other technologies being lower cost; greater efficiency; and improved business continuity,” says Bhatnagar. “For example, the current data center team can be redeployed to other initiatives as the technical experts at GCP will be undertaking most of the management and maintenance tasks.

DB Corp is already making business and financial performance data available in real time from a single source, enabling business teams to make sound, consistent decisions about digital strategies and other key activities. These teams may also address issues or problems before they compromise the quality of content and services provided to consumers.

Deploying Chrome for Meetings across various offices has enabled teams to communicate and collaborate effectively in real time, breaking down geographic barriers, ensuring each member is on the same page and ensuring the business transformation proceeds smoothly. Sales teams are using Google Forms and Google Sheets to centralize and control tasks such as sales forecasting, reducing the time required to complete reports and updates from up to a week to two hours.

Furthermore, various teams are using calendars to improve organization and productivity. For example, editorial teams are using calendars to track Indian holidays and festivals and deliver relevant content to readers. Reporters are also using Google Cloud Speech API and Google Cloud Translation API services to capture and document interviews and source material for articles at accuracy rates of 95 percent for Hindi alone.

May is a big month for the security industry. It’s been over a year since we gathered for RSA in San Francisco for one of 2020’s last major in-person events. While we likely won’t be together in person this year, it’s an important time for the security community to come together and reflect on many accomplishments, and to consider the challenges still ahead of us. As the world focuses on security incidents and all the risks that still need resolving, it is important to stand back, on occasion, and also note that immense progress has been made by large numbers of small, medium and large enterprises to protect themselves and their customers against increased threats. What is also amazing is to see organizations do this while accelerating their digital transformations, supporting and protecting customers and managing ongoing remote working challenges. We are privileged to play our part in supporting those great teams. 

It’s also been a busy month for us here at Google Cloud since our inaugural CISO perspectives blog post in April. Today, I’ll recap our cloud security and industry highlights, a sneak peak of what’s ahead from Google at RSA and more. 

Thoughts from around the industry 

• Risk Governance of Digital Transformation in the Cloud – In our latest Office of the CISO whitepaper, we shared guidance on both the challenges and opportunities of cloud transformation for Chief Risk Officers, Chief Compliance Officers, Heads of Internal Audit and their teams. A misconception we sometimes see among these executives is that moving to the cloud creates more risk to manage. Having held these leadership positions in previous roles, I believe that the cloud is as much a means of managing security, resilience and other risks as it is a risk in its own right. The whitepaper dives deep into considerations for each of these leadership functions as their organization embarks on a digital transformation journey. 
• The importance of meeting global compliance requirements – Compliance is critical for building trust with customers in regulated industries, especially the public sector. It is worth remembering that in any critical industry, where there can be material impact from incidents, strong industry practices and standards to protect customers are vital (I wrote about this last summer). At Google Cloud, we’re regularly adding new compliance and security certifications to meet our customers’ needs globally. Recently, we expanded our list of FedRAMP High-certified products to include Cloud DNS, and helped our customers in the Asia-Pacific region address various compliance requirements to meet new government regulations for security and data protections. Google Cloud was also the only cloud service provider to complete an annual pooled audit with the Collaborative Cloud Audit Group (CCAG), which is a syndicate of 39 leading European financial institutions and insurance companies who depend on cloud infrastructure and technologies to deliver innovative solutions and experiences for their customers. Having spent most of my career in the financial services industry, I know firsthand the importance of managing risk assessments for outsourced vendors to provide the necessary assurances customers need from their cloud providers. 

RSA 2021 

We have a great lineup of speaking sessions and keynotes from Googlers at RSA this year. Below are the highlights you don’t want to miss: 

• I’ll be doing a session on May 20 about supply chain resilience, where a panel of experts will dive into how we can adjust risk and security initiatives to handle the next “punch to the supply chain.” Additionally, on May 18 I’ll join many of my esteemed CISO leaders from various industries and governments for a keynote discussion on our top security insights, lessons learned and best practices for how we move forward as an industry to address the next wave of challenges. 
• Google’s Senior Director of Information Security Heather Adkins will deliver a session on how to build secure and reliable systems at scale, which will cover principles from Google’s Site Reliability Engineering book with the same title (available for free download here). I’m most looking forward to Heather’s advice for how we as an industry can reshape our security thinking, based on modern architectures and technologies that can help organizations design scalable and reliable systems that are fundamentally secure.
• Nelly Porter, Senior Product Manager at Google Cloud Security, will participate in a panel discussion with security experts on the importance of Confidential Computing technology, how it’s changing the security landscape and where it’s headed. Google Cloud has made great progress in delivering a Confidential Computing portfolio for our customers in regulated industries over the past year, and we’re excited for new milestones in 2021. 

Google cloud security highlights

• Infrastructure and SRE spotlight – Before I joined Google Cloud, I always admired the infrastructure and benefits this organization delivers that are uniquely Google – from the subsea cable innovations to SRE inventions and principles. Security and resiliency are baked into every layer of our infrastructure. Many of the Googlers who build and support our platform have sat in the same seat as our customers, so they understand those needs intimately. Over the last few months it’s been amazing to watch our technical infrastructure team grow, and the direct reliability, operational resilience and security benefits that team brings to our customers. For example, we’ve opened a new region in Poland, announced the first subsea cable that will directly connect the U.S. to Singapore with fiber pairs over an express route, and released an SRE book focused on how organizations can complete a successful cloud migration.
• New security foundations blueprint guide – As part of our mission to deliver the industry’s most trusted cloud, we strive to operate in a shared-fate model for risk management in conjunction with our customers. This includes sharing opinionated step-by-step guidance with key decision points and focus areas for how our customers deploy workloads in Google Cloud. This is why we’ve updated our Google Cloud security foundations guide and corresponding Terraform blueprint scripts. These blueprints are tremendously helpful to many stakeholders within an enterprise, like a CISO that needs to understand our key principles for cloud security, or a C-Suite business leader that needs to quickly identify the skills their teams need to meet an organization’s security, risk, and compliance needs on Google Cloud. 

When we think about the types of features to build into products, we have many principles we follow. But the two that I keep coming back to as crucial are:

1. The need for secure products not just security products. All products should have security built in and while we do build great security products our security and other teams remain focused on constantly enhancing the base levels of security and the security features in all our products. 
2. Defense in Depth. We don’t just focus on defense in depth from attacks – for ourselves and our customers. We also prioritize defense in depth from configuration errors or other hazards. 

As you see below in some of the highlights of new features and products, these represent our commitment to secure products and all forms of defense in depth. 

• Workload identity federation – Service account keys are powerful credentials, and can represent a security risk if they are not managed correctly. A safer approach is to use workload identity federation, using IAM to grant external identities IAM roles, including the ability to impersonate service accounts. This lets you access resources directly and eliminates the maintenance and security burden associated with service account keys. We also offered related overall guidance on the best way to use and authenticate service accounts on Google Cloud.
• VPC-SC Directional Policies – With VPC Service Controls (VPC-SC), admins can define a security perimeter around Google-managed services to control communication to and between those services. Using VPC-SC, you can isolate your production GCP resources from unauthorized VPC networks or the internet. But what if you need to transfer data between isolated environments that you’ve set up? VPC-SC directional policies is a new secure data exchange feature that allows you to configure efficient, private, and secure data exchange between isolated environments. 
• Anthos service mesh supports VMs as well as clusters – Most enterprise compute resources are still in VMs and many will remain there for a long time to come. In Anthos 1.7,  your VM-based workloads can now take advantage of the same mesh functionality as your container-based workloads.
• Cloud Spanner CMEK and Access Approvals – Cloud Spanner is Google Cloud’s fully managed relational database that offers unlimited scale, high performance, strong consistency across regions and high availability. Spanner now supports customer-managed encryption keys (CMEK) and Access Approval, Google Cloud’s industry-leading controls to require approval before access to your content by Google support and engineering teams.
• External Key Manager enhancements – In early 2020 we launched Cloud External Key Manager (Cloud EKM), the industry’s leading Hold-Your-Own-Key (HYOK) product. Using Cloud EKM, the keys used to protect your data stored and processed in Google Cloud are completely hosted and managed outside of Google Cloud infrastructure. Cloud EKM initially launched with support for BigQuery and GCE/PD;  we expanded support for Cloud SQL, GKE, Dataflow Shuffle, and Secret Manager, with CMEK support currently in beta. We also provided in-depth documentation on the functionality, architecture and use cases for Cloud EKM in a new whitepaper.
• Web App and API Protection solution –  Web applications and public APIs are increasingly important to how organizations interface with their customers and partners, and we’ve seen increased investment in tools to protect these resources from fraud and abuse. Google Cloud’s new Web App and API protection solution is based on the same technology Google uses to protect its public-facing services against web application exploits, DDoS attacks, fraudulent bot activity, and API targeted threats. It provides protection across clouds and on-premises environments.
• Threat Intel for Chronicle – Most threat intelligence feeds require security teams to do the implementation and legwork. With our new Threat Intel for Chronicle offering, however, our intelligence insights are applied automatically across your security telemetry to present unique observations within your environment. Threat Intel for Chronicle is exclusively curated for enterprise customers by Uppercase, Google Cloud’s intelligence research and applications team to provide our perspective on threats across the internet and surface them as relevant alerts.

That wraps up another month of thoughts and highlights. If you’d like to have this Cloud CISO Perspectives post delivered every month to your inbox, click here to sign-up, and we’ll see you in June!