“Any device, anytime, anywhere.” A cohort of CIOs within Airbus believed that the cloud, combined with new ways of working, could provide the foundation for this vision. Google Workspace and Google Cloud have played a pivotal role in helping Airbus realize this new path, transforming security, data management, and collaboration along the way.

Adopting a secure-by-design approach

In adopting Google Workspace and Google Cloud Airbus needed to ensure a robust, zero-trust security model that works across the entire organization, even when employees are working outside the office. Google Workspace provides a single login that enables secure access to data, based on device and user information, as well as contextual inputs that inform the security risk of each login and user action. Airbus admins also use Google Workspace to define trust rules that govern what information and files can be shared within and outside the organization, making it easy for employees to comply with best practices from anywhere.

Encryption also plays a central role in keeping information secure and private. By default, Google Workspace uses the latest cryptographic standards to encrypt all data at rest and in transit. Google Workspace also offers client-side encryption, which Airbus uses for their most sensitive projects, giving them authoritative control over their data as the sole owner of their encryption keys.

And to ensure the organization is protected against hackers, Airbus has implemented sharding as a standard practice, thereby splitting data across multiple servers and data centers. Because the company works with incredibly sensitive information—including government and military information—the ability to locate data all within European data centers continues to be a necessity.

Powerful data management

Managing an enormous volume and variety of data, Airbus needs to ensure complete compliance with internal policies, as well as with external standards, like the General Data Protection Regulation (GDPR). Given this context, Airbus requires a solution that has strong built-in governance controls. Airbus also leverages the Drive labels feature, along with manual classification, to ensure that every file added to Google Drive is tagged and labeled correctly. In turn, these labels define the loss-prevention policies assigned to each file.

Staying connected during the pandemic

Before the pandemic, nearly every employee spent their workdays at an Airbus facility. When remote work became mandatory, the company made the pivot to Google Chat and Google Meet as an essential part of supporting real-time and asynchronous collaboration. Gmail also played a significant role in secure, anywhere-anytime communication, with its built-in anti-spam and anti-malware protections. Customizable filters let administrators protect against suspicious attachments, untrustworthy links, and countless other forms of malicious content. While Gmail blocks more than 99.9% of spam and phishing messages from ever reaching users’ inboxes, more advanced security measures like sandboxing can be put in place for specific use cases.

Protecting more than just data

Google Cloud’s sustainability efforts are as equally important to Airbus as data security. Google Cloud has been working to keep its climate footprint and those who use its services as low as possible, with all of Google currently carbon neutral and with a goal to run on carbon-free energy 24/7 at all of our data centers by 2030. And with our smarter, more efficient data centers, we’re already on that path with more than six times the computing power for the same amount of electrical power we used 5 years ago.

Building the future of work

By combining Google Workspace with Google Cloud, Airbus has been able to live up to its vision of “any device, anytime, anywhere.” The new model is a core foundation for its evolving future of work. Not only has Airbus adopted a zero-trust model across the organization, it’s also transformed how data is secured, managed, and accessed by employees working across a broad range of locations. The new flexible approach has also led to changes in how collaboration happens. Google is deeply gratified to have supported Airbus as they implement these changes and we continue to be proud that we’re running the cleanest cloud in the industry.

Want to learn more about how Google Workspace helps businesses like yours do more while keeping your data secure? Read this whitepaper to find out about our zero-trust model and other ways we protect organizations.

If you took one look at the title of this blog and thought, “just show me how, because I already know a million reasons why I’m stressed about billing things” then check out the interactive tutorial right here.

For everyone else, read on, because we’ll walk through some common sense tips, and a few step-by-step tutorials for all things billing related. If you’ve ever wished you could sit down with someone from Google Cloud, and walk through your bill, the console, and your options — you’re in the right place! Consider this Cloud Billing 101 – an intro level course that’ll get you started on the right foot.

6 simple tips to manage your Google Cloud billing accounts:

1. Get to know your billing statement and console: Knowledge is power, after all. Take a tour of the billing console so you can better understand your options, along with what’s included in your monthly bill and the different components.
2. Set up authorized users, alerts and budgets: Make sure anyone who needs to have access to payment settings is authorized. Allocate budgets for projects, and get notifications when your usage or spending exceeds a certain amount so you can take action as needed.
3. Use cost-saving tools: We’ve got  a range of tools and services to help you save money, like Committed Use Discounts, and even Recommenders for actionable, AI-powered intelligent recommendations around your cost trends and product usage.
4. Optimize your resources: Use the Google Cloud Resource Manager to see how your resources are being used and identify areas for optimization, temporarily suspend, or even shut down unused projects. 
5. Review your billing history with reporting and data visualization: Regularly check your billing history with reports to help track your spending, identify any trends or patterns, and even anticipate future costs. You can even export your data to BigQuery for detailed analysis, or use a tool like Google Data Studio to visualize your data.
6. Use the pricing calculator: Estimate your monthly costs and make informed decisions with the Google Cloud pricing calculator. It can help you get a ballpark figure for your usage, and determine if your use case fits within cost-free parameters.

I hope these common sense pointers and tutorials empower you to effectively manage your Google Cloud billing and stay on top of your spending. Get started right now by managing your billing methods and payment settings in this 5-minute tutorial, and then take a tour of the billing console to get familiar with your setup.

I’m excited to share our first Cloud CISO Perspectives post of 2022. It’s already shaping up to be an eventful year for our industry and we’re only in month one. There’s a lot to recap in this post, including the U.S. government’s recent efforts to address critical security issues, like open source software security and zero trust architectures. We’ve also released new resources from our Google Cybersecurity Action Team like the Cloud Security Megatrends and the Boards of Directors whitepaper on cloud risk governance. 

Cloud Security Megatrends 

We’re often asked if the cloud is more secure than on-prem (and why) so we shared our answer in a recent blog post. At Google Cloud, security by design is our priority. We’ve long adopted zero-trust principles for our baseline security architectures and built a global network that relies on defense in depth layers to protect against configuration errors and attacks. But security is always evolving and that is why we also take advantage of the following megatrends:

1. Economy of scale: Decreasing the marginal cost of security raises the baseline level of security. 
2. Shared fate: A flywheel of increasing trust drives more transition to the cloud, which compels even higher security and even more skin-in-the-game from the cloud provider.
3. Healthy competition: The race by deep-pocketed cloud providers to create and implement leading security technologies is the tip of the spear of innovation. 
4. Cloud as the digital immune system: Every security update the cloud gives the customer is informed by some threat, vulnerability, or new attack technique often identified by someone else’s experience. Enterprise IT leaders use this accelerating feedback loop to get better protection.
5. Software-defined infrastructure: Cloud is software defined, so it can be dynamically configured without customers having to manage hardware placement or cope with administrative toil. From a security standpoint, that means specifying security policies as code, and continuously monitoring their effectiveness.
6. Increasing deployment velocity: Because of cloud’s vast scale, providers have had to automate software deployments and updates, usually with automated continuous integration/continuous deployment (CI/CD) systems. That same automation delivers security enhancements, resulting in more frequent security updates.
7. Simplicity: Cloud becomes an abstraction-generating machine for identifying, creating and deploying simpler default modes of operating securely and autonomically. 
8. Sovereignty meets sustainability: The cloud’s global scale and ability to operate in localized and distributed ways creates three pillars of sovereignty. This global scale can also be leveraged to improve energy efficiency.

If you’re an IT decision maker, pay attention to these megatrends that will continue to drive and reinforce cloud security and will outpace the security of on-prem infrastructure well into the future. 

U.S. Federal government cybersecurity momentum 

• Open source software security: Earlier this month, Google participated in the White House Summit on open source software security. The meeting came at a critical time for the industry following December’s Log4j vulnerabilities and was both a recognition of the challenge and an important first step towards addressing it. The open source software ecosystem is not homogenous, despite the fact that the industry often thinks of or treats it this way. Some of it, like Linux, is highly curated, while other critical software is supported through diffuse communities including technology companies and other stakeholders. There is also a long tail of many other critical projects driven by a dedicated community of maintainers around the world, including Googlers. In light of this reality, we welcomed the chance to share our recommendations to advance the future of open source software security. Some work we’ve done includes founding the Open Source Security Foundation, which has been instrumental already in making security improvements. We’ve also helped drive a number of key security initiatives within the open source community including security scorecards, the SLSA framework to improve the security and integrity of open source packages, and Secure Open Source Rewards to financially incentivize improvements to critical open source security projects.  
• OMB’s Federal zero trust strategy: The publication of the Office of Management and Budget’s zero trust architecture strategy marks an important step for the U.S. federal government’s efforts to modernize under Executive Order 14028. Google Cloud supports this approach, which recognizes the immense security benefits offered by modern computing architectures. For the past decade, Google has successfully applied zero trust principles through our BeyondCorp and BeyondProd frameworks for providing end-user access and securing our cloud workloads. And we’ve brought these best practices from our own journey to global governments and businesses of any size through solutions like BeyondCorp Enterprise and capabilities like Binary Authorization and Anthos Service Mesh, which are embedded in Anthos, our managed application platform. For Federal agencies embarking on this zero trust journey, the Google Cybersecurity Action Team will offer our expertise by conducting Zero Trust Foundations strategy workshops, which can help organizations in the public and private sectors develop actionable and achievable strategies and plans for zero trust implementation. 

Google Cybersecurity Action Team Highlights 

Here are the latest updates, products, services and resources across our security teams this month: 

Security

• Democratizing security operations: We recently announced that Siemplify, a leading security orchestration, automation and response (SOAR) provider, is joining Google Cloud to help companies better manage their threat response. Providing a proven SOAR capability with Chronicle’s approach to security analytics is an important step forward in our vision to advance invisible security and democratize security operations for every organization.
• Security by design: The Highmark Health security team is using “secure-by-design” techniques to address the security, privacy, and compliance aspects of its Living Health solution with Google Cloud’s Professional Services Organization (PSO). Google has long advocated for and followed security by design principles, which is why we’re continuously building enhanced security, controls, resiliency and more into our cloud products and services. 
• Secure collaboration for hybrid work environments: The Google Workspace team shared its recommendations for businesses as they prepare for the future of work,  where the hybrid/flexible work model is becoming standard practice and a new approach to security is essential.
• Anthos Policy Controller CIS Benchmark enforcement: A big part of our shared fate philosophy is to build secure products and not just security products. A recent example of this in action is embedding CIS benchmark policy conformance in the Anthos Policy Controller. We believe the more we embed approaches like this into our products, the more application and infrastructure teams can intrinsically embed security at the start and reduce toil for the security team.
• DevOps for technology-driven organizations and startups: A key success factor for many security programs is the partnership and integration with development teams, and there are some great resources and lessons in our DORA research.
• Security by design with Chrome OS: ABN AMRO’s Asia-Pacific region team recently shared how they are using Chrome OS and CloudReady to work securely in the cloud, reduce total cost of ownership, and add flexibility for employees. This is a great example of secure by design principles in the use of Chromium.

Risk & Compliance

• Boards of Directors summary guide to cloud risk governance: The latest whitepaper from the Google Cybersecurity Action Team outlines how boards of directors can prioritize safe, secure, and compliant adoption processes for cloud technologies within their organizations.  
• TruSight Risk Assessment of Google Cloud: TruSight recently released a comprehensive
  risk assessment report on Google Cloud. Our Enterprise Trust team collaborated on this robust assessment of Google Cloud services to validate the design and implementation of controls. TruSight’s risk assessment of our security controls will help customers accelerate and complete their risk management due diligence.
• Data governance: Check out this new blog series on data governance where our teams explain the role of data governance, its importance, and the necessary processes to run an effective data governance program. Implementing data governance will help maximize value derived from business data, build user trust, and ensure compliance with required security measures.

Controls and Products

• Encrypting Data Fusion: To help meet the security, privacy and compliance requirements of customers in regulated industries like finance or public sector, we announced the general availability of Customer Managed Encryption Keys (CMEK) integration for Cloud Data Fusion, which enables encryption of both user data and metadata at rest with a key that customers can control through our Cloud Key Management Service (KMS). 

Don’t forget to sign-up for our newsletter if you’d like to have our Cloud CISO Perspectives post delivered every month to your inbox. We’ll be back next month with more updates and security-related news.

Compute Engine lets you create and run virtual machines (VMs) on Google’s infrastructure, allowing you to launch large compute clusters with ease. When it comes to getting started with Compute Engine, our customers have lots of questions—but some questions come up more often than others. 

We looked at an internal list of the most popular Compute Engine documentation pages over a 30-day period to find out what topics were explored by users again and again. Here are the top four questions users have about Compute Engine, in order.

1. What are the different machine families

Compute Engine lets you select the right machine for your needs. You can choose from a curated set of predefined virtual machine (VM) configurations optimized for specific workloads, ranging from small-level purpose to large-scale use cases or create a machine type customized to your needs with our custom machine type feature. 

Compute Engine machines are categorized by machine family, including: 

• General-purpose: Best price-performance ratio for a variety of standard and cloud-native workloads 
• Compute-optimized: Highest performance per core for compute-intensive workloads, such as ad serving or media transcoding  
• Memory-optimized: More compute and memory per core than any other family for memory-intensive workloads, such as SAP HANA or in-memory data analytics 
• Accelerator-optimized: Designed for your most demanding workloads, such as machine learning (ML) or high performance computing (HPC)

Read the documentation to learn more about each machine family category.

2. How to connect to VMs using advanced methods

In general, we recommend using the Google Cloud Console and the gcloud command-line tool to connect to Linux VM instances. However, some of our customers want to use third-party tools, or require alternative connection configurations. 

In these cases, there are several methods that might fit your needs better than the standard connection options:

• Connecting to instances using third-party tools (e.g. Windows PuTTY, Chrome OS Secure Shell app), or MacOS or Linux local terminal) 
• Connecting to instances without external IP addresses
• Connecting to instances as the root user Manually connecting between instances and running commands as a service account

Read the documentation to learn about advanced methods for connecting Linux VMs.

3. How to set up OS Login

OS Login lets you use IAM roles and permissions to manage access and permissions to VMs. 

OS Login is the recommended way to manage users across multiple instances or projects. OS Login provides:

• Automatic Linux account lifecycle management
• Fine-grained authorization using Google IAM without having to grant broader privileges
• Automatic permissions updates to prevent unwanted access
• Ability to import existing Linux accounts from Active Directory (AD) and Lightweight Directory Access Protocol (LDAP)

You can also add an extra layer of security by setting up OS Login with two-factor authentication or manage organization access by setting up organization policies.

Read the documentation to learn how to configure OS login and connect to your instances.

4. How to manage SSH keys in metadata 

Compute Engine allows you to manually manage SSH keys and local user accounts by editing public SSH key metadata.

You can add  public SSH keys to instance and project metadata using: 

• The Google Cloud Console The gcloud command-line tool 
• API methods from the Google Cloud Client Libraries

Read the documentation to learn how to manually manage SSH keys and local user accounts in metadata.

Don’t see your question here? Check out the Compute Engine documentation for all of our recommended guides, tutorials, and resources.