Did you know that by 2025, enterprise IT spending on public cloud computing will overtake traditional IT spending? In fact, 51% of IT spend in application software, infrastructure software, business process services, and system infrastructure will transition to the public cloud, compared to 41% in 20221.. As enterprises continue to rapidly shift to the cloud, government agencies must prioritize and accelerate security and compliance implementation.

In May 2021, the White House issued an Executive Order requiring US Federal agencies to accelerate cloud adoption, embrace security best practices, develop plans to implement Zero Trust architectures, and map implementation frameworks to FedRAMP. The Administration’s focus on secure cloud adoption marks a critical shift to prioritizing cybersecurity at scale. Google Cloud’s Public Sector Professional Services Organization (PSO) has committed to helping customers meet security and compliance requirements in the cloud through specialized consulting engagements.

Accelerating Authority to Operate (ATO)

The Federal Risk and Authorization Management Program (FedRAMP) was established in 2011 as a government-wide program that promotes the adoption of secure cloud services across the federal government. FedRAMP provides a standardized approach to security and risk assessment for cloud technologies and federal agencies. US Federal agencies are required to utilize and implement FedRAMP cloud service offerings as part of the “Cloud First” federal cloud computing strategy.

While Google Cloud provides a FedRAMP-authorized cloud services platform and a robust catalog of FedRAMP-approved products and services (92 services and counting), customers are still tasked with achieving Agency ATO for the products and services they use, and Google Cloud provides many resources to assist customers with this journey. Google Cloud’s FedRAMP package can be accessed by completing the FedRAMP Package Access Request Form and submitting it to info@fedramp.gov. Additionally, customers can use Google’s NIST 800-53 ATO Accelerator as a starting point for documenting control implementation. Finally, Google Cloud’s Public Sector PSO offers the following strategic consulting engagements to help customers streamline the Agency ATO process.

• Cloud Discover: FedRAMP is a six-week interactive workshop to support customers that are just getting started with the ATO process on Google Cloud. Customers are educated on FedRAMP fundamentals, Google’s security and compliance posture, and how to approach ATO on Google Cloud. Through deep-dive interviews and design sessions, PSO helps customers craft an actionable ATO plan, assess FedRAMP readiness, and develop a conceptual ATO boundary. This engagement helps organizations establish a clear understanding and roadmap for FedRAMP ATO on Google Cloud.
• FedRAMP Security Review is a ten to twelve week engagement that aids customers in FedRAMP operational readiness. PSO consultants perform detailed FedRAMP architecture reviews to identify potential gaps in NIST 800-53 security control implementation and Google Cloud secure architecture best practices. Findings from the security reviews are shared with the customer along with configuration guidance and recommendations. This engagement helps organizations prepare for the third-party or independent security assessment that is required for FedRAMP ATO.
• Cloud Deploy: FedRAMP is a multi-month engagement designed to help customers document the details of their FedRAMP System Security Plan (SSP) and corresponding NIST 800-53 security controls, in preparation for Agency ATO on Google Cloud at FedRAMP Low, Moderate, or High. PSO collaborates with customers to develop a detailed technical infrastructure design document and security control matrix capturing evidence of the FedRAMP system architecture, security control implementation, data flows and system components. PSO can also partner with a third-party assessment organization (3PAO) or an independent assessor (IA) to support customer efforts for FedRAMP security assessment. This engagement helps customer system owners prepare for Agency ATO assessment and package submission.

Developing a Zero Trust Strategy

In addition to providing FedRAMP enablement, Public Sector PSO has partnered with the Google Cloud Chief Information Security Officer (CISO) team to assist organizations with developing a zero trust architecture and strategy.

Zero Trust Foundations is a seven-week engagement co-delivered by Google Cloud’s CISO and PSO teams. CISO and PSO educate customers on zero trust fundamentals, Google’s journey to zero trust through BeyondCorp, and defense in depth best practices. The CISO team walks customers through a Zero Trust Assessment (ZTA) to understand the organization’s current security posture and maturity. Insights from the ZTA enable the CISO team to work with the customer to identify an ideal first-mover workload for zero trust adoption. Following the CISO ZTA, PSO facilitates a deep-dive Zero Trust Workshop (ZTW), collaborating with key customer stakeholders to develop a NIST 800-207 aligned, cloud-agnostic zero trust architecture for the identified first-mover workload. The zero trust architecture is part of a comprehensive zero trust strategy deliverable that is based on focus areas called out in the Office of Management and Budget (OMB) Federal Zero Trust Strategy released January 2022.

Scaling Secure Cloud Adoption with PSO

Public Sector PSO enables customer success by sharing our technical expertise, providing cloud strategy, implementation guidance, training and enablement using our proven methodology. As enterprise IT, operations, and organizational models continue to evolve, our goal is to help government agencies accelerate their security and compliance journeys in the cloud. To learn more about the work we are doing with the federal government, visit cloud.google.com/solutions/federal-government.

1 Gartner Says More Than Half of Enterprise IT Spending in Key Market Segments Will Shift to the Cloud by 2025

After a seamless migration to Google Cloud Platform with CloudCover and Google Cloud Professional Services, Hike has reduced its costs by 20% and processed analytics queries 20 times faster than with its previous cloud provider. The business is also using AI and machine learning to enhance the experience provided by a new sticker-based messaging app, Hike Sticker Chat.

India is a market of opportunity for businesses that provide messaging apps to consumers. With more than 1.3 billion people, the country is the second most populous in the world. However, global messaging app providers face a robust market challenge from Hike, a home-grown internet and technology startup. Launched in 2012, Hike provides innovative products such as Hike Messenger and more recently the AI- and machine-learning-enabled Hike Sticker Chat, a service that enables young people in the country to express themselves through digital stickers.

The business says it understands the people of India and communication like no one else, while its mission is to reduce individuals’ dependency on the keyboard. To do this, Hike is building one of the largest repositories of AI and machine-learning-enabled stickers for Hike Sticker Chat. This messaging platform is, according to Hike, the only product of its type that enables conversations through stickers covering more than 40 languages and local dialects.

Google Cloud Results

• Processes analytics queries 20X faster than previously
• Doubles compute throughput
• Uses Google Cloud Machine Learning Engine managed, distributed capabilities to train complex models on TensorFlow that provide delightful local sticker recommendations through Hike Sticker Chat

Founded by Kavin Bharti Mittal, the Delhi-based venture is backed by SoftBank, Tencent, Tiger Global, Foxconn, and Bharti. To date, Hike has raised $261 million in funding. In August 2016, Hike raised its Series D round of funding, led by Tencent and Foxconn, at a valuation of $1.4 billion. The business is one of the fastest Indian startups to achieve Unicorn status, doing so in less than four years.

Hike started operations on a multinational cloud service. However, as user numbers and usage grew, the business began exploring options to improve performance and stability, reduce costs, and cut administration loads. In particular, Hike wanted to reduce latency between cloud data centers.

Focus on product development

“We aimed to move away from a technology stack with single points of failure to a horizontally scaled, highly reliable, distributed systems and managed services environment that enabled us to focus on product development rather than operations,” says Aditya Gupta, Director, Engineering, Hike.

Hike then began exploring the opportunities presented by Google Cloud Platform. The business held a number of executive-level meetings with Google to understand the capabilities, roadmap, and track record of the cloud service. It then decided to proceed with a proof of concept with Google Cloud Premier Partner CloudCover.

The proof of concept revealed that when Cloud Load Balancing was operating, latency between the Google Cloud data center in Taiwan and Delhi, India, was less than the latency between the incumbent cloud provider’s data center and Delhi. Further, compute throughput was up to two times greater on Compute Engine than on the equivalent service, while Hike could complete more then 1 million connections on Compute Engine – up from 500,000 connections on the incumbent service.

Migrate to GCP

The success of the exercise prompted Hike to migrate its messaging app to Google Cloud Platform. “We chose Google Cloud Platform because of its very broad set of services and features,” explains Gupta. “In addition, Google’s innovation mindset and the richness of the partnership would allow us to be onboarded quickly to machine learning services such as Cloud Machine Learning Engine.”

The business called on Google Cloud Professional Services (Technical Account Management) to help ensure a seamless lift-and-shift migration over two months. Google Cloud Professional Services initially undertook a technical infrastructure kickoff to establish a foundation for architecture requirements such as identity and access management and security.

Google Cloud Professional Services team delivers smooth migration

Google Cloud Professional Services worked closely with Hike to map out and deliver the Google Cloud Platform architecture that would deliver the greatest value to the business. The Professional Services team also worked with Hike to resolve product and support queries quickly; provided project background for product and support teams; and organized project meetings and early adopter program access.

In addition, Professional Services team members worked on site at least once a week, coordinated external support during critical migration periods, and coordinated teams in five countries for a single, 17-hour migration marathon. Over 60 days, the business migrated 7,000 processor cores, running virtual machine instances used for messaging infrastructure and analytics, to Google Cloud Platform.

Throughout the exercise, Google Cloud Professional Services worked with CloudCover to educate the customers’ technology teams to achieve proficiency with Google Cloud Platform. The teams soon built up skills and knowledge of best practices and began applying them to the Google Cloud Platform environment.

The Hike Google Cloud Platform architecture comprises virtual machine instances running in Compute Engine; Cloud Storage for unified object storage; networking; a BigQuery analytics data warehouse; Cloud Dataflow to transform and enrich data; Cloud Load Balancing to distribute workloads to maximize efficiency; and Cloud Dataproc to run Hadoop clusters.

Hike is also stepping up its AI & machine learning capabilities. It uses Google Cloud Machine Learning Engine managed, distributed computing capabilities to train complex models on TensorFlow. This powers key use cases such as delightful local sticker recommendations on Hike Sticker Chat. Hike is also investing heavily on AI and machine learning research.

Hike has achieved a range of benefits from its Google Cloud Platform deployment. As well as reduced latency, improved compute throughput, and increased connection handling, Google Cloud Platform managed services have enabled the business to reduce the time and effort required to administer core infrastructure, with the saved resources allocated to improving its messaging product.

“Managed services are beginning to reduce our operational overheads,” says Gupta. “For example, managed instance groups and Cloud Load Balancing are reducing our instance count and costs, thereby reducing involvement from DevOps and developer teams.”

Google Cloud Platform 20% cheaper

Gupta and his team have calculated that running for three years on Google Cloud Platform will cost, including the cost of migration, 20 percent less than on its previous platform. BigQuery is processing queries 20 times faster than a similar service offered by the previous provider, while storing 125TB of data and streaming 1.5TB of data daily. Furthermore, Hike’s analytics pipeline costs 80 percent less than in its previous environment.

“Google Cloud Platform has played an important role in enabling us to continue to innovate and realize our mission of reducing dependency on the keyboard,” says Gupta.

In an industry as highly regulated as healthcare, building a single secure and compliant application that tracks patient care and appointments at a clinic requires a great deal of planning from development and security teams. So, imagine what it would be like to build a solution that includes almost everything related to a patient’s healthcare, including insurance and billing. That’s what Highmark Health (Highmark)—a U.S. health and wellness organization that provides millions of customers with health insurance plans, a physician and hospital network, and a diverse portfolio of businesses–decided to do. 

Highmark is developing a solution called Living Health to re-imagine healthcare delivery, and it is using Google Cloud and the Google Cloud Professional Services Organization (PSO) to build and maintain the innovation platform supporting this forward thinking experience. Considering all the personal information that different parties like insurers, specialists, billers and coders, clinics, and hospitals share, Highmark must build security and compliance into every part of the solution. 

In this blog, we look at how Highmark Health and Google are using a technique called “secure-by-design” to address the security, privacy, and compliance aspects of bringing Living Health to life.

Secure-by-design: Preventive care for development

In healthcare, preventing an illness or condition is the ideal outcome. Preventive care often involves early intervention—a course of ideas and actions to ward off illness, permanent injury, and so on. Interestingly, when developing a groundbreaking delivery model like Living Health, it’s a good idea to take the same approach to security, privacy, and compliance. 

That’s why Highmark’s security and technology teams worked with their Google Cloud PSO team to implement secure-by-design for every step of design, development, and operations. Security is built into the entire development process rather than waiting until after implementation to reactively secure the platform or remediate security gaps. 

It’s analogous to choosing the right brakes for a car before it rolls off the assembly line instead of having an inspector shut down production because the car failed its safety tests. The key aspect of secure-by-design is an underlying application architecture created from foundational building blocks that sit on top of a secure cloud infrastructure. Secure-by-design works to ensure that these building blocks are secure and compliant before moving on to development.

The entire approach requires security, development, and cloud teams to work together with other stakeholders. Most importantly, it requires a cloud partner, cloud services, and a cloud infrastructure that can support it. 

Finding the right cloud and services for secure-by-design 

Highmark chose Google Cloud because of its leadership in analytics, infrastructure services, and platform as a service. In addition, Google Cloud has made strategic investments in healthcare interoperability and innovation, which was another key reason Highmark decided to work with Google. As a result, Highmark felt that Google Cloud and the Google Cloud PSO were best suited for delivering on the vision of Living Health—its security and its outcomes. 

“Google takes security more seriously than the other providers we considered, which is very important to an organization like us. Cloud applications and infrastructure for healthcare must be secure and compliant,” explains Highmark Vice President and Chief Information Security Officer, Omar Khawaja. 

Forming a foundation for security and compliance

How does security-by-design with services work? It starts with the creation and securing of the foundational platform, allowing teams to harden and enforce specified security controls. It’s a collaborative process that starts with input from cross-functional teams—not just technology teams—using terms they understand, so that everyone has a stake in the design. 

A strong data governance and protection program classifies and segments workloads based on risk and sensitivity. Teams build multiple layers of defense into the foundational layers to mitigate against key industry risks. Google managed services such as VPC Service Controls help prevent unauthorized access. Automated controls such as those in Data Loss Prevention help teams quickly classify data and identify and respond to potential sources of data risk. Automation capabilities help ensure that security policies are enforced.

After the foundational work is done, it’s time to assess and apply security controls to the different building blocks, which are Google Cloud services such as Google Kubernetes Engine, Google Compute Engine, and Google Cloud Storage. The goal is to make sure that these and similar building blocks, or any combination of them, do not introduce additional risks and to ensure any identified risks are remediated or mitigated. 

Enabling use cases, step by step

After the foundational security is established, the security-by-design program enables the Google Cloud services that developers then use to build use cases that form Living Health. The service enablement approach allows Highmark to address complexity by providing the controls most relevant for each individual service. 

For each service, the teams begin by determining the risks and the controls that can reduce them. The next step is enforcing preventive and detective controls across various tools. After validation, technical teams can be granted an authorization to operate, also called an ATO. An ATO authorizes the service for development in a use case.

For use cases with greater data sensitivity, the Highmark teams validate the recommended security controls with an external trust assessor, who uses the HITRUST Common Security Framework, which maps to certifications and compliance such as HIPAA, NIST, GDPR, and more. A certification process follows that can take anywhere from a few weeks to a few months. In addition to certification, there is ongoing monitoring of the environment for events, behavior, control effectiveness, and control lapses or any deviation from the controls.

The approach simplifies compliance for developers by abstracting compliance requirements away. The process provides developers a set of security requirements written in the language of the cloud, rather than in the language of compliance, providing more prescriptive guidance as they build solutions. Through the secure-by-design program, the Highmark technology and security teams, Google, the business, and the third-party trust assessor all contribute to a secure foundation for any architectural design with enabled Google Cloud services as building blocks. 

Beating the learning curve 

Thanks to the Living Health project, the Highmark technology and security teams are trying new methods. They are exploring new tools for building secure applications in the cloud. They are paying close attention to processes and the use case steps and, when necessary, aligning different teams to execute. Because everyone is working together collaboratively toward a shared goal, teams are delivering more things on time and with predictability, which has reduced volatility and surprises. 

The secrets to success: Bringing everyone to the table early and with humility

Together, Highmark and Google Cloud PSO have created over 24 secure-by-design building blocks by bringing everyone to the table early and relying on thoughtful, honest communication. Input for the architecture design produced for Highmark came from privacy teams, legal teams, security teams, and the teams that are building the applications. And that degree of collaboration ultimately leads to a much better product because everyone has a shared sense of responsibility and ownership of what was built. 

Delivering a highly complex solution like Living Health takes significant, more purposeful communication and execution. It is also important to be honest and humble. The security, technology, and Google teams have learned to admit when something isn’t working and to ask for help or ideas for a solution. The teams are also able to accept that they don’t have all the answers, and that they need to figure out solutions by experimenting. Khawaja puts it simply, “That level of humility has been really important and enabled us to have the successes that we’ve had. And hopefully that’ll be something that we continue to retain in our DNA.”

Soldiers can now use their CAC cards to log into the service’s newly established Google Workspace account. With it, soldiers who don’t need the full spectrum of information-sharing provided by Army365 can nevertheless find comrades, schedule meetings and coordinate other activities.

“All new entrants to the Army will be provisioned automatically with a Google Workspace account with a new email address … when they receive their CAC card,” Raj Iyer, the service’s chief information officer, said in a social-media post.

“Soldiers will retain their Google account till they fully transition to their first unit after completion of basic training and AIT [advanced infantry training], at which point their commanders will determine if they need an Army365 account.”

The directive applies to all active-duty, reserve, and National Guard soldiers.

At Google Cloud, our customers are at the forefront of digital transformation—launching entirely new businesses and products built in the cloud, redefining entire industries with data and artificial intelligence, delivering innovative new consumer experiences, or committing to sustainable new ways of doing business.

We’re committed to our customers’ success, and over the past two years we’ve invested significantly in providing ongoing and integrated support through our customer care portfolio, including launching new Premium and Mission Critical Support offerings that allow us to monitor, prevent, and mitigate impacts quickly, while delivering the fastest response times in the industry.

Today, I’m proud to unveil several new resources and offerings for our customers, including a new Custom AI Solutions practice, new Global Delivery Centers, expanded Executive Briefing Centers, and new leaders to help continue to drive our organization forward.

Helping businesses innovate with a new Custom AI Solutions practice

We are investing in services and offerings to help our customers innovate and drive innovative change to business processes, culture, and customer experiences with Google Cloud products and services. Artificial intelligence (AI) and machine learning (ML) technologies are foundational for many such digital transformations, and to help customers create real business value with these technologies, we’re excited to launch a Custom AI offering to address our customers’ most critical innovation needs. 

AI and ML technologies are foundational to digital transformations, yet they are not “one size fits all.” Each customers’ problems and opportunities are unique; a rideshare company will use AI differently than a brick and mortar retailer, or a healthcare company, or an insurance firm. To help organizations deploy AI and ML more effectively, we’re launching a new Custom AI Solutions practice, offering customers custom-built AI and ML solutions built into Vertex AI; access to Google’s engineering expertise; and predictable, subscription-based pricing. 

Our teams are already partnering closely with early customers to build and deploy custom AI solutions. For instance, USAA, the large North American insurer, is using Google Cloud ML to process near-real-time damage estimates based on digital images to create a streamlined operations experience.

Learn more about our Custom AI Solutions practice offering here, and how we work together with our customers here. To get in touch, please contact our sales team.

Launching new Global Delivery Centers

Our drive to digitally transform our customers’ businesses is often manifested through our Global Delivery Centers, which expand our professional consulting and emerging practices capabilities available to customers and partners around the world.

The teams at our Global Delivery Centers help customers get up-and-running on Google Cloud quickly and cost effectively, and consult with customers to rapidly build capacity in areas like data analytics, hybrid and multi-cloud, artificial intelligence, and machine learning. More importantly, they help customers successfully execute projects in support of their most mission-critical business objectives. Critically, these centers also help our global partner ecosystem quickly ramp their Google Cloud practices, and get fast, expert consultation for their customers too.

In 2022, we aim to triple the size of our Global Delivery Center teams in Argentina, Poland, and India. In addition, we’ll invest in building deep Google Cloud talent in Mexico and Portugal, furthering our commitment to the industry’s best expert consultation for customers and partners around the world.

Expanding our Executive Briefing Centers footprint

In addition to our Global Delivery Centers, we’re also pleased to expand our resources and facilities that enable digital and face-to-face meetings and working sessions with our customers. This year, we will launch four new Executive Briefing Centers, located on Google Cloud campuses in London, Paris, Singapore, and Munich. 

These centers provide an opportunity to listen to our customers, share the best of Google Cloud’s solutions, and inspire digital transformation, in conversations facilitated by Google Cloud leadership, engineers, and industry experts. By bringing this experience to our customers in-region we can foster deeper partnerships and develop cloud solutions that meet their requirements for security, privacy, and digital sovereignty without compromising on functionality or innovation. 

Adding new leadership to enable customer success

Finally, I’m excited to welcome two new leaders to Google Cloud on the Customer Experience team, who will help scale our Delivery Centers and deliver exceptional experiences for our customers.

Heading our Global Delivery Center experience is Sunil Rao. Sunil comes to Google Cloud from Accenture, where he spent 18-plus years working with large technology customers across many industry verticals and managed large global teams in Accenture Advanced Technology Center. Sunil will also lead our Technical Onboarding Center, which helps businesses around the world get up to speed with technologies that are critical to understanding customer and business process contexts, and delivering great experiences.

Additionally, Lee Moore is joining Google Cloud to lead Customer Experience in North America. Lee spent nearly 30 years at Accenture in various leadership positions, including services integration for complex problem-solving, product development across a number of industry verticals, and building long-term customer relationships.

You’ll be hearing much more from us in the coming months, as we build out even more powerful and effective cloud-based services and offerings, work with customers to deliver new analytics- and AI-based tools and services, and work with our growing list of partners to help ensure customer success, across the globe.