Organizations large and small are realizing that digital transformation and the changing threat landscape require a grounds up effort to transform security. At Google Cloud, we continue to invest in our vision of invisible security where advanced capabilities are engineered into our platforms, operations are simplified, and stronger security outcomes can be achieved.

We made five major security announcements at Google Cloud Next:

• Introducing Chronicle Security Operations, to help detect, investigate, and respond to cyberthreats with the speed, scale, and intelligence of Google
• Introducing Confidential Space, to help unlock the value of secure data collaboration
• Advancing digital sovereignty on Europe’s terms, to address growing demand for cloud solutions with high levels of control, transparency, and sovereignty
• Introducing Software Delivery Shield, to help improve software supply chain security
• New and expanded Google Cloud partnerships with leaders across the security ecosystem

Today at Next ‘22, we’re introducing additional new security products, partnerships, and solutions across security analytics, anti-fraud measures, device security, Zero Trust, and open source software security to help our customers around the world address their most pressing security challenges.

Our Assured Open Source Software service, which we announced earlier this year, is now available in Preview. Assured OSS enables enterprise and public sector users of open source software to easily incorporate the same trusted OSS packages that Google uses into their own developer workflows. You can sign up for the Preview of Assured OSS here.

Security teams must continually measure and manage risk in their cloud environments. Earlier this year we acquired Foreseeti, a startup focused on attack simulation and risk quantification. We’re excited to announce that the integration of Foreseeti’s groundbreaking technology, which can help teams understand their exposure and prioritize contextualized vulnerability findings, will be coming to Security Command Center in Preview in Q4. Security Command Center will use Forseeti’s advanced attack path simulations to help you apply targeted remediations before attackers can take advantage of high-risk vulnerabilities.

To help organizations better manage risks in their online channels, reCAPTCHA Enterprise and Signifyd will partner to bring to market a joint anti-fraud and abuse solution. This solution will combine the behavioral analysis capabilities of reCAPTCHA Enterprise with the anti-fraud capabilities of Signifyd to help enterprises reduce abuse, account takeovers, and payment fraud.

We continue to invest in new initiatives with our BeyondCorp Alliance partners. Palo Alto Networks customers can now pair Prisma Access with BeyondCorp Enterprise Essentials to help secure private and SaaS app access while mitigating internet threats across managed and unmanaged devices with a secure enterprise browsing experience.

We now package best practices and implementation experience for our customers in Zero Trust Advisory solutions. Our Cybersecurity Action Team and select partners can help guide you through the Zero Trust journey with exploratory workshops, architecture reviews, customized recommendations, and implementation support.

Google Cloud Armor, which was instrumental in stopping the largest Layer 7 DDoS attack to date, was named a Strong Performer in The Forrester Wave™: Web Application Firewalls, Q3 2022. This is our debut in the WAF Wave, and it’s encouraging to see the recognition for the product in this market segment.

Google Workspace has received several security updates and advances. They bring data loss prevention (DLP) to Google Chat to help prevent sensitive information leaks, new Trust rules for Google Drive for more granular control of internal and external sharing, and Client-side encryption (CSE) in Gmail and Google Calendar to help address a broad range of data sovereignty and compliance requirements. You can learn more in our Workspace blog.

Learn more at Google Cloud Next

Our growing team at Google Cloud Security remains focused on delivering solutions that can make governments and enterprises safer with Google, in our trusted cloud and through products that bring our security capabilities to on-premises environments and other clouds. Learn more about these announcements and capabilities by attending the Security sessions at Google Cloud Next all this week and on-demand soon after.

Editor’s note: Today’s post highlights five takeaways from our session at the first ever Google Cloud Public Sector Summit. To watch the full session, check out All the Right Moves: Prioritizing Investments in Technology.

Now more than ever, government agencies need to invest in digital services to fulfill their missions and better serve communities. Yet modernization isn’t a one-and-done approach; it’s a sustained effort, with multi-year implications, and requires careful consideration of how to integrate existing investments to optimize costs. Digital transformation requires coordination between different programs and agencies, including all of their many competing considerations. In short, maximizing technology investments requires careful planning, strategic thinking, and industry partners that can provide flexibility and security and meet agencies where they are. 

I sat down with Suzette Kent, former U.S. federal chief information officer, and Dominic Sale, assistant commissioner for Technology Transformation Services at the General Services Administration (GSA) for a conversation to unpack this important topic and discuss industry best practices. 

The panelists had five tips for government employees who are making technology purchasing decisions for their agency.

1.   Put the agency’s mission first.Avoid getting distracted by exciting new trends and focus on long-term goals that can impact which procurement strategies or funds could be used. The discussion started with how government agencies could cut through the noise about technology and prioritize which technology is best for their needs. Sale and Kent agreed that an agency should focus on its core mission outcomes and let its technology needs flow from that. Sale also emphasized the importance of having technology design respond to humans’ needs, which has historically been a challenge for government agencies.

For agencies to stay focused on their mission, final decisions about technology need to be made by the program manager who best understands each program’s mission. The government CIO’s role is to be the enabler for the technology and leverage it at the enterprise level, particularly when it comes to sharing infrastructure.  The takeaway: enable mission programs by empowering your teams and providing access to authorized, compliant, innovative data platforms that programs can move confidently and quickly with.

2.   Invest in interoperability. Agency employees often struggle to balance the need for a positive return on investment (ROI) with requirements for meeting mission objectives. While the panelists agreed that the total cost of ownership was important, they also emphasized taking an expanded view of ROI, including future-proofing and investing in functionality that may not realize its return for many years based on the initiative. Saving money isn’t particularly valuable if the solution doesn’t meet an agency’s needs. When choosing a technology partner, government employees should understand its long-term vision to ensure that the partner fits agency priorities. Partners’ technologies should also integrate seamlessly with existing systems so agencies don’t duplicate investment costs.

For example, Google Anthos extends Google Cloud services and engineering practices into an organization’s existing environment, establishing operational consistency across apps and modernization. With Anthos, agencies can simply and securely build and deploy applications anywhere, integrating cloud services across platforms. This allows them to enjoy a consistent DevOps experience for hybrid and multi-cloud environments and enables new innovation. Most importantly, this enables an enterprise data platform, one of the largest catalysts for mission transformation and applied AI.

3.   Take advantage of artificial intelligence (AI) benefits. Over the course of the pandemic, the rapid application of AI has improved government productivity, efficiency, and the ability to deliver critical new services to the public at scale. This has further cemented AI’s role as an essential government technology for the present and future. In fact, Nextgov reports that “46% of government IT specialists plan to use AI and machine learning (ML) for embedded systems in the near future.”

As we’ve seen over the course of the pandemic, government programs can start small with AI  pilots before moving into broad deployment. This can help agencies understand AI’s potential before moving to full production. People always supervise AI technologies, and the possibilities are endless. Google Cloud’s Contact Center AI (CCAI) has helped government agencies improve the customer experience, by allowing citizens to schedule vaccine appointments via a platform of their choice with up to 28 languages and dialects, and manage vaccine deployment. The U.S. Navy spends billions annually to fight rust and corrosion on its ships. Inspections of ships, aircraft and vehicles are a time-consuming and critical part of keeping the U.S. Navy at top performance so Google Cloud and Simple Technology Solutions (STS) rapidly built an AI-based corrosion-detection and analysis system. The system detected and analyzed corrosion on vessels with 90% accuracy and will eventually be used to automate inspections of vessels, aircraft, and vehicles—saving billions of dollars. Document AI helps a variety of government agencies scale their document processing, reducing the time it typically takes to process enormous amounts of data and related citizen claims.

Successful adoption of AI also depends on the quality of the data. Ultimately, agencies need high-quality enterprise data pipes so that employees and the community trust the system and public sector agencies. Sale described a GSA project that used AI bots to read legal contracts and look for particular phrases that would indicate a specific use case. Previously, an employee would have had to read through the contracts and search for the information. In this way, AI is saving the government both money and time.

4.   Creating better experiences for the public. Sale observed that, “trust is the government’s currency and profit motive.” And trust comes when the public can be served with the same modern tools and technology they’re used to – in real-time and with transparency in mind. For example, agencies can provide transparency in public-facing dashboards for programs and supply services that deliver information in real-time through solutions like CCAI.

Trust also requires that constituents feel that government agencies will keep their data safe and secure. The need for a globally secure infrastructure with systems that are up-to-date and designed with security at every level, underpinned by zero-trust enterprise-wide remains paramount – particularly after the series of recent cyberattacks targeting government IT infrastructure.

5.   Finding the right technology partner. Government leaders need technology partners who  provide a flexible and interoperable platform to integrate existing investments and maximize technical value. Historically, public sector agencies have largely been forced to adopt private clouds, which has reduced their access to richer features, and hindered their ability to adopt a full range of security and product capabilities. The right partner won’t require government leaders to compromise on functionality or service availability to achieve compliance. The right partner can harness the power of emerging technology to make it Government-ready and the true promise of cloud– the access and integration of open data– to make missions more powerful and impactful for the constituencies they serve.

The security world keeps changing, with new tools and new threats in the ever-evolving arms race that is cybersecurity. To keep you up to speed on all that Google Cloud is doing to help safeguard your data and your applications, welcome to the first installment of the Security Roundup. In this regular series, I’ll be sharing a selection of news and guidance to help ensure you have the resources you need for your hectic, high-stakes harm-preventing job.

Applying the principle of least privilege to GKE clusters

Access to your GKE clusters – just like any other resource – should be based on the principle of least privilege. Use groups, individual roles, and Identity and Access Management tools to limit who can do what with your Kubernetes clusters in Google Cloud. These principles can help you control who uses which elements of the Kubernetes API as well as how they access your clusters. More details are in Anthony Bushong’s video.

Ensuring CI/CD pipeline security

To make sure only trusted code artifacts enter your continuous integration and deployment pipeline, you can take advantage of Binary Authorization on Google Cloud, and then only permit signed builds to go through. Learn more in Martin Omander’s video interview and walkthrough with XIaowen Lin.

Protecting against denial of service and flooding attacks

Once your applications are on the web, they become potential targets for attack. You can use Cloud Armor to protect against many types of traffic attacks, including distributed denial-of-service (DDoS), and HTTP POST flood attacks. After learning the normal traffic patterns of your apps, Cloud Armor monitors for anomalies and then generates alerts or intervenes on your behalf to block malicious traffic. Learn more with Arman Rye in this video.

Defending against cyberattacks with Palo Alto Networks

If you use Palo Alto Networks products for endpoint protection or network monitoring, now you can integrate the signals from those systems into Google Cloud security tools. You can ingest device health conclusions from Palo Alto Networks Cortex XDR to boost your visibility into those endpoints’ state and improve your trust decisions. BeyondCorp Enterprise users can incorporate Cortex XDR metadata into access policies, leveraging additional posture information to add another level of trusted device information and operate with more confidence. Check out the details in this interview with Mason Yan at Palo Alto Networks.

Dealing with Apache Log4j 2 vulnerability(ies)

Attackers who exploit the Apache Log4j 2 vulnerability can execute arbitrary code on a vulnerable server. Read this post by the Google Cybersecurity Action Team for more details on log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046) and how you can find out if you’re affected. It includes advice for how to use Google Cloud products like Binary Authorization rules and Security Command Center to keep your cloud deployments safe.

Good luck out there, and remember: Keep your data yours!

This blog includes content from Episode One “Confidentially Speaking” of our Cloud Security Podcast, hosted by Anton Chuvakin (Head of Solutions Strategy) and Timothy Peacock (Product Manager). You should listen to the whole conversation for more insights and deeper context.LEARN MORECloud Security Podcast – Confidentially SpeakingListen to the Cloud Security Podcast with guest Nelly Porter, Group Product Manager @ Google.

We all deal with a lot of sensitive data and today, enterprises must entrust all of this sensitive data to their cloud providers. With on-premises systems, companies used to have a very clear idea about who could access data and who was responsible for protecting that data. Now, data lives in many different places—on-premises, at the edge, or in the cloud. 

You may already know that Google Cloud provides encryption for data when it is in transit or at rest by default, but did you also know we also allow you to encrypt data in use—while it’s being processed? 

In this podcast episode, Product Manager Nelly Porter gave us a peek under the hood of  confidential computing at Google Cloud. 

What is confidential computing? 

Google Cloud’s Confidential Computing started with a dream to find a way to protect data when it’s being used. We developed breakthrough technology to encrypt data when it is in use, leveraging Confidential VMs and GKE Nodes to keep code and other data encrypted when it’s being processed in memory. The idea is to ensure encrypted data stays private while being processed, reducing exposure.

During the episode, Nelly Porter explained that Google Cloud’s approach is based on hardware and CPU capability. Confidential Computing is built on the newest generation of AMD CPU processors, which have a Secure Encrypted Virtualization extension that enables the hardware to generate encryption keys that are ephemeral and associated with a single VM.  Basically, they are never stored anywhere else and are not extractable—the software will never have access to those keys. 

“You can do whatever you need to do, but you will be in a cryptographically isolated space that no other strangers passing by can see.”

Memory controllers use the keys to quickly decrypt cache lines when you need to execute an instruction and then immediately encrypts them again. In the CPU itself, data is decrypted but it remains encrypted in memory. 

Confidential computing aims to mitigate gaps in data security

Nelly also shed some light on why confidential computing will continue to play a central role in the future of cloud computing. She pointed out that one of the biggest gaps companies are looking to cover is securing data when it is in use. 

Data that is encrypted on-premises or in cloud storage, but the biggest risk for companies is when they start working with that data. For instance, imagine you encrypted your data on-premises and only you hold the keys. You upload that data into Cloud Storage buckets—simple, safe, and secure. 

But now, you want to train machine learning models based on that data. When you upload it into your environment, it’s no longer protected. Specifically, data in reserved memory is not encrypted.We’re trying to ensure that your data is always protected in whatever state it exists, so fewer people have the opportunity to make mistakes or maliciously expose your data.

Top takeaways about confidential computing 

Throughout the conversation, Nelly also shared interesting points about the development and direction of confidential computing at Google Cloud. 

Here were our favorite takeaways from the podcast: 

We worked hard to make Google Cloud’s approach simple.
We’ve invested a lot of time and effort into investigating the possibilities (and limitations) of confidential computing to avoid introducing residual risks to our approach. For instance, the early introduction of hardware capable of confidential computing in the industry required IT teams to have the resources to rewrite or refactor their app, severely limiting their ability to adopt it within their organizations. 

With Confidential Computing, teams can encrypt data in use without making any code changes in their applications.  All Google Cloud workloads can run as Confidential VMs, enabled with a single checkbox, making the transition to confidential computing completely simple and seamless. 

“A lot of customers understand the values of confidential computing, but simply cannot support re-writing the entire application. It’s why Google Cloud, in particular, decided to take a different approach and use models that were incredibly easy to implement, ensuring that our customers would not have those barriers to cross.”

Confidential computing is for more than just fintech. 
There is, of course, a compelling use case for confidential computing at highly-regulated companies in financial, government, life sciences, and public sectors. However, Nelly shared that her team didn’t anticipate that even verticals without significant regulation or compliance requirements would be so interested in this technology, mostly to pre-empt privacy concerns. 

Many companies see confidential computing as a way to create cryptographic isolation in the public cloud, allowing them to further ease any user or client concerns about what they are doing to protect sensitive data. For instance, during COVID-19, there was an increase in small research organizations that wanted to collaborate across large datasets of sensitive data. 

“Prior to confidential computing, it wasn’t possible to collaborate because you needed the ability to share very sensitive data sets among multiple parties while ensuring none of them will have access to this data, but the results will benefit all of them—and us.”

An open community, working together will be key for the future. 
Nelly also shared that there are plans to extend memory protections beyond just CPUs to cover GPUs, TPUs, and FPGAs. Google Cloud is working with multiple industry vendors and companies to develop confidential computing solutions that will cover specific requirements and use cases.

Confidential computing will not be achieved by a single organization – it will require many people to come together. We are a member of the Confidential Computing Consortium, which aims to solve security for data in use and includes other vendors like Red Hat, Intel, IBM, and Microsoft. 

“Google alone would not be able to accomplish confidential computing. We need to ensure that all vendors, GPU, CPU, and all of them follow suit. Part of that trust model is that it’s third parties’ keys and hardware that we’re exposing to a customer.”

There are no magic bullets when it comes to security. 
Confidential computing is still an emerging, very new technology and unsurprisingly, there are a lot of questions about what it does and how it works. It’s important to remember that there is no such thing as the one-tool-fits-all-threats security solution. Instead, Nelly notes that confidential computing is yet another tool that can be added to your security arsenal. 

“No solution will ever be the magic bullet that will make everyone happy and secure, guaranteed. But confidential computing is an addition to our toolbox of defense against gaps we have to take super seriously and invest in solving.” 

Did you enjoy this blog post? To listen to the full conversation, head over to Episode One “Confidentially Speaking” of our Cloud Security Podcast, hosted by Anton Chuvakin (Head of Solutions Strategy) and Timothy Peacock (Product Manager). 

We also recommend checking out other episodes of the Cloud Security Podcast by Google for more interesting stories and insights about security in the cloud, from the cloud, and of course, what we’re doing at Google Cloud.