Road construction is booming in India. A recent report prepared by the India Brand Equity Foundation—a trust established by the Department of Commerce—pointed out that in FY 2019 alone, the country added 10,855 kilometers of highways to a road network that spans 5.89 million kilometers. This network is the second largest in the world and transports 90% of passenger traffic and 64.5% of all goods in the country.

The Indian Government has also earmarked road construction as key to plans to increase the nation’s GDP to $5 trillion in coming years, targeting road construction worth $212.8 billion in the two years from April 2020.

G R Infraprojects Limited is well positioned to support the government’s program. The business, which started as a contractor building roads in rural villages in India, now specializes in road engineering, procurement, and construction (EPC), a model whereby private construction firms build roads funded by the government.

The business now undertakes the processing of bitumen, manufacture of thermoplastic road-marking paint and road signage, and fabrication and galvanizing road-crash barriers. Its in-house integration model includes a design and engineering team, as well as manufacturing facilities in Rajasthan, Assam, and Gujarat.

The business recently expanded into rail—another area expected to benefit from extensive government investment—with its competencies including earthworks, materials supply, track lining, and bridge construction.

In this environment—and despite the economic impact of the coronavirus pandemic—G R Infraprojects Limited aims to substantially increase turnover and manpower over the next five years.

Best-in-class infrastructure key to success

Digital transformation is key to enabling growth while best-in-class IT infrastructure is one of the foundations on which the business seeks to build success.

G R Infraprojects Limited’s digital initiatives include deployment of a new document management system and corporate systems that enable remote monitoring, live tracking, effective real-time communication, and efficient data management.

Providing a scalable, reliable cost-effective infrastructure

But most important of all is providing a scalable, reliable, and cost-effective infrastructure to support a business-critical SAP enterprise resource planning system. Over the last few years, versions of SAP have enabled the organization to digitize processes and seamlessly run business-critical functions such as inventory management and finance.

G R Infraprojects Limited initially went live with SAP ECC6.0, with a few hundred team members using the system for business-critical tasks such as tracking stock level and movement and generating financial statements and reports for review and action.

“Google Cloud is a very big brand, so we were easily able to secure the trust from our executive and business teams to run an important system such as SAP S/4HANA on the platform.”—Sachin Kumar Agarwal, Head, Transformation, G R Infraprojects Limited

Lowering maintenance costs

However, as G R Infraprojects Limited grew, projects proliferated, and new markets emerged, the business elected to move to the cloud from an on-premises infrastructure. “We wanted to move because there were so many maintenance costs in on-premises solutions and cloud provided convenience to IT and the broader organization,” explains Sachin Kumar Agarwal, Head, Transformation at G R Infraprojects Limited.

The business also wanted to move to SAP S/4HANA to take advantage of features such as AI, advanced analytics, and machine learning to transform business processes. The system runs on the HANA database, an in-memory database with fast processing speeds and a simplified data model.

G R Infraprojects Limited selected Google Cloud to run SAP S/4HANA because, Sachin says, it is “much better than any other platform,” incorporates a wide range of features, and meets uptime requirements. The cloud service could also scale to support forecast growth without a sharp increase in cost.

Furthermore, Sachin adds, “Google Cloud is a very big brand, so we were easily able to secure the trust from our executive and business teams to run an important system such as SAP S/4HANA on the platform.”

“With Google Cloud, our speed and availability are controlled and optimized day by day. With such a scalable and dynamic platform, we are very happy with the performance.”—Sachin Kumar Agarwal, Head, Transformation, G R Infraprojects Limited

Successful transition with Infrabeat

G R Infraprojects Limited completed the project with assistance from partner InfraBeat over three months and SAP S/4HANA on Google Cloud went live mid-2019. “Our dedicated SAP team worked closely with Infrabeat to deliver the project successfully,” says Sachin. “We needed an experienced partner to assist with the implementation process and Infrabeat performed that role admirably. Both teams supported each other and worked to plan to deliver a great result.”

SAP S/4HANA runs on an infrastructure comprising virtual machine instances delivered through Compute Engine, Cloud Storage, and Cloud NAT to enable the secure transmission and receipt of packets to and from the internet.

G R Infraprojects Limited estimates the cost of running SAP S/4 HANA in Google Cloud is significantly lower than on alternative infrastructure options—freeing up budget for other business priorities.

In addition, moving SAP S/4 HANA to infrastructure as a service through Google Cloud has eliminated the need to assign internal team members to infrastructure management, allowing them instead to focus on higher-value activities.

Google Cloud also incorporates the security needed to protect the data and processes of SAP S/4 HANA from intrusion or disruption and ensure the uptime and continuity required of a business-critical system.

Optimized speed and availability

G R Infraprojects Limited’s decision to run SAP S/4 HANA on Google Cloud is delivering benefits on a daily basis. “With Google Cloud, our speed and availability are controlled and optimized day by day,” says Sachin. “We are very happy with the performance.”

Success with SAP S/4HANA has helped the business decide to move its remaining apps and data to the cloud when its on-premises servers and other equipment reach end of life. G R Infraprojects Limited is already running Active Directory in Google Cloud and Sachin says the cloud platform’s “fast and excellent services” made the decision easy.

“There are definitely instances of various upgrades of our systems and within the organization, and as we talk about our application and mobility requirements, we see Google Cloud playing a crucial role.”—Sachin Kumar Agarwal, Head, Transformation, G R Infraprojects Limited

Adding value

As G R Infraprojects Limited grows, Sachin adds, the business expects Google Cloud to continue to add value. “There are definitely instances of various upgrades of our systems and within the organization, and as we talk about our application and mobility requirements, we see Google Cloud playing a crucial role.”

Editor’s note: 5G is much more than a network—it’s a platform for innovation with the ability to provide immediate global scale and enable use cases that we haven’t even dreamed of yet. But to achieve this, industry players must come together to drive this growing ecosystem. Today, Erik Ekudden, CTO of Ericsson, and Bikash Koley, VP of Global Networking at Google Cloud, share their insights into the potential of edge and 5G.

Experts consider 2021 to be the year that serves as the inflection point between network readiness and 5G availability. However, communications service providers (CSPs) are still faced with the task of modernizing their networks, systems, and infrastructure to maximize the potential of 5G for themselves and for the enterprise customers they serve. As you weigh whether to tackle this challenge, let’s first examine what’s different about 5G and how CSPs can best leverage 5G and the edge together as an even stronger platform for innovation than just 5G alone.

With 5G, applications and mobile networks are no longer isolated

Let’s first address what 5G brings to the table. Faster speeds and lower latency are expected of course, and throughout the evolution from 2G to 3G to 4G, there’s been a step function in performance improvements with each of these. However, with every generation, applications and networks have been like ships passing in the night. Networks have been unaware of what the applications have been doing and applications have been guessing what the network was capable of. 

What’s different this time around is that there is some real innovation happening with the development and rollout of 5G itself. The network is on a path to become more accessible via APIs so that applications can call on and consume what they need from the networks in a more programmable way. This sets us up for more open architectures and ecosystems.

5G leverages a more open architecture 

One key difference with 5G as compared to prior generations is that it’s the most open and flexible network architecture the CSP industry has seen. This is thanks to its service-based approach and the decoupling of hardware and software components. CSPs are now running core network elements in the public cloud, private cloud, hybrid cloud, and even multi-cloud, which was unthinkable even five years ago.

The flexibility of this more open architecture allows us to push the cloud to the edge while still being able to manage it from a single pane of glass. This is a huge leap forward from traditional networks, which have been domain-specific, managed in silos, and with slow service creation and delivery. Now, hyperscale cloud vendors and network equipment providers are offering solutions that help CSPs break down these silos to enable more flexible, automated networks with improved orchestration, visibility, and control across multi-vendor, multi-cloud and hyperscale cloud-provider environments. In addition, the separation of hardware and software provides a much more flexible and cost-effective way to upgrade from one network generation to the next.

To provide solutions that are relevant to enterprises, CSPs must offer capabilities beyond connectivity. Enterprise service orchestration, including exposure of network assets and network slicing, are foundational capabilities to provide value to the application ecosystem and be in control of the network and the delivered services.

Combining 5G and edge to help industries reimagine user experiences

This convergence of compute, storage and networking at the edge coming together for the first time will enable CSPs and enterprises to offer their customers completely reimagined user experiences. Consider, for example, how the automotive industry might enhance how customers shop for a car. As part of Fiat Chrysler Automobiles’ Virtual Showroom at the recent CES 2021 event, consumers were able to experience the innovative new 2021 Jeep Wrangler 4xe by scanning a QR code with their phones, and then see an Augmented Reality (AR) model of the Wrangler right in front of them—virtually placed on their own driveway or in any open space.

By rendering the model in Google Cloud, then streaming it to mobile devices, visitors could also see what the car looked like from any angle, in different colors, and even step inside to see the interior in incredible detail. That is the true digitization of an industry segment and highlights the device-to-network-to-edge-to-cloud application relationship and how it can impact the user experience.

A programmable network unlocks more application use cases

The programmability of the 5G network will truly enable application developers to utilize all the benefits of the underlying network. Programmability supports ease of use and enables CSPs, integrated software vendors (ISVs) and the ecosystem to have the right network-level APIs exposed so that applications can be optimized based on the network behavior and vice versa. Imagine, for instance, automatically pushing applications from a cloud region to the edge based on network latency and performance metrics.

Finally, 5G’s programmability is also about having the right tools available for developers to build and integrate applications on the network with zero-touch onboarding and validation. With this, we’ve come to the point where the network is now a “platform” for application innovation. 

5G and edge will be all about the ecosystem

One thing is for certain: the shift to 5G will place tremendous focus on the ecosystem, and it needs to be an ecosystem that includes CSPs, public cloud providers, application developers and technology providers, all coming together to optimize the user experiences across industry applications. For instance, Google Cloud and Ericsson recently announced our partnership to deliver 5G and edge cloud solutions for CSPs and enterprise.  In addition, Google Cloud is also teaming up with popular ISVs to deliver more than 200 edge applications from 30-plus partners, all running on our cloud.  

With collaboration across ISVs, cloud providers and network equipment providers, we are enabling the rapid delivery and deployment of new vertical services and applications, leveraging capabilities like Anthos, artificial intelligence (AI), and machine learning (ML), as well as multi-vendor, multi-cloud and hyperscale cloud provider service orchestration and global edge networks such as those provided by Google and telecom service providers.

As members of the technology ecosystem, we talk about compute, storage and networking, but when it comes down to it, it’s about optimally placing these resources—whether in the cloud, at the provider core, at the edge or anywhere in between—to maximize the end-user experience. The openness and programmability of 5G lends itself to collaboration like never before. We predict that in 2022 and beyond, it will be all about the ecosystem coming together to leverage 5G and the edge to build innovations that we can’t yet imagine.

To learn more, watch the full Ericsson 5G Things CTO Focus fireside chat, where we discuss these topics and more.

May is a big month for the security industry. It’s been over a year since we gathered for RSA in San Francisco for one of 2020’s last major in-person events. While we likely won’t be together in person this year, it’s an important time for the security community to come together and reflect on many accomplishments, and to consider the challenges still ahead of us. As the world focuses on security incidents and all the risks that still need resolving, it is important to stand back, on occasion, and also note that immense progress has been made by large numbers of small, medium and large enterprises to protect themselves and their customers against increased threats. What is also amazing is to see organizations do this while accelerating their digital transformations, supporting and protecting customers and managing ongoing remote working challenges. We are privileged to play our part in supporting those great teams. 

It’s also been a busy month for us here at Google Cloud since our inaugural CISO perspectives blog post in April. Today, I’ll recap our cloud security and industry highlights, a sneak peak of what’s ahead from Google at RSA and more. 

Thoughts from around the industry 

• Risk Governance of Digital Transformation in the Cloud – In our latest Office of the CISO whitepaper, we shared guidance on both the challenges and opportunities of cloud transformation for Chief Risk Officers, Chief Compliance Officers, Heads of Internal Audit and their teams. A misconception we sometimes see among these executives is that moving to the cloud creates more risk to manage. Having held these leadership positions in previous roles, I believe that the cloud is as much a means of managing security, resilience and other risks as it is a risk in its own right. The whitepaper dives deep into considerations for each of these leadership functions as their organization embarks on a digital transformation journey. 
• The importance of meeting global compliance requirements – Compliance is critical for building trust with customers in regulated industries, especially the public sector. It is worth remembering that in any critical industry, where there can be material impact from incidents, strong industry practices and standards to protect customers are vital (I wrote about this last summer). At Google Cloud, we’re regularly adding new compliance and security certifications to meet our customers’ needs globally. Recently, we expanded our list of FedRAMP High-certified products to include Cloud DNS, and helped our customers in the Asia-Pacific region address various compliance requirements to meet new government regulations for security and data protections. Google Cloud was also the only cloud service provider to complete an annual pooled audit with the Collaborative Cloud Audit Group (CCAG), which is a syndicate of 39 leading European financial institutions and insurance companies who depend on cloud infrastructure and technologies to deliver innovative solutions and experiences for their customers. Having spent most of my career in the financial services industry, I know firsthand the importance of managing risk assessments for outsourced vendors to provide the necessary assurances customers need from their cloud providers. 

RSA 2021 

We have a great lineup of speaking sessions and keynotes from Googlers at RSA this year. Below are the highlights you don’t want to miss: 

• I’ll be doing a session on May 20 about supply chain resilience, where a panel of experts will dive into how we can adjust risk and security initiatives to handle the next “punch to the supply chain.” Additionally, on May 18 I’ll join many of my esteemed CISO leaders from various industries and governments for a keynote discussion on our top security insights, lessons learned and best practices for how we move forward as an industry to address the next wave of challenges. 
• Google’s Senior Director of Information Security Heather Adkins will deliver a session on how to build secure and reliable systems at scale, which will cover principles from Google’s Site Reliability Engineering book with the same title (available for free download here). I’m most looking forward to Heather’s advice for how we as an industry can reshape our security thinking, based on modern architectures and technologies that can help organizations design scalable and reliable systems that are fundamentally secure.
• Nelly Porter, Senior Product Manager at Google Cloud Security, will participate in a panel discussion with security experts on the importance of Confidential Computing technology, how it’s changing the security landscape and where it’s headed. Google Cloud has made great progress in delivering a Confidential Computing portfolio for our customers in regulated industries over the past year, and we’re excited for new milestones in 2021. 

Google cloud security highlights

• Infrastructure and SRE spotlight – Before I joined Google Cloud, I always admired the infrastructure and benefits this organization delivers that are uniquely Google – from the subsea cable innovations to SRE inventions and principles. Security and resiliency are baked into every layer of our infrastructure. Many of the Googlers who build and support our platform have sat in the same seat as our customers, so they understand those needs intimately. Over the last few months it’s been amazing to watch our technical infrastructure team grow, and the direct reliability, operational resilience and security benefits that team brings to our customers. For example, we’ve opened a new region in Poland, announced the first subsea cable that will directly connect the U.S. to Singapore with fiber pairs over an express route, and released an SRE book focused on how organizations can complete a successful cloud migration.
• New security foundations blueprint guide – As part of our mission to deliver the industry’s most trusted cloud, we strive to operate in a shared-fate model for risk management in conjunction with our customers. This includes sharing opinionated step-by-step guidance with key decision points and focus areas for how our customers deploy workloads in Google Cloud. This is why we’ve updated our Google Cloud security foundations guide and corresponding Terraform blueprint scripts. These blueprints are tremendously helpful to many stakeholders within an enterprise, like a CISO that needs to understand our key principles for cloud security, or a C-Suite business leader that needs to quickly identify the skills their teams need to meet an organization’s security, risk, and compliance needs on Google Cloud. 

When we think about the types of features to build into products, we have many principles we follow. But the two that I keep coming back to as crucial are:

1. The need for secure products not just security products. All products should have security built in and while we do build great security products our security and other teams remain focused on constantly enhancing the base levels of security and the security features in all our products. 
2. Defense in Depth. We don’t just focus on defense in depth from attacks – for ourselves and our customers. We also prioritize defense in depth from configuration errors or other hazards. 

As you see below in some of the highlights of new features and products, these represent our commitment to secure products and all forms of defense in depth. 

• Workload identity federation – Service account keys are powerful credentials, and can represent a security risk if they are not managed correctly. A safer approach is to use workload identity federation, using IAM to grant external identities IAM roles, including the ability to impersonate service accounts. This lets you access resources directly and eliminates the maintenance and security burden associated with service account keys. We also offered related overall guidance on the best way to use and authenticate service accounts on Google Cloud.
• VPC-SC Directional Policies – With VPC Service Controls (VPC-SC), admins can define a security perimeter around Google-managed services to control communication to and between those services. Using VPC-SC, you can isolate your production GCP resources from unauthorized VPC networks or the internet. But what if you need to transfer data between isolated environments that you’ve set up? VPC-SC directional policies is a new secure data exchange feature that allows you to configure efficient, private, and secure data exchange between isolated environments. 
• Anthos service mesh supports VMs as well as clusters – Most enterprise compute resources are still in VMs and many will remain there for a long time to come. In Anthos 1.7,  your VM-based workloads can now take advantage of the same mesh functionality as your container-based workloads.
• Cloud Spanner CMEK and Access Approvals – Cloud Spanner is Google Cloud’s fully managed relational database that offers unlimited scale, high performance, strong consistency across regions and high availability. Spanner now supports customer-managed encryption keys (CMEK) and Access Approval, Google Cloud’s industry-leading controls to require approval before access to your content by Google support and engineering teams.
• External Key Manager enhancements – In early 2020 we launched Cloud External Key Manager (Cloud EKM), the industry’s leading Hold-Your-Own-Key (HYOK) product. Using Cloud EKM, the keys used to protect your data stored and processed in Google Cloud are completely hosted and managed outside of Google Cloud infrastructure. Cloud EKM initially launched with support for BigQuery and GCE/PD;  we expanded support for Cloud SQL, GKE, Dataflow Shuffle, and Secret Manager, with CMEK support currently in beta. We also provided in-depth documentation on the functionality, architecture and use cases for Cloud EKM in a new whitepaper.
• Web App and API Protection solution –  Web applications and public APIs are increasingly important to how organizations interface with their customers and partners, and we’ve seen increased investment in tools to protect these resources from fraud and abuse. Google Cloud’s new Web App and API protection solution is based on the same technology Google uses to protect its public-facing services against web application exploits, DDoS attacks, fraudulent bot activity, and API targeted threats. It provides protection across clouds and on-premises environments.
• Threat Intel for Chronicle – Most threat intelligence feeds require security teams to do the implementation and legwork. With our new Threat Intel for Chronicle offering, however, our intelligence insights are applied automatically across your security telemetry to present unique observations within your environment. Threat Intel for Chronicle is exclusively curated for enterprise customers by Uppercase, Google Cloud’s intelligence research and applications team to provide our perspective on threats across the internet and surface them as relevant alerts.

That wraps up another month of thoughts and highlights. If you’d like to have this Cloud CISO Perspectives post delivered every month to your inbox, click here to sign-up, and we’ll see you in June!