Oxford Economics and Google Cloud surveyed 1,000 CIOs across seven industries around the world to understand their approaches to developing strong business partnerships that support innovation and drive business results—and to find out what the most successful companies are doing differently. Download to read more.

I’m excited to share our first Cloud CISO Perspectives post of 2022. It’s already shaping up to be an eventful year for our industry and we’re only in month one. There’s a lot to recap in this post, including the U.S. government’s recent efforts to address critical security issues, like open source software security and zero trust architectures. We’ve also released new resources from our Google Cybersecurity Action Team like the Cloud Security Megatrends and the Boards of Directors whitepaper on cloud risk governance. 

Cloud Security Megatrends 

We’re often asked if the cloud is more secure than on-prem (and why) so we shared our answer in a recent blog post. At Google Cloud, security by design is our priority. We’ve long adopted zero-trust principles for our baseline security architectures and built a global network that relies on defense in depth layers to protect against configuration errors and attacks. But security is always evolving and that is why we also take advantage of the following megatrends:

1. Economy of scale: Decreasing the marginal cost of security raises the baseline level of security. 
2. Shared fate: A flywheel of increasing trust drives more transition to the cloud, which compels even higher security and even more skin-in-the-game from the cloud provider.
3. Healthy competition: The race by deep-pocketed cloud providers to create and implement leading security technologies is the tip of the spear of innovation. 
4. Cloud as the digital immune system: Every security update the cloud gives the customer is informed by some threat, vulnerability, or new attack technique often identified by someone else’s experience. Enterprise IT leaders use this accelerating feedback loop to get better protection.
5. Software-defined infrastructure: Cloud is software defined, so it can be dynamically configured without customers having to manage hardware placement or cope with administrative toil. From a security standpoint, that means specifying security policies as code, and continuously monitoring their effectiveness.
6. Increasing deployment velocity: Because of cloud’s vast scale, providers have had to automate software deployments and updates, usually with automated continuous integration/continuous deployment (CI/CD) systems. That same automation delivers security enhancements, resulting in more frequent security updates.
7. Simplicity: Cloud becomes an abstraction-generating machine for identifying, creating and deploying simpler default modes of operating securely and autonomically. 
8. Sovereignty meets sustainability: The cloud’s global scale and ability to operate in localized and distributed ways creates three pillars of sovereignty. This global scale can also be leveraged to improve energy efficiency.

If you’re an IT decision maker, pay attention to these megatrends that will continue to drive and reinforce cloud security and will outpace the security of on-prem infrastructure well into the future. 

U.S. Federal government cybersecurity momentum 

• Open source software security: Earlier this month, Google participated in the White House Summit on open source software security. The meeting came at a critical time for the industry following December’s Log4j vulnerabilities and was both a recognition of the challenge and an important first step towards addressing it. The open source software ecosystem is not homogenous, despite the fact that the industry often thinks of or treats it this way. Some of it, like Linux, is highly curated, while other critical software is supported through diffuse communities including technology companies and other stakeholders. There is also a long tail of many other critical projects driven by a dedicated community of maintainers around the world, including Googlers. In light of this reality, we welcomed the chance to share our recommendations to advance the future of open source software security. Some work we’ve done includes founding the Open Source Security Foundation, which has been instrumental already in making security improvements. We’ve also helped drive a number of key security initiatives within the open source community including security scorecards, the SLSA framework to improve the security and integrity of open source packages, and Secure Open Source Rewards to financially incentivize improvements to critical open source security projects.  
• OMB’s Federal zero trust strategy: The publication of the Office of Management and Budget’s zero trust architecture strategy marks an important step for the U.S. federal government’s efforts to modernize under Executive Order 14028. Google Cloud supports this approach, which recognizes the immense security benefits offered by modern computing architectures. For the past decade, Google has successfully applied zero trust principles through our BeyondCorp and BeyondProd frameworks for providing end-user access and securing our cloud workloads. And we’ve brought these best practices from our own journey to global governments and businesses of any size through solutions like BeyondCorp Enterprise and capabilities like Binary Authorization and Anthos Service Mesh, which are embedded in Anthos, our managed application platform. For Federal agencies embarking on this zero trust journey, the Google Cybersecurity Action Team will offer our expertise by conducting Zero Trust Foundations strategy workshops, which can help organizations in the public and private sectors develop actionable and achievable strategies and plans for zero trust implementation. 

Google Cybersecurity Action Team Highlights 

Here are the latest updates, products, services and resources across our security teams this month: 

Security

• Democratizing security operations: We recently announced that Siemplify, a leading security orchestration, automation and response (SOAR) provider, is joining Google Cloud to help companies better manage their threat response. Providing a proven SOAR capability with Chronicle’s approach to security analytics is an important step forward in our vision to advance invisible security and democratize security operations for every organization.
• Security by design: The Highmark Health security team is using “secure-by-design” techniques to address the security, privacy, and compliance aspects of its Living Health solution with Google Cloud’s Professional Services Organization (PSO). Google has long advocated for and followed security by design principles, which is why we’re continuously building enhanced security, controls, resiliency and more into our cloud products and services. 
• Secure collaboration for hybrid work environments: The Google Workspace team shared its recommendations for businesses as they prepare for the future of work,  where the hybrid/flexible work model is becoming standard practice and a new approach to security is essential.
• Anthos Policy Controller CIS Benchmark enforcement: A big part of our shared fate philosophy is to build secure products and not just security products. A recent example of this in action is embedding CIS benchmark policy conformance in the Anthos Policy Controller. We believe the more we embed approaches like this into our products, the more application and infrastructure teams can intrinsically embed security at the start and reduce toil for the security team.
• DevOps for technology-driven organizations and startups: A key success factor for many security programs is the partnership and integration with development teams, and there are some great resources and lessons in our DORA research.
• Security by design with Chrome OS: ABN AMRO’s Asia-Pacific region team recently shared how they are using Chrome OS and CloudReady to work securely in the cloud, reduce total cost of ownership, and add flexibility for employees. This is a great example of secure by design principles in the use of Chromium.

Risk & Compliance

• Boards of Directors summary guide to cloud risk governance: The latest whitepaper from the Google Cybersecurity Action Team outlines how boards of directors can prioritize safe, secure, and compliant adoption processes for cloud technologies within their organizations.  
• TruSight Risk Assessment of Google Cloud: TruSight recently released a comprehensive
  risk assessment report on Google Cloud. Our Enterprise Trust team collaborated on this robust assessment of Google Cloud services to validate the design and implementation of controls. TruSight’s risk assessment of our security controls will help customers accelerate and complete their risk management due diligence.
• Data governance: Check out this new blog series on data governance where our teams explain the role of data governance, its importance, and the necessary processes to run an effective data governance program. Implementing data governance will help maximize value derived from business data, build user trust, and ensure compliance with required security measures.

Controls and Products

• Encrypting Data Fusion: To help meet the security, privacy and compliance requirements of customers in regulated industries like finance or public sector, we announced the general availability of Customer Managed Encryption Keys (CMEK) integration for Cloud Data Fusion, which enables encryption of both user data and metadata at rest with a key that customers can control through our Cloud Key Management Service (KMS). 

Don’t forget to sign-up for our newsletter if you’d like to have our Cloud CISO Perspectives post delivered every month to your inbox. We’ll be back next month with more updates and security-related news.

When the world was forced to go primarily online, state governments also faced the reality of needing to provide community services without the health risk of meeting in person. Old systems that relied on interpersonal contact could not keep up. An unprecedented number of displaced workers swamped every unemployment system. The capacity challenges weren’t limited to state labor departments either. Everything from birth certificates and marriage licenses to apostilles and court system services that could usually be handled by a simple walk-in had to be scheduled in advance. Both internal and external communication suffered. 

To meet these challenges, many organizations turned to new technology solutions and innovative approaches.

How VAST helped Arizona get back to work

The State of Arizona had tens of thousands of constituents who relied on pandemic unemployment insurance and would also need tools to reenter the workforce.Tim Tucker, Deputy Administrator of the Workforce Development Administration for the Arizona Department of Economic Security, started preparing in late 2020. He collaborated with Google Cloud and SADA to introduce the Virtual Appointment Scheduling Tool (VAST) to State of Arizona staff members. Using VAST reduced the excessive workload taken on by the Workforce Development Administration as they got Arizona back to work. VAST lets constituents book an appointment, upload documents and forms, and conduct career counseling virtually. This helped constituents move through the system faster so they could successfully reenter the workforce.

That preparation paid off. As of September 2021, Arizona had recovered the majority of the jobs lost during the pandemic. It has also seen one of the smallest percent change in employment compared with pre-pandemic numbers. Even more impressive, Arizona is one of only five states where unemployment claims are now lower than pre-pandemic numbers. Using VAST helped them get people back to work faster and has become a permanent part of their unemployment program.

Bringing streamlined services to the community

To fully realize a solution to the challenges faced by our public sector customers, we focused on three key areas in which we knew we needed VAST to excel:

• Efficient staff allocation
• Streamlined internal meetings
• Confident constituent interactions

We also knew our customers needed to get VAST online fast, and it needed to work with existing infrastructure without requiring a total overhaul. These areas informed the design of VAST’s features and have allowed us to meet the challenges faced by agencies such as the Arizona Department of Economic Security.

Virtual Agent support and integrations

VAST gives constituents 24×7 virtual agent support powered by  Google Cloud’s contact center AI virtual agents. Virtual agents are custom programmed to fit the specific needs of each agency and community they serve. It’s easy to add new options and information whenever an update is needed. Virtual agents can be designed to understand the user’s intent and serve up relevant content for a smooth user experience on both ends of the system. Virtual agents run at scale and offer multi-language support, ensuring they can serve everyone in the community. By pairing these with VAST, constituents can experience seamless self-service. 

6 week deployment time

Most of our public sector clients needed a solution yesterday. VAST can be deployed rapidly, taking about six weeks from start to finish, which includes everything–even staff training time.

 Integration with Google Workspace and Chrome

VAST securely integrates with other Google solutions, such as Google Workspace and Chromebooks. We work to ensure VAST is fully functional within your existing systems.

Collaboration and support

SADA collaborates with each organization to ensure that the design, development, and functionality of VAST align with their needs. SADA specializes in helping public sector customers migrate to Google Cloud. 

Analytics

Application administrators have access to analytic data gathered by VAST and options to customize and add additional datasets.This data helps organizations find blind spots in coverage, fix service bottlenecks, and better organize internal resources. Leveraging this data gives organizations the power to make changes, resulting in everything from a smoother customer experience to cost savings.

To learn more about how Google Cloud has supported Arizona during the pandemic, check out this blog on how their vaccination distribution system leveraged Google Cloud to get the vaccine to more people. For more information on how VAST can streamline a customer experience.

There were several reasons why Suddora and CustomOnIt shouldn’t have been successes. My friend Adam and I were working in a Michigan video store and knew next to nothing about running a business. We started with an idea to sell sweatbands, like the ones I used to wear in my band, and over several months managed to launch it legitimately. This led us to bail on the video store and move to Vegas—smack in the middle of the 2008 financial crisis. We lived on ramen noodles and little else for two years while we got the company going. Our friends took bets on how long we’d stay in business. 

But 11 years later, we have not one but several successful sports apparel businesses, I’m running a bunch of other e-commerce companies (including SweatBands.com), and we’re selling in the United Kingdom and soon in Asia Pacific. 

How did two broke-but-determined guys working in a video store get this far? We always believed in moving ahead, no matter what obstacles came our way—and we learned a lot about how technology like G Suite can make a small business look and operate like a bigger one, and how searching Google for business resources can pay off.

Starting with an idea, a domain and…ramen noodles
In my band days in Michigan, we tried to think of ways to get our name out there. Instead of the usual T-shirts or stickers, I pitched the idea of custom sweatbands since I wore sweatbands when I played guitar. I figured other people might like sweatbands with the names of their bands.

We knew we needed a web domain and email addresses so we could sell online. We found out about G Suite during a Google search, and it seemed like the most pain-free way to get started by buying the domains Customonit.com and Suddora.com (Adam made up that name. “Sudor” is Spanish for “sweat,” which is what the businesses were about, and we added the “d” and the “a” to make the name stand out.).

Even though the company was just me and Adam, we needed to look professional (and also a bit bigger than we actually were). With G Suite, we set up email aliases for various business functions, like help@suddora.com and sales@suddora.com, and arranged to route email from these addresses into our regular Gmail inboxes; that way, customers could easily reach us.

Scaling our business in the Las Vegas heat
Next, we decided to move to Las Vegas because, in the aftermath of the recession, we could live cheaply there. When we got our first big sweatband order from a major NCAA football team,  the momentum started. Now we had to scale up the business so we could handle more orders and deal with suppliers, even though we were still working out of our living room.

We grew to a five-person team, including a customer service person and a designer, and G Suite made it easy to onboard everyone quickly. In addition to giving new employees their own email addresses with the Suddora.com or STbands.com domain names, we routed emails to various people from the “help” and “sales” email aliases we had set up. We also made sure that all of our employees were set up on G Suite, too.

Once orders started to roll in from major fast-food restaurants, football teams, and sports apparel companies, our roles constantly changed. G Suite helped us shave off precious time by helping us manage email less manually—we automatically re-routed emails depending on who’s working on what. If I wanted to take on more sales work, I forwarded emails from sales@suddora.com to my inbox with one click. Same thing with customer service: We never want to lose track of customer service inquiries, which are a high priority.

In 2009, a year after starting the business, Adam and I left our part-time jobs at a local department store to run the business full-time. We promised ourselves that when we hit a revenue target of $15,000 in one month we’d buy a TV for the apartment—and we got that TV!

Going international (without leaving our office)
The business was taking off. We decided to split STbands.com into two websites: Suddora.com for sports sweatbands and CustomOnIt.com for custom apparel and party goods. We recognized that half our customers wanted athletic wear and accessories, while the other half wanted custom items like T-shirts and wristbands. It was a move that would allow each business to thrive.

Creating products and managing suppliers was getting more complicated. Once again, G Suite helped us move our business forward. We used Google search to find suppliers in China, and were able to set up supplier relationships and talk one-on-one with the people making our products—without extensive and time-consuming travel to China. You can accomplish so much with video meetings and chat.

With more suppliers and more customers, we needed to constantly up our game in terms of product design. When we create new designs it generates a ton of files and iterations, which get shared back and forth between pattern designers, photo editors, writers, and marketing professionals. To help centralize these files, we store everything in Google Drive so they can be shared and accessed anytime, from anywhere. For example, we use Sheets to house updated data on our products across all of our e-commerce platforms. 

Lessons learned
Eleven years on, I’m still learning every day about what it takes to run and grow a business. I think what helps is finding tools like G Suite that are so easy to use, you don’t need much ramp-up time to get started—nor do your employees. That means we’re all productive much faster. 

Also, you might be thinking about a million ideas for starting a business. But the truth is, you only need one—an opportunity that makes you think, “Okay, this is going to be big.” So go for it. You can’t afford not to.

The mobile industry is extremely fast-paced. New smartphones arrive at rapid speed. Smartphone OS updates regularly add new features and capabilities. And by the end of 2018, 5G wireless, the game-changing successor to 4G, will begin to be available in some markets.

With more than 125 T-Mobile premium retail stores across the United States, MobileOne is at the forefront of the mobile industry’s constant, rapid-fire changes. The company is growing quickly, too, expanding its number of stores by 340% in just 3 years.

In this high-growth, non-stop environment, MobileOne’s mission is to keep frontline employees trained, informed, and updated at all times so that they, in turn, can serve as trusted experts to customers. Ultimately, the end game is to stay competitive by delivering the kind of positive experience that encourages customers to return, and to recommend MobileOne to friends.

But fulfilling this mission had become a major operational challenge for MobileOne. Information was typically created in the company’s productivity software suite and shared in emailed file attachments through the company’s on-premises email system. The method was slow and inefficient, and it could introduce errors if an outdated file was emailed.

In addition, there were no central, shared, easily accessible repositories of company knowledge. Thus, to find information shared a few months ago, team members might have to search their email archives for the appropriate file, and the search capabilities of MobileOne’s legacy email system were far from robust. Worse, a file that one employee suddenly needed may exist only on the hard drive of another employee who might be away on vacation.

“Without G Suite, I can’t imagine how we could keep up with everything.”

– Revel Stark, Director of Recruiting and Marketing, MobileOne LLC

MobileOne leaders recognized that a digital workforce transformation was needed to help the company stay focused on delivering excellent customer service. In response, the company began moving all employees to G Suite with the help of Suitebriar, a Google Cloud – G Suite Premier partner.

Sharing docs in seconds

G Suite applications help MobileOne team members collaborate, share information, and receive the latest training. G Suite also helps MobileOne move at an accelerated pace. For example, on a recent Sunday, Revel Stark, Director of Recruiting and Marketing at MobileOne, was on his way to the beach with his family when someone in the company needed a document from him right away.

“It took just seconds to launch the Google Drive smartphone app, do a quick search, and share the requested document,” says Revel. “Before G Suite, I’d have to start up my laptop, assuming I even had it with me, and search for the file. If the file wasn’t on my laptop’s drive, it might be Monday before I could have found and shared it. That just doesn’t work for us. Without G Suite, I can’t imagine how we could keep up with everything.”

Creating central repositories

“Now, with Drive and Sheets, everyone has access to the most recent, business-critical information at the same time. Having live spreadsheets helps us ensure that no important information gets lost, despite the rapid pace in which we work.”

– Revel Stark, Director of Recruiting and Marketing, MobileOne LLC

Drive, coupled with G Suite apps such as Docs and Sheets, streamlines document sharing at MobileOne by enabling the company to create central repositories of information that are easily accessible and, with Google search technology, easily searchable.

For example, the company used to track operations, growth metrics, and performance in its legacy productivity suite’s spreadsheet application. The spreadsheet files were shared via email. But given MobileOne’s rapid growth, the information in those spreadsheet files could become outdated quickly. And there was confusion at times about which file was the most recent version.

“Now, with Drive and Sheets, everyone has access to the most recent, business-critical information at the same time,” Revel says. “Having live spreadsheets helps us ensure that no important information gets lost, despite the rapid pace in which we work.”

MobileOne has set up a Team Drive for each of the company’s departments, too. “With Team Drives, department heads can make sure their department’s documents are well organized, up to date, and easy to find,” Revel says. “And they can give access only to the people who need it.”

Streamlining interview schedules

The thousands of apps in the G Suite Marketplace enable businesses to add even more functionality to the G Suite apps that their employees use every day. MobileOne uses a third-party scheduling app that integrates with Calendar to streamline the scheduling of job applicant interviews. “Job applicants can look at our calendar and pick an open slot to schedule their interview,” says Revel. “It speeds up the process by not having to go back and forth in email, trying to find a time that’s mutually agreeable.”

Simplifying admin duties

“Before G Suite, it was time-consuming to add a new user to our email system,” Revel says. “I’d have to ask our service provider, then wait for them to do it. But with the easy-to-use G Suite admin panel, we can add someone to Gmail ourselves in a minute or two.”

Receiving personalized service

To support the rollout, MobileOne worked with Suitebriar, a Google Cloud – G Suite Premier Partner. Suitebriar efficiently set up MobileOne on G Suite and now provides webinars and on-going support to help MobileOne users get more out of G Suite. “Suitebriar is incredibly responsive,” says Revel. “They know our business, they give us personalized service, and they get back to me quickly when I have questions, sometimes in as soon as 30 seconds.”

Driving new business with Forms

MobileOne uses Forms to help it organize public events and, in combination with Sheets, to measure the success of those events.

Last year MobileOne held 200 events across the company’s 125 stores and is planning to hold up to 400 events this year. The events are designed to connect MobileOne associates with local residents and bring people into its stores who might not otherwise visit.

“We developed a pre-event form that stores use to communicate with our corporate office about what’s needed to set up their event,” Revel explains. “And we have a post-event form that stores can fill out to capture what worked and what didn’t work at the event. The information in that form gets dropped into a Sheets spreadsheet, so we can track the success of events across all stores. It helps us focus on the events that drive the most traffic into stores, where we can connect with locals and show them how we can help them.”

Using Hangouts to train — and applaud

“When a team member in the field does something fantastic, we can gather a bunch of people in a conference room, get that team member into Hangouts, and give him or her a round of applause. It’s a great way to give someone a pat on the back.”

– Revel Stark, Director of Recruiting and Marketing, MobileOne LLC

At MobileOne, Hangouts is among the most used G Suite app. The company uses Hangouts to bring executives together in different locations for a weekly briefing. “Hangouts breaks down the barriers that geographical distances create, so that everyone gets quality time together,” Revel says.

Training is another key Hangouts use case. “Because keeping our people well informed is so important, we use Hangouts frequently to train team members,” says Revel. “We’re currently using Hangouts with a Hangouts Meet hardware in our corporate office for training, and we’re considering expanding that by adding 20 to 30 Hangouts Meet hardware in training rooms across all seven states where we operate.”

MobileOne uses Slides for training presentations, which are often scheduled using Calendar and presented in Hangouts. “Calendar makes it easy to set up training events and to see the availability of people you want to invite,” Revel says. When people find a time that works, they simply add a Hangouts link to the calendar event. Then during the Hangouts session, a presenter can launch a Slides presentation, and attendees can ask questions with Hangouts chat. All of this is easy to set up and the training happens in real-time, which gives it more of an impact.

The company is also leveraging Hangouts in a less conventional way. “When a team member in the field does something fantastic, we can gather a bunch of people in a conference room, get that team member into Hangouts, and give him or her a round of applause,” says Revel. “It’s a great way to give someone a pat on the back.