Whether driven by government policy, industry regulation, or geo-political considerations, the evolution of cloud computing has led organizations to want even more control over their data and more transparency from their cloud services. At Google Cloud, one of the best tools for achieving that level of control and transparency is a bit of technological magic we call Cloud External Key Manager (EKM).

Cloud EKM can help you protect your cloud data at rest with encryption keys which are stored and managed in a third-party key management system that’s outside Google Cloud’s infrastructure, and ultimately outside Google’s control. This can help you achieve full separation between your encryption keys and your data stored in the cloud. Cloud EKM works with symmetric and asymmetric encryption keys, and offers organization policies that allow for fine-grained control over what types of keys are used. Via Key Access Justification (KAJ) it also offers a way for clients to control each key use.

At their core, many cloud security and cloud computing discussions are about the kinds of trust that Cloud EKM specifically and encryption more broadly can help create. While the concept of digital trust is much bigger than cybersecurity and its tripartite components of security, privacy, and compliance, one of the most crucial themes of cloud computing is the cloud trust paradox. In order to trust the cloud more, you must be able to trust it less, and external control of keys and their use can help reduce concerns over unauthorized access to sensitive data.

How it works

From our Cloud EKM documentation, you can use keys that you manage within a supported external key management partner to protect data within Google Cloud. You can protect data at rest in services that support CMEK, or by calling the Cloud Key Management Service API directly.

Cloud EKM provides several benefits:

• Key provenance: You control the location and distribution of your externally-managed keys. Externally-managed keys are never cached or stored within Google Cloud. Google cannot see them. Instead, Cloud EKM communicates directly with the external key management device for each request.
• Access control: You manage access to your externally-managed keys. Before you can use an externally-managed key to encrypt or decrypt data in Google Cloud, you must grant the Google Cloud project access to use the key. You can revoke this access at any time.
• Centralized key management: You can manage your keys and access policies from a single location and user interface, whether the data they protect resides in the cloud or on your premises. The system that managed the keys is entirely outside Google control.

In all cases, the key resides on the external system, and is never sent to Google.

Here’s how it works:

1. Create or use an existing key in a supported external key management partner system. This key has a unique URI.
2. Grant your Google Cloud project access to use the key, in the external key management partner system.
3. Create a Cloud EKM key in your Google Cloud project, using the URI for the externally-managed key.

The Cloud EKM key and the external key management partner key work together to protect your data. The external key is never exposed to Google and cannot be accessed by Google employees. Furthermore, Cloud EKM can be combined with Key Access Justifications (KAJ) to establish cryptographic control over data access.

KAJ with Cloud EKM can give customers the ability to deny Google Cloud administrators access to their data at rest for any reason, even in situations typically exempted from customer control, such as outages or responses to third-party data requests. KAJ does this by providing customers a clear reason why data is being decrypted, which they can use to programmatically decide whether to permit decryption and thus allow access to their data.

Previously, we’ve discussed three patterns where keeping the keys off the cloud may in fact be truly necessary or outweighs the benefits of cloud-based key management. Here’s a brief summary of those three scenarios where Cloud EKM can help solve these Hold Your Own Key dilemmas.

Scenario 1: The last data to go to the cloud

As organizations complete their digital transformations by migrating data processing workloads to the cloud, there is often a pool of data that can not be moved to the cloud. Perhaps it’s the most sensitive data, the most regulated data, or the data with the toughest internal security control requirements.

Finance, healthcare, manufacturing and other heavily-regulated organizations face myriad risk, compliance, and policy reasons that may make it challenging to send some of their data to a public cloud provider. However, the organization may be willing to migrate this data set to the cloud as long as it is encrypted and they have sole possession of the encryption keys.

Scenario 2: Regional regulations and concerns

Regional requirements are playing a larger role in how organizations migrate to and operate workloads in the public cloud.

Some organizations are already facing situations where they are based in one country and want to use a cloud provider based in a different country, but they aren’t comfortable with or legally allowed to give the provider access to encryption keys for their stored data. Here the situations are more varied, and can include an organization’s desire to stay ahead of evolving regulatory demands or industry-specific mandates.

Ultimately, this scenario allows organizations to utilize Google Cloud while keeping their encryption keys in the location of their choice, and under their physical and administrative control.

Scenario 3: Centralized encryption key control

The focus here is on operational efficiency. Keeping all the keys within one system to cover multiple cloud and on-premise environments can help reduce overhead and attack surface, thus helping to improve security. As Gartner researchers concluded in their report, “Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data1,” organizations are motivated to reduce the number of key management tools.

“By minimizing the number of third-party encryption solutions being deployed within an environment, organizations can focus on establishing a cryptographic center of excellence,” Gartner researchers said

Given that few organizations are 100% cloud-based today for workloads that require encryption, keeping keys on-prem can streamline key management. Centralizing key management can give the cloud user a central location to enforce policies around access to keys and access to data-at-rest, while a single set of keys can help reduce management complexity. A properly implemented system with adequate security and redundancy outweighs the need to have multiple systems.

Do I need Cloud EKM?

Whether protecting highly sensitive data, retaining key control to address geopolitical and regional concerns, or supporting hybrid and multi-cloud architectures, Cloud EKM is best suited for those Google Cloud customers who must keep their encryption keys off of the cloud and always under their full control.

To learn more about Cloud EKM, please review these resources:

• Our research explaining why Google Cloud users can benefit from Cloud EKM
• The most recent updates to Cloud EKM
• Take a deeper dive into the cloud trust paradox

1. Gartner, Develop an Enterprisewide Encryption Key Management Strategy or Lose the Data, David Mahdi, Brian Lowans, March 2022.

Workplace collaboration continues to evolve as hybrid work expands its footprint. While both “same-time” and “staggered-time” (or asynchronous) collaboration modes each have their place in the hybrid work environment, organizations and teams sometimes overuse one mode over another. That’s probably because in-person meetings or collaborating in real time have been the default for many organizations, leading to a “same-time” bias, even as new tools make working across time zones and locations seamless. Ultimately, the key for making collaboration scalable and to support employee wellbeing is choosing the right method and tool for the task at hand. With that in mind, here are some ways to get the most out of same-time and staggered-time collaboration in your organization.

Making same-time collaboration more valuable

Historically, many organizations have valued same-time interactions for the fast, direct exchange of information and feedback. They also bring teams together and build human connections. While all these outcomes are powerful and important, same-time collaboration also has some drawbacks — especially in a hybrid environment.

First, same-time interactions can be difficult to arrange. Coordinating schedules requires advanced planning, especially when employees are distributed across time zones or working outside of traditional business hours. Second, back-to-back scheduling can contribute to meeting fatigue. In our recently commissioned global hybrid work survey with Economist Impact, 72% of respondents acknowledged that virtual meetings improve inclusion and participation. At the same time, 68% said there are too many virtual meetings in general, suggesting that even though employees value same-time collaboration, they want it in moderation.

To address these challenges, organizations should consider the collaboration scenarios in which same-time interactions can make the greatest impact. It’s particularly useful when consensus or immediate action is needed, as in briefings, decision-making, and crisis management.

For effective same-time collaboration in a hybrid environment, your employees need tools that help them coordinate real-time interactions and minimize time spent switching apps and context. With Google Workspace, teams can create and access a shared agenda or Google Doc inside a Google Calendar invite, helping align expectations and goals before, during, and after scheduled same-time work sessions. And, the more integrated your collaboration tools are, the easier it is for employees to get right to work when inspiration strikes or a quick decision is needed. For example, team members can initiate spontaneous work sessions by starting a Google Meet directly from Docs, Sheets, or Slides.

Additionally, consider how you can bring real-world collaboration activities into virtual environments to enhance same-time collaboration for distributed teams. For instance, digital whiteboard tools, like Jamboard and Miro in Google Meet, allow people to brainstorm, ideate, and problem-solve in real time from anywhere. Interactive solutions like these empower employees to work together in new ways.

Expanding what’s possible with staggered-time collaboration

Widespread adoption of hybrid work has prompted organizations to turn more frequently to staggered-time collaboration — where team members are free to share and respond to information in their own time. A key benefit of staggered collaboration is improving the experience and wellbeing of employees — specifically, by promoting participation across the team and support for flexible work habits. Allowing team members to engage when they’re most productive, or when it doesn’t interfere with their scheduled focus time, supports their wellbeing. It can also help employees feel heard, valued, and empowered. Staggered-time collaboration can also give team members who may feel uncomfortable or vulnerable speaking up in real time, or who just need time to think about their feedback, a more inviting way to share their perspectives.

Staggered-time collaboration can enhance a range of collaboration scenarios, including assigning tasks and action items, knowledge- and resource-sharing, brainstorming, and giving feedback. To make these interactions successful, employees need secure, intuitive tools that give them the information they need to do their jobs from anywhere, at any time. For example, in Spaces, team members can initiate and take part in group chat threads devoted to project- and topic-based discussions, as well as access files and tasks, to stay in the loop whenever they’re able to participate. For people working on a task or project at varied times, creating a dynamic, single source of truth makes all the difference.

When collaborating on shared documents, a feature like smart canvas enables teammates to assign tasks, build checklists, and share files using @-mentions for easy information access. Meanwhile, automated, built-in summaries in Docs help the team get up to speed without losing focus. Features like these help everyone stay on the same page (literally), even if they’re contributing to a project at different times.

Flexibility and collaboration are not mutually exclusive

Helping people know which tasks call for real-time collaboration and which tasks are better done on their own time is critical for sustaining productivity and wellbeing in a hybrid work world. Employees who are empowered to work in ways that complement their needs, preferences, and schedules typically reward their organization for that flexibility. As Holger Reisinger, Paul Sephton, and Dane Fetterer wrote for the Harvard Business Review, “When leaders give employees the freedom to choose where and when they work, it signals they trust them to do the job they were hired to do. The data shows that that trust is then paid back…at a very high rate, building a tight-knit culture of inclusivity and belonging.”

When you create team norms around same-time and staggered-time collaboration, you can help your employees stay productive and connected — to each other and the broader organization. And by giving them tools that support seamless, secure collaboration experiences from anywhere, the impact on productivity, employee wellbeing, and morale can be transformational.

In 2020, many businesses across industries turned their focus and investments towards digital strategies. APIs being an integral part of every organization’s digital disruption, will grow in relevance throughout 2021. Read the report to gain more insights on driving API-led digital transformations and in-depth analysis of Google Cloud’s Apigee API Management Platform usage data, case studies and third-party surveys conducted with tech leaders.

More than 3 billion users stay in touch, share ideas, and get more done together in Google Workspace, across apps like Meet, Chat, Drive, Docs, Sheets, Slides, and more. And starting today, we’re rolling out a new version designed to help people bring the apps they know and love to use in their personal lives to their work life. The new Google Workspace Essentials Starter Edition is a no-cost solution for business users looking to enhance teamwork and unlock innovation with secure-by-design collaboration. With Essentials Starter, we’re making it easy for employees to choose their own productivity tools and bring modern collaboration to work.

Work easily and securely within your current environment

As the world of work continues to evolve in unprecedented ways, secure collaboration—at speed, at scale, across platforms, on multiple devices—has never been more important. Essentials Starter helps employees and their teams break down silos and work together in new ways, even if their organization still relies on legacy productivity tools that weren’t built for the hybrid era of work. There’s no need for a new email address, file conversions, new plug-ins, or desktop software. All of the tools in Essentials Starter will work quickly and easily within your existing environment. And because we designed Google Workspace to operate on our industry-leading cloud foundation, Essentials Starter provides encrypted and secure access to files, helping keep users safe and their information private.

How Essentials Starter works

1. Sign up with your work email for a no-cost Essentials Starter account. No credit card required and there’s no limited trial period.
2. Invite teammates to collaborate using Google Docs, Slides, Sheets, Chat, Drive, and Meet.
3. Unlock innovation with new ways of working with immersive, virtual meetings, and by storing, sharing, and collaborating on 100+ file types, including Microsoft Office, without the need for file conversions.

Collapse the boundaries between people, places, and timezones

In our recently commissioned hybrid work global survey with Economist Impact, when workers were asked what was most important to realize the benefits of hybrid work, their number one choice was “new technologies that allow for time and location flexibility.”*

Google Workspace was born in the cloud and designed for maximum flexibility; to be used from the location and device of your choice. Google Workspace brings chat, files, meetings, and your favorite apps into an intelligent hub so you—and your team—can connect, create, and collaborate from your PCs, tablets, and smartphones, across locations and time zones.

Modern collaboration capabilities

Using the cloud-first approach of Google Workspace, teams can:

• Experience modern collaboration without the burden of version control or email attachments. Brainstorm, build presentations, and glean insights from data using Google Sheets, Slides, and Docs.
• Host secure video meetings to bring everyone together in one place. Conduct one-to-one video meetings (unlimited) and immersive team meetings (3-100 people; up to 60 minutes in duration each).
• Real-time messaging with Google Chat. Share quick updates, files, and high-fives across the team with Google Chat, from one-to-one messages to larger group conversations.
• A dedicated place for team collaboration in Spaces. Spaces are tightly integrated with Google Workspace tools like Chat, Drive, Docs, Sheets, Slides, and Meet, providing a better way for people to engage in topic-based discussions, share knowledge and ideas, move projects forward, and build communities and team culture.
• Access work content securely from your devices. With 15 GB of storage in Google Drive, you can store, share, and access work content from your mobile device, tablet, or computer, and Drive for desktop can enable you to sync files and folders to your PC or Mac. Your Drive storage limits remain separate across your personal and Google Workspace Essentials Starter user accounts.
• Work with existing tools without file conversions. Store, share, or co-edit 100+ file types, including Microsoft Office documents and PDFs without the need for file conversions.
• Easily manage your team of collaborators. Add and remove team members effortlessly using a simple dashboard.

Over the past two years, organizations around the world have relied on Google Workspace to reimagine how work happens and enable modern collaboration across their teams to unlock innovation. During a time of enormous uncertainty, our customers have launched game-changing products, reached new audiences, accelerated lifesaving research, and digitally transformed their own customer experiences. Along the way, they’ve used Google Workspace to empower their employees—across homes, offices, and on the frontlines—to connect, create, and collaborate in powerful new ways. And starting today, with Essentials Starter, employees can make the switch from legacy productivity tools and experience the difference with Google Workspace.

Get started today.

^{* Economist Impact survey commissioned by Google in October 2021. The most popular answer when workers were asked about the most important condition needed to achieve the long-term success of hybrid work models was based on 42% of 1,244 respondents.}

Many organizations, including Google, have moved quickly to embrace working from home. With this widespread remote work, it’s never been more important for IT admins to be certain that every device in their organization is secure, even when that device isn’t company-owned. 

We pioneered zero-trust security through our BeyondCorp strategy and leverage it to offer advanced security for G Suite* users to protect secure access for all devices. Admins can enforce these controls across G Suite and other corporate applications and data, ensuring consistent security and user experience across your organization.

Today, we’re laying out six key controls that IT admins can use within G Suite to help keep their organizations safe when using the bring your own device approach (BYOD). You can also review our detailed security checklist here, and learn more from our course on Managing G Suite here. 

Secure mobile and desktop devices with endpoint management

BYOD devices can differ widely across an organization, with a range of OS versions, hardware modes, patch versions, and more, so it’s impossible to rely on a one-size-fits-all approach to device management. With Google endpoint management, IT admins can easily support a variety of mobile and desktop devices by enforcing measures like minimum software versions and blocking jailbroken or rooted devices, in many cases without requiring full device rights for employee privacy. 

When it comes to managing mobile devices, G Suite offers basic and advanced mobile device management:

• With basic mobile device management, BYOD devices are secured with baseline security features with no end user friction. Admins can enforce a passcode, get a device inventory, wipe Google accounts remotely, and even remotely install applications on Android devices. 
• With advanced mobile device management, admins can apply more policy controls over BYOD devices, and Android users can keep their personal data private and separate from their work data with Android Work Profiles. You can also allow and manage work apps on iOS and Android devices.

Admins can also manage and secure desktop devices with fundamental device management and enhanced desktop security for Windows. With fundamental device management, when a user logs into G Suite through any browser on a Windows, Mac, Chrome, or Linux device, that device will be automatically enrolled with endpoint management. This provides a base level of security to every desktop device that accesses G Suite data. With enhanced desktop security for Windows, admins can easily manage and secure Windows 10 devices through the admin console.

Enable secure connections without a corporate VPN using context-aware access

Context-aware access offers protection from unwanted access to G Suite services without the need for a VPN, and allows admins to set up different access levels based on a user’s identity and the context of the request, taking into account factors such as the country, device security status, and IP address of the request. For example, you can require BYOD devices accessing G Suite to meet encryption and password requirements, or restrict contractors from accessing G Suite from company managed Chromebooks.

Control data access with app access control

It’s important to protect all devices in your organization—corporate or BYOD—from malicious apps trying to gain access to corporate data. Using app access control, admins can take steps to prevent these apps from tricking users into mistakenly granting access to corporate data. With this feature, admins can choose which third-party apps are allowed to access users’ G Suite data by explicitly trusting, limiting, or blocking access for apps.

Enforce 2-Step Verification

With 2-Step Verification, admins can reduce the risk of unauthorized access by asking users for additional proof of identity when signing in. And you can now use the Advanced Protection Program—our strongest protection for users at risk of targeted attacks. With the Advanced Protection Program for the enterprise, we’ll enforce a specific set of policies for enrolled users including security key enforcement, blocking access to untrusted apps and enhanced scanning for email threats

If you choose not to use security keys for any reason, you have multiple other options to enforce 2-Step Verification on BYOD devices. For Android and iOS, you can use Google prompt, Google Authenticator, text message, or phone call options for a second verification step.

Prevent data loss and leakage with data loss prevention

We know that as an admin, one of your highest priorities is to keep internal information safe and secure. That’s why we developed data loss prevention (DLP) policies to help protect sensitive information in Drive, Docs, Sheets, Slides, and Gmail from loss, misuse, or being accessed by unauthorized users. With G Suite DLP, admins can choose which types of data are sensitive and exactly how to protect them. Our controls enable easy detection of a wide variety of common info types, and administrators can supplement this with custom content detectors to meet their organization’s needs. You can also classify files in Drive automatically using DLP rules (beta) to categorize your data by sensitivity levels. DLP works on all the devices in your organization, including BYOD ones, since the protection is at the data and application level. 

In addition to DLP, you can use DXP for iOS devices to restrict the copy/pasting of G Suite data to other accounts, personal or otherwise. DXP for iOS can also restrict users’ ability to drag and drop files from specific apps within their G Suite account. Similarly, you can use Google endpoint management to configure Android devices to prevent data sharing between personal and work profiles.

Make retention and eDiscovery possible on all your devices with Vault

To support your organization’s retention and eDiscovery needs, Vault enables corporate data that’s stored in G Suite and accessed by BYOD devices to be available for all your information governance needs. No matter the owner of the device, your organization’s data stored in Gmail, Drive, Chat, Groups, Voice, and Meet are accessible to Vault.

Using the zero-trust security model, the G Suite features above work together to keep your data protected and organization secure across all devices, whether they’re corporate-owned or BYOD.

(*Google Workspace was previously G Suite)