New Certificate Manager Helps Leverage Google’s Network Security and Performance
3030
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
We’re excited to announce the public preview of Certificate Manager and its integration with External HTTPS Load Balancing. Certificate Manager enables you to use External HTTPS Load Balancing with as many certificates or domains as you need. You can bring your own TLS certificates and keys if you have an existing certificate lifecycle management solution you’d like to use with Google Cloud, or enjoy the convenience of our fully Managed TLS offerings.
Extend the security and performance of the Google network to your customers
Certificate Manager brings support for multiple certificates per customer. When coupled with our global anycast load balancing solution with automated autoscaling and failover, you now have a powerful platform for building robust SaaS and PaaS offerings. This enables custom domain support for your customers with the lowest latency and the highest level of availability.
Alon Kochba, the head of web performance at website-building service Wix, explained how the new features lighten their workload.
“As a SaaS product, we need to terminate SSL for millions of custom domains and certificates. GCP’s Certificate Manager and External HTTPS Load Balancing lets us do this at the edge, close to the clients, without having to rely on our own custom solution for terminating SSL,” Kochba said.
Customers who switch to External HTTPS Load Balancing can also now protect their SaaS users from denial of service attacks, OWASP Top 10 risks, and other common Web attacks by adopting Cloud Armor.
DNS authorization
This release also now enables you to provision your Google-managed certificates with DNS-based authorizations and have them ready to use before your load-balancing production environment is fully set up. This will help streamline the migration process to Google Cloud, for example. To create a DNS authorization, use the following command:
gcloud beta certificate-manager dns-authorizations create example-authorization --domain="example.com"
This command returns the CNAME record for _acme-challenge.example.com that you must add to your DNS configuration in the DNS zone of the target domain. This CNAME record points to a special Google Cloud domain, e.g.: “534959-1a8a-40cf-90b6-b1f5f8d22517.2.authorize.certificatemanager.goog” that is used to verify domain ownership.
When you request a certificate based on the above authorization, Cloud Certificate Manager will work with the Certificate Authority automatically to get and later renew your certificate for that domain.
Wildcard support
This DNS-based domain control authorization also allows us to bring you support for wildcard certificates. To configure the use of wildcard certificates you first must configure the DNS authorization as we’ve indicated above. Once that has been completed, you can configure the use of a wildcard certificate using the following command. Our example below is for a top-level registered domain and its wildcard subdomains.
gcloud beta certificate-manager certificates create example-wildcard-certificate --domains="example.com,*.example.com" --dns-authorizations="example-authorization"
Monitoring for Certificate Expiration
Another new feature that will be enabled with this product is the ability to monitor certificate expiration with Google Cloud Logging. Cloud Logging creates a record of certificate expiration, uses the `certificatemanager.googleapis.com/Project` monitored resource, and is represented by the following message:
message CertificatesExpiry {// Expiration state of the certificate.enum State {// Unspecified state, should never be reported.STATE_UNSPECIFIED = 0;// Certificate will expire soon.CLOSE_TO_EXPIRY = 1;// Certificate is expired.EXPIRED = 2;}// Number of reported certificates.int64 count;// Names of reported certificates. If there are too many, the list is sampled.repeated string certificates = 2;// State of reported certificates.State state = 3;// Approximate expiration time of reported certificates.// Multiple certificates with close expiration time are batched// together in a single log, so the timestamp is not precise.google.protobuf.Timestamp expire_time = 4;}
The log message is delivered every hour and contains a sample of the certificates being close to expiry or already expired.
Pricing
The best part is that there’s no additional charge to use the Certificate Manager for the first 100 certificates. To use more than 100 certificates with the management tools, we will charge on a per-certificate, per-month pricing structure. This empowers you to scale up to as many certificates as you need, and as cost-effectively as possible. The pricing will be enabled when the solution goes to General Availability.
It is our hope that these new features, combined with the programmability offered by Certificate Manager, will enable you to simplify the way you deploy HTTPS and offer a more scalable and secure service to your customers.
Efficient, Safe and Dynamic Gaming Experience: Aristocrat’s Digital Journey on Google Cloud
4759
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
Since Aristocrat’s founding in 1953, technology has constantly transformed gaming and the digital demands on our gaming business are a far cry from challenges we faced when we started. As we continue to expand globally, security and compliance are top priorities.
Managing IT security for several gaming subsidiaries and our core business became more complex as we entered into new markets and scaled up our number of users. We needed a centralized platform that could give us full visibility into all of our systems and efficient monitoring capabilities to keep data and applications secure. We also needed the ability to secure our systems without compromising user experiences.
We turned to Google Cloud and Splunk to better manage complexity and support highly efficient, secure, and more dynamic gaming experiences for everyone. We are committed to using today’s modern technologies to give players more optimal experiences.
Bringing our digital footprint into the cloud
When we set out on our digital transformation, we looked to address many business requirements.
These requirements included:
- Regulation: We wanted a platform that could efficiently address our industry’s stringent and global regulatory compliance requirements.
- Player experience: Our IT environment must support smooth gaming experiences to keep users engaged and satisfied.
- Scalability: As we grow and diversify, meeting the changing demands of an increasingly global gaming community, we need an easily scalable platform to align with our current and future needs.
Google Cloud offered us the perfect foundation through solutions such as Compute Engine, Google Kubernetes Engine, BigQuery, and Google Cloud Storage. These acted as the right infrastructure components for us for the following reasons:
- Google Cloud is globally accessible and supports compliance, helping to streamline security and regulatory processes for our team.
- With Google Cloud, we can manage our entire development and delivery processes globally with fast and efficient reconciliation of regional compliance requirements.
- When we need to adjust existing infrastructure or deliver new capabilities, Google Cloud accelerates the process and takes the heavy lifting off of our team.
- Google Cloud allows us to support tens of thousands of players on each of our apps while experiencing minimal downtime and low latency. The importance of this support can’t be underestimated in an industry where players have little to no patience if lags in games occur.
We migrated our back-office IT stack alongside our consumer-facing production applications to Google Cloud given our positive experiences with compliance, security, scalability, and process management. This migration has significantly accelerated our digital transformation while streamlining our infrastructure for faster and more cost-effective performance.
In many ways, Google Cloud has been, with maybe a pun intended, a game-changer for us. For instance, when we suddenly had to support a lot of remote work during the COVID-19 pandemic, native identity and access management tools in Google Cloud allowed us to retire costly VPNs used for backend access and quickly adopt a more easily managed, cost-effective zero-trust security posture.
Accessing vital third-party partners and managed services
Aristocrat has many IT needs best addressed in a multi-cloud environment. Google Cloud is particularly attractive given its strong cloud interoperability, as well as the many products and services available on Google Cloud Marketplace. The marketplace accelerated our deployment of key third-party apps including Splunk and Qualys.
Given the personal information we store and the global regulatory compliance statutes we must oblige, security lies at the heart of our business. Splunk is a critical component of our digital transformation because it offers solutions that provide the enhanced monitoring capabilities and visibility we need. The integration between Splunk and Google Cloud gives us confidence that our data is secure. We know our data can be secure in Google Cloud, while simplified billing through Google Cloud Marketplace makes payments and license tracking easier for our procurement team.
As part of our protected environment, we use the Splunk platform as our security information and event management system, leveraging the InfoSec app for Splunk that provides continuous monitoring and advanced threat detection to significantly improve our security.
We can manipulate and present data in Splunk in a way that provides us with a single pane-of-glass for our hybrid, multi-cloud environment and our third-party apps and systems. Splunk observability tools have likewise helped us to track browser-based applications like our online gaming apps to monitor details related to security and performance.
Splunk and Google Cloud have transformed how we operate. We can now quickly ingest and analyze data at scale within our refined approach to security management by offloading software management to Splunk and Google Cloud. This ability enables us to approach security more strategically, and positions us to integrate more AI/ML capabilities into our products for even greater governance and performance.
This is just the beginning of our journey with Splunk and Google Cloud. We’re excited to see the innovation we can continue bringing to the gaming community worldwide.
The Many Risks of Ignoring the Impact of a Tighter Cloud Security Framework
DOWNLOAD WHITEPAPER3233
Of your peers have already downloaded this article
3:30 Minutes
The most insightful time you'll spend today!
The perimeter has disappeared and access to company data is no longer limited to your physical office or your employees. Instead, in today’s transformed workforce – increasingly connected, collaborative and in the cloud – the security perimeter has become dispersed and elastic, wrapped around each user and device.
Moreover, ‘users’ no longer refers to simply employees, but also vendors, partners, contractors, and customers. Each of these groups has its own requirements – access to different information and applications, from different locations and different devices. In this ever-evolving ecosystem of users, apps, and devices, traditional approaches to identity and access management aren’t ready for this new environment.
Time-consuming and complex, these approaches were built for the on-premise world (think cumbersome VPNs, limited device access and inconvenient authentication), instead of today’s cloud-first world.
Organizations are also facing increased pressure for digital transformation, higher compliance standards to prevent the loss of company data, and more sophisticated cyber-attacks – it’s no wonder organizations are grappling with these unprecedented pressures. Clearly, a new approach to identity management is needed.
That’s where Cloud Identity can help – an identity, access and device management (IAM/EMM) platform that helps organizations maximize user and IT efficiency, protect company data with Google-grade security, and transition to a digital workspace at their own pace.
AirAsia’s CIO Speaks Up: Why He Decided, What He Did
3313
Of your peers have already read this article.
2:45 Minutes
The most insightful time you'll spend today!
At AirAsia, we operate a fleet of more than 270 aircraft across 23 markets, fly to more than 150 destinations and carry 100m guests each year. We’ve also been named the world’s best low-cost carrier for 11 years running. To accomplish all of this, we rely heavily on our 22,000 Allstars (employees). As AirAsia co-founder Tony Fernandes likes to say, “it has always been about the people.”
With Cloud Identity in place, our IT department can spend less time worrying about managing multiple on-premises directory servers and and can instead focus on delivering value to our Allstar employees.
–Declan Hogan, Group CIO, AirAsia
In my role as CIO, it’s critical that I give our Allstars the tools and technology they need to get their jobs done, while at the same time ensuring that our company’s data is protected and secure. While this is challenging enough in normal circumstances, we’re also in the midst of rapidly moving from legacy on-premises technologies to the cloud. Google Cloud has been a critical partner for us in this journey.
Identity Challenges
AirAsia, like many other enterprises, has relied on a legacy on-premises directory for many years. As our company has quickly grown and expanded to new markets and regions, we’ve had to manage multiple servers across a number of on-premises data centers and the public cloud, which has proved costly and time-consuming.
Our Allstars, located all across Asia, need to easily access a number of legacy on-premises apps in addition to a growing number of SaaS apps. As a business, we also needed a more seamless integration between our HR system of record and our identity solution for user provisioning and lifecycle management.
Deploying Cloud Identity is a key step towards enabling the BeyondCorp (or zero trust) security model, which we feel is the best approach to strengthen our security posture and fight modern threats.
–Declan Hogan, Group CIO, AirAsia
Solving these challenges with our existing on-premises directory was simply not feasible for us.
In recent years, we partnered with Google Cloud to help drive our digital transformation, including moving dozens of workloads and apps to Google Cloud Platform (GCP), deploying G Suite as our collaboration and productivity solution for all of our employees, and replacing thousands of Windows laptops with fast and secure Chromebooks.
We brought up our identity concerns with the Google Cloud team, and after a number of conversations, we decided to deploy Cloud Identity, Google’s cloud-based identity and access management solution, to help address the identity challenges we were facing.
Why Cloud Identity for AirAsia?
We ended up choosing Cloud Identity for a few key reasons. Here at AirAsia, we are eager to move to the cloud as quickly as possible, and moving identity management to the cloud is a key enabler of this and our broader digital transformation. Managing identities from the cloud also enables us to have a single identity and set of credentials for each employee, which they can use to access all of the applications they need to be productive, both in the cloud and on-premises.
In addition, deploying Cloud Identity is a key step towards enabling the BeyondCorp (or zero trust) security model, which we feel is the best approach to strengthen our security posture and fight modern threats.
Cloud Identity also integrates seamlessly with our existing technologies, which includes not only Google Cloud products like GCP, G Suite, and Chrome OS, but also third party tools like Citrix, Papercut, and others.
And finally, Cloud Identity offered us significant cost and resource savings. With Cloud Identity in place, our IT department can spend less time worrying about managing multiple on-premises directory servers and and can instead focus on delivering value to our Allstar employees.
5150
Of your peers have already watched this video.
14:00 Minutes
The most insightful time you'll spend today!
How Google Workspace Helps Manage, Govern and Protect Sensitive Data
The shift towards a hybrid work style and trends accelerated by the pandemic has resulted in data deluge. With companies and individuals sharing increasingly large volumes of information and collaborating with internal and external stakeholders, the need for innovations for higher security also escalates. View this video to learn how Google Workspace approaches security across content lifecycle from client-side encryption updates, data loss prevention, Google Vault, data regions, labels, and more!
Register to Watch July’s Security Summit
2899
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
Together we can solve for the future of cloud security. Join us to learn how you can stay ahead of the next generation of threats with Google Cloud – whether you need to keep your organization secure in the cloud, on-premises, or in a hybrid environment. Get fresh insights from industry leaders and engage in interactive sessions that can help you solve your most critical security challenges.
Our digital event has ended, but you can still explore our sessions on demand.
The Security Summit is part of our digital Google Cloud Summit series. Check out the other events in the series to explore Google Cloud technology applications in various industries and dive into our latest digital innovations.Original air date:20 July 2021 21:30 Register to watch on demand.
More Relevant Stories for Your Company
Protect Users in Apps with Multi-Factor Authentication
These days, using a password alone to secure user accounts containing sensitive, identifiable, or private information just isn’t sufficient. Passwords are often subject to reuse and can easily be phished and stolen. With this in mind, we recently teamed up with researchers from New York University and the University of
5 Compelling Ways to Practice the Principle of Least Privilege for Security Leaders
When it comes to security, managing access is a foundational capability—whether you’re talking about a physical space or your cloud infrastructure. If you were securing an office, you wouldn’t give every employee a master key that can open the front door, the mailbox, and the safe. Likewise, when you’re securing
Three Lesser-Known Ways to Protect Your Customers and Business From Phishing and Fraud
Your users are critical to your business, and you need security controls to keep them — and your business — safe. Built from years of Google Cloud technology and experience, these security features focus on keeping users safe on the web. You can reduce online fraud (chargebacks, hijackings, and abuse)
How to Retrace the Steps of a Potential Phishing Attack with Threat Analytics
The majority of cyber attacks begin with phishing emails and websites. Attackers use many tricks, including by leveraging enterprise brand assets, such as company names and logos, to develop phishing websites that appear authentic and lure internet users to enter valuable information such as user names and passwords. Experts say
