What do CIOs and CTOs deliver for the company? If you said “technology,” that’s just the beginning. According to their research, McKinsey found that 85% of CIOs and CTOs interviewed in the spring of 2019 said they were essential for at least two of the three most common CEO priorities—revenue acceleration, improved agility and time to market, and cost reduction.

IT modernization – including migrating to the cloud – is key to business growth and agility. Yet, according to a recent McKinsey study, 80% of CIOs report that regardless of their level of cloud migration, they still haven’t reached their projected agility and business benefits. Sometimes, this is because of issues like training and skills gaps in the IT workforce. Surprisingly often though, the barrier to reaching the goals is based on trade-offs that CIOs themselves feel they must make to strike a balance between the perfect and the possible.

But what if you could have it all without the trade-offs? As Will Grannis, Managing Director of the CTO Office at Google, and Arul Elumalai, Partner at McKinsey & Company discussed in our recent digital conference, many of the compromises CIOs make can be avoided with new technology, modern architectures and by encouraging a transformation mindset across the business. In interviews, CIOs explained how they’ve leveraged the best of the cloud without compromising on security, agility, and flexibility. Here’s how these leaders avoid three of the top perceived trade-offs—both with technology and by transforming their operating model.

Trade-off #1: Developer agility vs. control and governance

Moving to the cloud offers new opportunities for speed, but 69% of organizations indicate that stringent security guidelines and code review processes can slow developers significantly. One CISO of a multinational company mentioned that cloud development was so fast that they had to institute manual checks on their developers’ code. So much for agility. 

To overcome this trade-off and maintain both speed and security, some respondents found success in DevOps, hiring security-experienced talent and introducing automation for security and quality. Building in security into the CI/CD pipeline and increasing automation don’t just eliminate the tradeoff, they result in higher quality and faster innovation.

At Google Cloud, we’ve also observed that customers with strong DevOps practices have increased speed-to-market and product/service quality. From our own journey, we’ve learned seven critical lessons essential to adopting a DevOps model, ranging from taking up small projects and embracing open source to building an overall DevOps culture.

Trade-off #2: Single-vendor benefits vs. freedom from lock-in

CIOs perceive benefits to using the fewest number of clouds, specifically avoiding introducing multiple systems that require their teams to develop and maintain multiple skillsets. Unfortunately, 83% of the CIOs interviewed said that while they would prefer fewer clouds, the potential financial and technical lock-in drives them to multiple providers. 

Successful CIOs said that they can avoid lock-in pitfalls not just with contractual guardrails and executive and board education, but with evolving hybrid cloud technologies that provide additional choices. Hybrid cloud platforms based on containers can further mitigate the risk of using a single cloud vendor. The key to successful hybrid architectures is the infrastructure abstraction and portability that containers create for them, enabling disparate environments to work together. 

This notion has been at the heart of our strategy at Google Cloud with Anthos, which provides an abstraction layer and an application modernization platform for hybrid and multi-cloud environments. Enterprises can use Anthos to modernize how they develop, secure, and operate hybrid-cloud environments and enable consistency across cloud environments.

Trade-off #3: Best-of-breed tools vs. standardization and familiarity

Optimizing tool chains for different environments can improve productivity, but many CIOs believe that this means reduced functionality and tools. While 77% of CIOs said they had to standardize to the lowest common denominator, some have found a better solution. Rather than giving up the languages, libraries, and frameworks that their teams prefer, effective leaders said that they found success by investing in training programs to upscale talent and adopting new open and vendor-agnostic solutions. Architectures that are based on open-source components have been the keys that helped remove this tradeoff, and eliminate the notion of a lowest common denominator. 

This is why we have built Anthos on open-source components like Kubernetes, Istio and Knative. Anthos gives your business the choice you need. With the ability to create code that works in most environments using the tools, languages, and systems you prefer, you can do more without major changes to how you work.

Regardless of your current cloud adoption level, check out “Unlock business acceleration in a hybrid cloud world” to discover more about McKinsey’s findings, including how CIOs drive agility, methods to make trade-offs unnecessary, and how to prepare your team for the cloud. Then, stay tuned for subsequent posts that  take a closer look at how hybrid solutions and strategies can help CIOs drive a transformation mindset across the business—without compromising on security, agility, and flexibility.

On March 15th, the Go team announced Go 1.18 GA, the latest release of the Go programming language. The culmination of over a decade of design delivers the features our developers demanded: generics, fuzzing, and module workspaces. With this release, Go becomes the first major language to integrate fuzz testing into its core toolchain without using third-party support, further establishing Go as a preferred language for developing secure applications.

Go was created at Google in 2007, designed to help developers build fast, reliable, and secure software. Unlike traditional languages, Go was built for the modern multi-core computing world. Go has emerged as a modern language for developing cloud applications, services, and infrastructure. Today Go powers several of Google’s largest products, and is used by many customers to scale their businesses. Organizations big and small love Go and the community of Go developers, known as “gophers” has grown into a global network with over 2 million users worldwide.

Using the power of Go in the Cloud

When looking at the public repos, over 75% of CNCF projects including Kubernetes are written in Go and 10% of developers are writing in Go worldwide (as of May 2021). Google delivers high performance infrastructure to run key, cloud native, Open Source projects. Our modern cloud infrastructure is based on Kubernetes at its core and our strong support for Istio and Knative have formed the base of some of our leading services like Google Kubernetes Engine (GKE), our managed application platform with Anthos, Cloud Functions, and Cloud Run. Google uses Go extensively for a wide range of applications from our indexing platform that powers Google Search, to the server side optimizations that power Chrome’s 1B+ users, to the infrastructure on which Google cloud is built.

Release Highlights

With this new release of Go 1.18, Generics are the biggest change to Go since the language was created. Go developers told us that they feel that Go lacks critical features, with generics being the main missing piece. With Go 1.18, new and existing Go developers can take advantage of the productivity, performance, and maintenance benefits that generics can bring. We’ve already begun to see the new kinds of libraries and projects gophers are building with generics in its short beta period, and expect this creativity to grow as time goes on.

This Go release also brings native support for fuzzing. Fuzzing is a type of vulnerability testing that throws arbitrary data at a piece of software to expose unknown errors and is emerging as a common testing scheme in enterprise development. Go is now the first major language to provide fuzzing support with no third-party integrations necessary, allowing developers to start building secure software with minimal additional cost. Go’s innovative approach to fuzzing can provide not only security for the current code but also ongoing protection as code and dependencies evolve. With attacks on software becoming more common and complex, vulnerability detection can be a critical part of the enterprise development lifecycle, and Go’s fuzzing capabilities catch vulnerabilities earlier in the lifecycle.

Build securely using Go

At Google we are helping to make Open Source software secure. Open source software is a connective tissue for much of the online world. At Google, we’ve been working to raise awareness of the state of open source security and are committed to helping secure the software supply chain for organizations. Go has been designed to create secure applications, helping to minimize risk as much as possible. Go applications compile down to a single binary without local dependencies. It’s not uncommon to see an application built using only the standard library, or only a couple well-vetted Go dependencies. Go’s dependency management uses tamper-evident transparency log, with built in tooling that helps ensure your dependencies are what you can expect. Go has native encryption, which is used across much of the internet, including key components of Google. Go even supports distroless containers, where there are zero local dependencies to worry about. Google Cloud products like Cloud Build, for CI/CDand Artifact Registry, for container management, and have direct access to Go’s vulnerability database and can provide you instant warnings about security threats.

“At Google we are committed to helping to secure the online infrastructure and applications upon which the world depends. A critical aspect of this mission is being able to understand and verify the security of open source dependency chains. The 1.18 release of Go is an important step towards helping to ensure that developers are able to build secure applications, understand risk when vulnerabilities are discovered, and reduce the impact of cybersecurity attacks” said Eric Brewer, VP Infrastructure, Google Fellow

This launch is a significant milestone for Go that helps developers from around the world build more performant and secure applications that run on any infrastructure. For more information on this release and how to get started with Go, please visit.

2020 brought many challenges, especially as in-person operations were shut down, and many were left vulnerable to unemployment.

The State of Rhode Island responded to these challenges, by modernizing their workforce development operations and moving completely to a custom online platform called the Virtual Career Center, also nicknamed “the VCC.”

It was developed in partnership with Google Cloud and a nonprofit called “Research Improving People’s Lives” (RIPL), and was fully built by Google Cloud partner Maven Wave, which helps a wide array of organizations, including public sector customers, with many types of cloud initiatives.

In this episode of Architecting with Google Cloud, we interviewed Joel Osman, head of Digital Experience & Custom Applications at MavenWave who shared a lot of insights such as:

“We looked at how we can apply leading edge emerging technologies to help people get back to work and use them as tools in such a way that we can augment the personal one to one interactions that agencies had been using with job seekers, to help them get back to work.”

One of those key benefits is enabling job seekers to find coaches that are specialized in their respective community. During the in-person walk-in model, applicants were paired on a first come first serve basis with any available coach on site. Meanwhile online scheduling has enabled a greater opportunity to match veterans, college graduates, non-English speakers, etc with coaches with prior experience in that specific area.

How the VCC was built

This VCC web app was built on Angular. It has a custom frontend built on top of 2 key Google Cloud products. The first is Workspace, which includes functionality such as video conferencing, documents, slides, chat, file storage, etc. And the other is Google Cloud computing resources. Here’s a view of the architecture:

There are 3 main types of users at this time, and that’s job coaches, job seekers, and employers.

• 👩‍🔧 Job Coaches all have Google IDs in the Google Workspace domain, and therefore authenticate against the Google identity repository.
• 🕵️‍♂️ Job Seekers are authenticated through a Cognito-based process maintained by the nonprofit I mentioned earlier (RIPL), the Rhode Island infrastructure team, and the Department of Information Technology (DoIT). Cognito was an identity repository setup prior to this project for users interacting with the State, and remained as their form of authentication.
• 🧭 Employers participate directly with Google Meet, and, to an extent, Google Calendar; but not the Angular app. There’s also a focus on building a future dashboard to see how the center has helped employers with applicants.

The specific Google Cloud components used are the following:

• Firestore: realtime Database that keeps data in sync across client apps.
• BigQuery: serverless warehouse for data.
• Data Studio: is used to build filterable dashboards over BigQuery
• Cloud Functions: which serve as triggers to keep scheduling and data workflows in sync.
• Kubernetes cluster: runs & autoscales the server-side code in a single-region deployment, with a minimum of four nodes per zone across three zones of the US East region.
• Cloud Armor: protects applications and websites from attacks, and sets NIST-compliant policies.
• Google’s Content Distribution Network (CDN): content is accessed and cached.

To manage the lifecycle of the infrastructure, a Terraform script is used, which is an open source tool, and is structured into 5 folder environments:

• Admin
• Dev
• QA & UAT
• Networks
• Prod
• Shared Services (for CI/CD pipelines between Dev & Prod).

Adoption outcomes

A universal fear we technical practitioners may have is:

“Will our tool be loved and adopted by our intended audiences?”

 Joel mentioned Job Coaches at the time were not used to working from home, and the team was concerned that they would potentially feel overwhelmed with a lot of new technology.

 As a rewarding surprise, when Job Coaches were presented the proof of concept, it was received with positivity.

“95% of Job Coaches rated the VCC as a valuable solution and 87% reported to find it very or extremely effective.”

This alignment was thanks to designing the tool with the users in mind, and performing user research since the beginning of the journey, which helped address their day to day needs.

Additional innovation for the future

After creating a centralized hub and moving operations to a digital format, many more benefits also arise. For example, there can now be an integrated data analytics view which enables meaningful dashboards that can be customized for different audiences such as job applicants, coaches, program stakeholders, or state agencies.

There can be improved job searchability by integrating machine learning, helping with resume building and parsing that take keywords out of a resume and match them to a variety of relevant job clusters, rather than just performing raw keyword searches.

Embedding chat bots can also help reduce the load of call centers in states, as they utilize natural language processing as well to help guide job seekers with prompt answers.

Conclusion

The State of Rhode Island’s Virtual Career Center is an amazing success story. By having worked with an experienced partner to move their operations to a digital format, they were able to respond to their citizen’s needs in a time where in-person operations were not possible. They also unlocked opportunities such as better matching and reporting along that journey.

For any organization whether they are in the public sector, university, private sector, etc; anyone can take advantage of this platform and customize it to their needs as Maven Wave shared that they offer a menu of options, where you can pick and choose functionality based on your requirements, IT resources, and budget.