This blog includes content from Episode One “Confidentially Speaking” of our Cloud Security Podcast, hosted by Anton Chuvakin (Head of Solutions Strategy) and Timothy Peacock (Product Manager). You should listen to the whole conversation for more insights and deeper context.LEARN MORECloud Security Podcast – Confidentially SpeakingListen to the Cloud Security Podcast with guest Nelly Porter, Group Product Manager @ Google.

We all deal with a lot of sensitive data and today, enterprises must entrust all of this sensitive data to their cloud providers. With on-premises systems, companies used to have a very clear idea about who could access data and who was responsible for protecting that data. Now, data lives in many different places—on-premises, at the edge, or in the cloud. 

You may already know that Google Cloud provides encryption for data when it is in transit or at rest by default, but did you also know we also allow you to encrypt data in use—while it’s being processed? 

In this podcast episode, Product Manager Nelly Porter gave us a peek under the hood of  confidential computing at Google Cloud. 

What is confidential computing? 

Google Cloud’s Confidential Computing started with a dream to find a way to protect data when it’s being used. We developed breakthrough technology to encrypt data when it is in use, leveraging Confidential VMs and GKE Nodes to keep code and other data encrypted when it’s being processed in memory. The idea is to ensure encrypted data stays private while being processed, reducing exposure.

During the episode, Nelly Porter explained that Google Cloud’s approach is based on hardware and CPU capability. Confidential Computing is built on the newest generation of AMD CPU processors, which have a Secure Encrypted Virtualization extension that enables the hardware to generate encryption keys that are ephemeral and associated with a single VM.  Basically, they are never stored anywhere else and are not extractable—the software will never have access to those keys. 

“You can do whatever you need to do, but you will be in a cryptographically isolated space that no other strangers passing by can see.”

Memory controllers use the keys to quickly decrypt cache lines when you need to execute an instruction and then immediately encrypts them again. In the CPU itself, data is decrypted but it remains encrypted in memory. 

Confidential computing aims to mitigate gaps in data security

Nelly also shed some light on why confidential computing will continue to play a central role in the future of cloud computing. She pointed out that one of the biggest gaps companies are looking to cover is securing data when it is in use. 

Data that is encrypted on-premises or in cloud storage, but the biggest risk for companies is when they start working with that data. For instance, imagine you encrypted your data on-premises and only you hold the keys. You upload that data into Cloud Storage buckets—simple, safe, and secure. 

But now, you want to train machine learning models based on that data. When you upload it into your environment, it’s no longer protected. Specifically, data in reserved memory is not encrypted.We’re trying to ensure that your data is always protected in whatever state it exists, so fewer people have the opportunity to make mistakes or maliciously expose your data.

Top takeaways about confidential computing 

Throughout the conversation, Nelly also shared interesting points about the development and direction of confidential computing at Google Cloud. 

Here were our favorite takeaways from the podcast: 

We worked hard to make Google Cloud’s approach simple.
We’ve invested a lot of time and effort into investigating the possibilities (and limitations) of confidential computing to avoid introducing residual risks to our approach. For instance, the early introduction of hardware capable of confidential computing in the industry required IT teams to have the resources to rewrite or refactor their app, severely limiting their ability to adopt it within their organizations. 

With Confidential Computing, teams can encrypt data in use without making any code changes in their applications.  All Google Cloud workloads can run as Confidential VMs, enabled with a single checkbox, making the transition to confidential computing completely simple and seamless. 

“A lot of customers understand the values of confidential computing, but simply cannot support re-writing the entire application. It’s why Google Cloud, in particular, decided to take a different approach and use models that were incredibly easy to implement, ensuring that our customers would not have those barriers to cross.”

Confidential computing is for more than just fintech. 
There is, of course, a compelling use case for confidential computing at highly-regulated companies in financial, government, life sciences, and public sectors. However, Nelly shared that her team didn’t anticipate that even verticals without significant regulation or compliance requirements would be so interested in this technology, mostly to pre-empt privacy concerns. 

Many companies see confidential computing as a way to create cryptographic isolation in the public cloud, allowing them to further ease any user or client concerns about what they are doing to protect sensitive data. For instance, during COVID-19, there was an increase in small research organizations that wanted to collaborate across large datasets of sensitive data. 

“Prior to confidential computing, it wasn’t possible to collaborate because you needed the ability to share very sensitive data sets among multiple parties while ensuring none of them will have access to this data, but the results will benefit all of them—and us.”

An open community, working together will be key for the future. 
Nelly also shared that there are plans to extend memory protections beyond just CPUs to cover GPUs, TPUs, and FPGAs. Google Cloud is working with multiple industry vendors and companies to develop confidential computing solutions that will cover specific requirements and use cases.

Confidential computing will not be achieved by a single organization – it will require many people to come together. We are a member of the Confidential Computing Consortium, which aims to solve security for data in use and includes other vendors like Red Hat, Intel, IBM, and Microsoft. 

“Google alone would not be able to accomplish confidential computing. We need to ensure that all vendors, GPU, CPU, and all of them follow suit. Part of that trust model is that it’s third parties’ keys and hardware that we’re exposing to a customer.”

There are no magic bullets when it comes to security. 
Confidential computing is still an emerging, very new technology and unsurprisingly, there are a lot of questions about what it does and how it works. It’s important to remember that there is no such thing as the one-tool-fits-all-threats security solution. Instead, Nelly notes that confidential computing is yet another tool that can be added to your security arsenal. 

“No solution will ever be the magic bullet that will make everyone happy and secure, guaranteed. But confidential computing is an addition to our toolbox of defense against gaps we have to take super seriously and invest in solving.” 

Did you enjoy this blog post? To listen to the full conversation, head over to Episode One “Confidentially Speaking” of our Cloud Security Podcast, hosted by Anton Chuvakin (Head of Solutions Strategy) and Timothy Peacock (Product Manager). 

We also recommend checking out other episodes of the Cloud Security Podcast by Google for more interesting stories and insights about security in the cloud, from the cloud, and of course, what we’re doing at Google Cloud.

In every industry, in every part of the world, cybersecurity concerns continue to grow in the wake of attacks on critical infrastructure and the software supply chain. Governments and businesses of all sizes recognize that they must do more to protect their employees, customers and citizens. 

But doing more of the same, like putting security band-aids on legacy infrastructure, is no longer helpful or productive. We need an enduring commitment, in products, people and monetary terms, to drive meaningful improvements in our collective security posture. Google recently announced a $10 billion investment to advance the security of governments around the world, and by extension, help enterprises and organizations to do the same. 

Over the past year, Google Cloud has been delivering on our vision of Invisible Security for our customers, where capabilities are continuously engineered into both our trusted cloud platform and market-leading products to bring the best of Google’s security to wherever your IT assets are. But being a provider of best-in-class technology is not enough. We want to share our expertise to help organizations with their security transformation and offer even more ways to accelerate these essential improvements. This week, at Google Cloud Next ‘21, we’re sharing the first of what will be many more steps in advancing these efforts.

Introducing our Cybersecurity Action Team

While access to the latest, most advanced security technology is important, the expertise of what it will take to become resilient in the face of today’s risk and threat environment is foundational.  

Today, we’re announcing the formation of the Google Cybersecurity Action Team. The Google Cybersecurity Action Team marshals experts from across Google to form what we believe will be the world’s premier security advisory team. It has a singular mission to support the security and digital transformation of governments, critical infrastructure, enterprises and small businesses.

Building on existing security solutions engineering efforts, today the Google Cybersecurity Action Team announced a security and resilience framework that delivers a roadmap for a comprehensive security management program aligned with the National Institute of Standards and Technology’s Cybersecurity Framework using cloud technologies from Google Cloud and our partners. 

“Google Cloud has been a critical partner in the BBVA security journey, helping us protect our customers’ sensitive and proprietary data with modern frameworks like zero trust and secure-by-default products like Google Workspace,” said Alvaro Garrido, Chief Security Officer at BBVA. “We look forward to the strategic services and guidance the Google Cybersecurity Action Team will deliver as we continue on our security transformation.”

Learn more about the Cybersecurity Action Team here. 

Announcing a safer way to work

Bringing you the expertise and hands-on guidance to help with your security transformation is just one valuable step. We recognize that too many organizations can’t wait any longer to begin their modernization efforts – they need a new baseline, and they need it now. 

That’s why today, we’re announcing the launch of our Google Work Safer offering, designed to help organizations, their employees, and partners collaborate and communicate securely and privately in today’s hybrid work environment. Work Safer provides companies with access to best-in-class security for email, meetings, messages, documents, and more. It uniquely brings together the cloud-native, zero-trust solutions of Google Workspace with BeyondCorp Enterprise for secure access with integrated threat and data protection. For customers who want secure devices, Work Safer includes Pixel phones managed with Android Enterprise, Chrome Enterprise Upgrade, and HP Chromebooks. Customers can also leverage Google’s Titan Security Keys for account protection, reCAPTCHA Enterprise for website fraud prevention, Chronicle for security analytics, and a variety of migration services for a seamless transition.

The program is designed to meet the needs of all organizations, including small businesses, enterprises and public sector institutions, many of which are reliant on legacy technology and often lack expertise to fully address rising security challenges associated with hybrid work. To learn more, visit our Work Safer homepage. 

Advancing our trusted cloud with new security capabilities

Above all, security has been and continues to be the cornerstone of our product strategy. There are three critical areas where Google Cloud’s capabilities can make a meaningful difference for any business’ or government’s digital security transformation:

At Next’ 21, we’re introducing new security products and partnerships that will enable you to:

• Protect your employees with new zero trust access capabilities: We’re delivering new features that expand the surface area for our zero trust access solution, BeyondCorp Enterprise, to cover all your apps – both modern and legacy. The new client connector, now in preview, enables identity and context-aware access to non-web applications running in Google Cloud and non-Google Cloud environments. We are also making it easier for admins to diagnose access failure, triage events, and unblock users with the new Policy Troubleshooter feature. You can learn more about both of these new enhancements in the live BeyondCorp Enterprise demo on October 13.
• Improve your detection and response capabilities: We announced a new collaboration with Cybereason for Extended Detection and Response (XDR) across endpoints, networks, cloud and workspaces. The combination of these capabilities delivers a cloud-native XDR solution, Cybereason XDR powered by Chronicle, that automates prevention for common attacks, guides analysts through security operations and incident response, and enables threat hunting with precision at a pace never before achieved. We are also deepening the integration between Chronicle and Security Command Center (SCC) on GCP. New integrations in preview centralize alerts and investigative workflows across the two platforms, and enable threat-specific pivots by enriching SCC alerts with intelligence on associated threat actors and entities. 
• Automate and bolster protection of your sensitive data: Automatic DLP, now in preview, is a prime example of how we are making Invisible Security a reality. It’s a game-changing capability that discovers and classifies sensitive data for all the BigQuery projects across your entire organization without you needing to do a single thing. We’re also introducing Ubiquitous Data Encryption, a solution which combines our generally available Confidential Computing, External Key Management, and Cloud Storage products to seamlessly encrypt data as it’s sent to the cloud. Using your External Key Management solution, data can now only be decrypted and run in a confidential VM environment, greatly limiting potential exposure.
• Protect your IP and implement a zero trust software supply chain: Today, we’re building on our zero trust software supply chain with new launches. Cloud Build is SLSA Level -1 compliant by default, with scripted builds and available provenance. With the new Build Integrity feature, Cloud Build automatically generates a verifiable build manifest that includes a signed certificate describing the sources that went into the build, the hashes of artifacts used, and other parameters. Additionally, Binary Authorization’s integration with Cloud Build makes it easy to set up deploy-time constraints. You can also now easily pair Binary Authorization with Cloud Run to ensure only trusted images make it to production. These integrations are now generally available.
• Protect your users and brand: We recently announced the preview of Cloud Armor Bot Management, which integrates Cloud Armor and reCAPTCHA Enterprise. You can enable protection without any server-side changes to your applications, and because detection and enforcement happens in-line, at the edge of Google’s network, you can mitigate threats before they have a chance to impact your applications, whether they run on GCP, on premise, or in a hybrid or multicloud deployment.
• Ensure secure collaboration: Today, Google Workspace is also introducing new security features. Client-side encryption for Google Meet, in beta, gives customers direct control of encryption keys and the identity service used to access keys. Data Loss Prevention (DLP) for Google Chat, in beta, helps prevent sensitive information from leaking outside of your organization. Check out the blog post from Google Workspace to learn more. 

As we head into three days of great content and engagements from our security and technology teams across Google Cloud at Next ‘21, we want to leave you with this: You are not alone on your security journey. Our goal is to ensure that every day, you are making your organization safer because you have partnered with us. Please make sure to watch our security experts, customers, and partners in our track sessions to go deep on the topics and products that matter most to you.

For a look ahead at the trends that will animate the retail industry this year, let’s take a look back at the 2022 National Retail Federation (NRF) “Big Show” in NYC.

Attendees at January’s event were treated to tangible examples of how retail challenges are being solved today, including new solutions to help them parse customer expectations and buying patterns, adapt stores into omni-channel experience hubs, and improve data visibility and actionability.

NRF 2022 also took the “omni-channel everything” theme of last year’s show to the logical next level: Enabling the best hybrid experiences. The message came through loud and clear of the importance of integration and interoperability in this new hybrid world – making everything work well together.

The need for modern digital infrastructure to enable this blending of physical and digital retail smoothly is paramount. To that end, technology vendors demonstrated how digital transformation initiatives, such as contactless and real time IoT and mobile applications, need to be built on cloud, edge, and secure connectivity to allow retailers to achieve the modern seamless hybrid retail that today’s consumer wants.

Other prominent themes and technologies highlighted at NRF included: extending engagement in the metaverse, sustainability, physical and digital security, and the agility and adaptability imperative.

The Metaverse and Hybrid (Omni-channel) Experiences

Today, the metaverse is an extension of our lives, enhanced by technology, which exists as a series of virtual worlds. In the future, the metaverse will be an interconnected, endless world where digital and physical lives fully converge. Imagine waiting for an appointment at a real booth on the NRF show floor while your avatar roams a fully fleshed-out digital NRF, meeting other virtual attendees, stopping for coffee at the digital Starbucks, and paying for a coffee that an in-the-flesh Starbucks employee brings to them. Digital and physical selves merge seamlessly in the metaverse, as the worlds draw closer together.

In the metaverse, brands have a digital presence, too. Nike filed seven trademarks late last year, including those for “Nike,” “Just Do It,” and its swoosh logo, and posted openings for virtual designer roles, indicating its intent to make and sell virtual branded sneakers and apparel. It subsequently purchased RTFKT Studios, a company that already makes and sells NFTs and digital sneakers. (In one collaboration with teenage artist FEWOCiOUS, the company sold 600 pair/NFTs of sneakers in just six minutes to the tune of more than $3.1 million.)

The metaverse also opens possibilities for gathering data about consumers and product demand. Imagine a sneaker drop in the virtual world. Certain styles of new kicks sell like gangbusters, giving the brand insight into what might sell IRL, intelligence that leads to trend-right production and less inventory headed for markdown or landfills. The metaverse can be a vehicle for more sustainable operations.

The metaverse further bridges the narrowing gap between digital worlds and physical worlds. Most consumers aren’t outfitting an avatar, but they are moving between online and offline and expect retailers to accommodate those hybrid omni-channel journeys seamlessly. Those demands have accelerated around last-mile delivery and experiences such as buying online and picking up in store (BOPIS) or at curbside, shopping in store and returning merchandise online, adding items to a BOPIS purchase when at the store, or communicating a substitution to the third-party grocery delivery service

Hybrid experiences open opportunities to please the consumer in new ways, but they also add expense and complexity. The need to meet this demand while enabling profitability was a major theme behind many of the technologies discussed at NRF. These included artificial intelligence (AI) for recommending the right product, return logistics software for defining and guiding product-specific reverse logistics workflows, order orchestration and fulfillment applications for omni-channel shopping, and last-mile delivery visibility for optimizing customer experience, to name a few. Also on display were task management applications help to improve and optimize in-store employee engagement, as well as touch-free applications to allow for faster payments and customer self-service checkout. RFID continues to improve inventory accuracy and inventory locating on the shelf, throughout the store, and the supply chain.

Sustainability

NRF 2022 saw a strong focus on sustainability. An NRF/IBV study released at the show highlighted the significant embrace of sustainable shopping by consumers. According to the survey, 62% of shoppers are “willing to change their purchasing habits to reduce environmental impacts.” About half indicated a willingness to pay a premium – on average a 70% premium – for sustainable products and brands.

Retailers are working to improve sustainability and reduce carbon footprint across operations by using sustainable sourcing through the supply chain, the store, and even returns. Tech vendors unveiled a variety of solutions enabled by cloud/edge, AI, computer vision, and IoT/RFID to allow retailers to effectively measure and record their environmental efforts, with the goal of reducing their impact.

Several cloud and digital infrastructure providers showcased sustainability clouds and other technology aimed at asset management with the goal of reducing energy consumption, water usage, waste. Examples included using IoT sensors to reduce water usage, optimizing re-use of store assets, and dashboards that allow retailers to accurately monitor and measure carbon output. However, such sustainability solutions can be most successful when running on the next-generation digital infrastructure that helps retailers better compete and differentiate in today’s omni-channel world.

Physical and Digital Security

According to a 2021 NRF survey, 57% of U.S. retailers reported the pandemic led to an increase in organized retail crime, while 50% reported an increase in shoplifting. When IDC’s Future Enterprise Resiliency & Spending Survey, Wave 10 (November 2021) asked retailers which digital infrastructure investments would provide the greatest strategic advantage in 2022, their #1 response was “cybersecurity and recovery investments.”

A wide range of technology vendors acknowledged retailer concerns with regards to security, fraud, and loss prevention:

• Networking, connectivity, and edge vendors highlighted multilayer security solutions that promise to protect data from a range of IoT applications that utilize customer and associate data. Many offer security consulting services to address varied threats including ransomware, retail crime, and loss prevention.
• Security and e-commerce security vendors showcased solutions to prevent fraud and abuse in e-commerce applications as well as omni-channel applications such as BOPIS and curbside pickup, using AI-based analysis for identifying “bad”/risky customers and mitigating risk.
• Cloud vendors highlighted how retail clouds provide consistent, reliable identity management and data security.
• POS/payments/store technology vendors emphasized their ability to handle payments securely from any platform with multifactor tokenization, improved identity techniques such as biometrics and voice authentication, as well as AI-enabled and computer vision solutions for loss prevention at checkout and at the door.

The Agility and Adaptability Imperative

On display at the show were multiple flavors of the digital infrastructure technology that retailers need to achieve agile, personalized, data-driven, integrated seamless operations across the many channels of today’s retail landscape. The emphasis was apt. More than half of retailers plan to boost investment in business agility and operational agility over the next 12 months, according to IDC’s Future Enterprise Resiliency & Spending Survey, Wave 10 (November 2021).

Technology vendors highlighted their connectivity investments to enable business and operational agility and their technology investments for better ease of integration, scalability, and the ability to more easily swap out or mix and match applications with integrated platforms, open systems, hybrid cloud, and retail industry clouds.

Vendors also showed off infrastructure to better harness data while enabling its visibility, maximizing its value, and providing the data-driven personalization essential for competitive advantage and differentiation. Highlights included fast, secure connectivity, 5G and Wifi-6, and edge- and cloud-enabled data and AI platforms to generate real-time insights – all designed to enable today’s omni-channel retail.

Advice for the technology buyer

Retailers should consider these key themes from NRF 2022 when making technology investment decisions for 2022 and beyond. To avoid lagging behind those retailers already moving toward thriving into the future, take action to:

• Enable the seamless, contactless omni-channel approach that today’s consumers want and expect.
• Replace legacy infrastructure that was not built to handle the modern retail environment that requires the agility and adaptability to seamlessly connect rapidly increasing volumes of data securely and more quickly than ever.

Whether sustainability, adaptability, the metaverse, or security are top concerns, addressing business needs holistically and strategically should be job #1.

Continue the conversation by downloading our Transforming retail and CPG markets whitepaper today.

For more than 15 years, developers have used Google Maps Platform to deliver location-based experiences to their end users and used location intelligence to optimize their businesses. Along this journey, we’ve made a variety of changes to better support our community as needs have changed and new industries and technologies have emerged. We started rolling out a new website experience, at https://mapsplatform.google.com, to help you better understand the products and solutions best suited to address your objectives. Plus, now you can directly connect to the developer documentation for each product to get started quickly, and you can visualize usage and associated costs to have a better idea of what to expect before getting started. 

Getting to your solution faster 

Maps, Routes, Places are building blocks that let you develop implementations for any use case. Building for specific use cases, however, typically requires using a combination of APIs and SDKs. To help you quickly understand what’s possible and what you need to build for your use case, you can now visit the solutions tab to select from a list of popular use cases or industries. Once you’ve selected a use case or industry, you’re taken to a page where you can explore relevant products, read helpful blog posts, see how other customers have deployed for similar use cases, and more.  

Direct access to developer documentation

Did you know there are more than a thousand pages of developer documentation created to help you get started, unblock you when you’re stuck, and share best practices? Now when you explore a product or solution from the Google Maps Platform website, you can easily navigate back and forth between our website and documentation. Just tap on JS, iOS, Android or API under the product name to get to the documentation you need. 

Budgeting for your project

To help you calculate pricing for your project, we’ve introduced a new pricing calculator. Once you find the product and API or SDK you plan to use, pull the slider to reflect your estimated number of monthly requests. This will automatically update the “monthly cost” column for each product and API or SDK you plan to use. If your estimated monthly requests exceed the slider limit, contact our sales team to ​​learn about volume discounts that start at 20% off. 

We hope our new website makes it easier to discover our products and solutions, estimate your budget, and start building with our documentation so you can deliver helpful experiences to your users and optimize your business. 

For more information on Google Maps Platform, visit https://mapsplatform.google.com.