In the fall of 2022, we announced new policy constructs for Google Cloud Firewall, a scalable, cloud-first firewall service that helps secure traffic flow to and from workloads in Google Cloud, and whose distributed architecture enables simplified, granular control including micro-segmentation. Whereas legacy VPC firewall rules included network tags that were not governed by our IAM infrastructure, Cloud Firewall’s new network firewall policies with IAM-governed tags conform to our hierarchical control model and can help improve security operations. 

We recommend that customers migrate from VPC firewall rules to the newly introduced network firewall policies. To assist with the migration, we developed a migration tool that creates a global network firewall policy and converts existing VPC firewall rules into the new policy.

With Google Cloud’s network firewall policies, we offer rules defined on a per-VPC network basis, either for all regions of the network (global network firewall policies) or a single region (regional network firewall policies). Granular controls enforced at the virtual machine (VM) level using IAM-governed Tags deliver intra-subnet micro-segmentation with pervasive policy coverage that automatically applies to workloads wherever they are deployed, independent of network architecture. 

Network firewall policies allow for: 

• Batch editing of multiple rules within a single policy, which saves time, simplifies rule management, and eliminates race conditions created by single rule update patterns
• A single resource to contain all the firewall rule sets applied to a VPC network, making it easy to modify and update the firewall configurations with unified APIs on the single resource
• Granular IAM controls based on your needs and requirements, such as separate IAM permissions for firewall policy creation, update, and association 
• Sharing and attaching of firewall configurations across VPC networks in the same project, which simplifies configuration and management

With these increased capabilities, the combination of the new policy structures and the IAM-governed tags can help simplify operations, while achieving more reliable granular control and the implementation of least-privilege policies. 

Going forward, all new enhancements and features for Cloud Firewall will only be supported through firewall policies. Network firewall policies and Tags integration are part of the Cloud Firewall Essentials tier, which is offered to customers at no additional charge. We encourage customers to migrate to network firewall policies to take advantage of future Cloud Firewall product enhancements, such as the Threat Intelligence, FQDN, and geo-location filtering features introduced in the Cloud Firewall Standard tier. For more details, please see our Cloud Firewall Standard announcement blog.

Network firewall policy migration tool overview 

The new migration tool helps you convert existing VPC firewall rules into the new policy. This tool does not delete or affect existing VPC firewall rules. Once the new global network firewall policy is created, you can attach the network firewall policy to a VPC. You also have the option to swap the evaluation order of network firewall policies and VPC firewall rules. 

Existing VPC firewall rules can be removed after you confirm the newly created network firewall policy works as intended. The best way to verify this is to enable firewall logging on both the existing VPC firewall rules and the new network firewall policy. After the evaluation order has been swapped to evaluate the new global policy first, you can review the firewall logs to confirm that the new network firewall policy rules are evaluated and hit as intended, and the hit count for the equivalent VPC firewall rules are shadowed and no longer getting hits. Support for the hit count and shadowed rule analysis will also be available in the upcoming release of Firewall Insights. More details can be found in the migration tool guide. 

You can access the migration tool as a gcloud command. There are two mandatory arguments in this command: (1) the source VPC Network (SOURCE_VPC_NETWORK) and (2) the target network firewall policy (TARGET_NETWORK_FIREWALL_POLICY).

gcloud compute firewall-rules migrate --source-network=SOURCE_VPC_NETWORK –target-firewall-policy=TARGET_NETWORK_FIREWALL_POLICY [OTHER_FLAGS]

Please note, a network firewall policy with the same name cannot exist before running this command, since the migration tool will create it.

Additionally, logging will remain unchanged for any migration, meaning that if a VPC firewall rule has logging turned on, the migration tool will leave it on and if logging is turned off, the migration tool will keep it off.

For a more detailed guide, including information on how to change the rule evaluation order, and how to migrate from VPC firewall rules that contain network tags and/or service accounts, please refer to the migration guide. 

Migrate today 

We encourage you to migrate your firewall configuration from VPC firewall rules to the newly introduced network firewall policies to enhance your security posture with a fully distributed, cloud-first stateful inspection firewall service. In addition, migrating to network firewall policies ensures you will have access to the latest firewall features, such as Cloud Firewall Standard. The migration tool is here to help you with this transition. Check out the guide to learn more.

All over the world, businesses, schools and users depend on G Suite to help them stay connected and get work done. Google designs, builds, and operates our products on a secure foundation, aimed at thwarting attacks and providing the protections needed to keep you safe. G Suite and Google Meet are no exception.

Google Meet’s security controls are turned on by default, so that in most cases, organizations and users won’t have to do a thing to ensure the right protections are in place. Here, we’ll summarize the key capabilities of Google Meet that help protect you.

Proactive protections to combat abuse and block hijacking attempts

Google Meet employs an array of counter-abuse protections to keep your meetings safe. These include anti-hijacking measures for both web meetings and dial-ins. 

Google Meet makes it difficult to programatically brute force meeting IDs (this is when a malicious individual attempts to guess the ID of a meeting and make an unauthorized attempt to join it) by using codes that are 10 characters long, with 25 characters in the set. We limit the ability of external participants to join a meeting more than 15 minutes in advance, reducing the window in which a brute force attack can even be attempted. External participants cannot join meetings unless they’re on the calendar invite or have been invited by in-domain participants. Otherwise, they must request to join the meeting, and their request must be accepted by a member of the host organization. 

In addition, we’re rolling out several features to help schools keep meetings safe and improve the remote learning experiences for teachers and students, including:

• Only meeting creators and calendar owners can mute or remove other participants. This ensures that instructors can’t be removed or muted by student participants.
• Only meeting creators and calendar owners can approve requests to join made by external participants. This means that students can’t allow external participants to join via video, and that external participants can’t join before the instructor.
• Meeting participants can’t rejoin nicknamed meetings once the final participant has left. This means if the instructor is the last person to leave a nicknamed meeting, students can’t join later without the instructor present.

Secure deployment and access controls for admins and end-users

To limit the attack surface and eliminate the need to push out frequent security patches, Google Meet works entirely in your browser. This means we do not require or ask for any plugins or software to be installed if you use Chrome, Firefox, Safari, or Microsoft Edge. On mobile, we recommend that you install the Google Meet app. 

To help ensure that only authorized users administer and access Meet services, we support multiple 2-Step Verification options for accounts that are secure and convenient. These include hardware and phone-based security keys and Google prompt. Additionally, Google Meet users can enroll their account in our Advanced Protection Program (APP), which provides our strongest protections available against phishing and account hijacking and is specifically designed for the highest-risk accounts. 

For G Suite Enterprise and G Suite for Education customers, we offer Access Transparency, which logs any Google access to Google Meet recordings stored in Drive, along with the reason for the access (support team actions that you might have requested, for example). Customers can also use data regions functionality to store select/covered data of Google Meet recordings in specific regions (i.e. US or Europe). 

Secure, compliant, and reliable meeting infrastructure 

In Google Meet, all data is encrypted in transit by default between the client and Google for video meetings on a web browser, on the Android and iOS apps, and in meeting rooms with Google meeting room hardware. Meet adheres to IETF security standards for Datagram Transport Layer Security (DTLS) and Secure Real-time Transport Protocol (SRTP). For every person and for every meeting, Meet generates a unique encryption key, which only lives as long as the meeting, is never stored to disk, and is transmitted in an encrypted and secured RPC (remote procedure call) during the meeting setup.

Security is an integral part of all our operations at Google. Our team of full-time security and privacy professionals supports our software engineering and operations to ensure that security is always a part of how we build and run our services. All of our Google Cloud and G Suite customers benefit from these capabilities, including: 

• Secure-by-design infrastructure: Google Meet benefits from Google Cloud’s  defense-in-depth approach to security, which utilizes the built-in protections and global-private network that Google uses to secure your information and safeguard your privacy.
• Compliance certifications: Our Google Cloud products, including Google Meet, regularly undergo independent verification of their security, privacy, and compliance controls, including validation against standards such as SOC, ISO/IEC 27001/17/18, HITRUST, and FedRAMP. We support your compliance requirements around regulations such as GDPR and HIPAA, as well as COPPA and FERPA for education. 
• Incident management: We have a rigorous process for managing data and security incidents that specifies actions, escalations, mitigation, resolution, and notification of any potential incidents impacting customer data.
• Reliability: Google’s network is engineered to accommodate peak demand and handle future growth. Our network is resilient and engineered to accommodate the increased activity we’ve seen on Google Meet.
• Transparency: At Google Cloud, we’re clear about our commitments regarding customer data: we process customer data according to your instructions; we never use customer data for advertising purposes; and we publish the locations of our Google data centers, which are highly available, resilient, and secure.  

During COVID-19 and beyond, we will continue to protect Google Meet users and their data, and keep innovating with new features to make our tools helpful, secure, and safe.