Data security is an ongoing concern for anyone managing a data warehouse. Organizations need to control access to data, down to the granular level, for secure access to data both internally and externally. With the complexity of data platforms increasing day by day, it’s become even more critical to identify and monitor access to sensitive data. In many cases, sensitive data is co-mingled with non-sensitive data, and access restrictions to sensitive data need to be enabled based on factors like data location or presence of financial information. There may also be nuances where data is sensitive for some groups of users, while for others, it is not. 

Today, we’re pleased to announce the general availability of BigQuery row-level security, which gives customers a way to control access to subsets of data in the same table for different groups of users. Row-level security (RLS) extends the principle of least privilege access and enables fine-grained access control policies in BigQuery tables. BigQuery currently supports access controls at the project-, dataset-, table- and column-level. Adding RLS to the portfolio of access controls now enables customers to filter and define access to specific rows in a table based on qualifying user conditions—providing much needed peace of mind for data professionals. 

“Our digital transformation and migration of data to the cloud magnifies the business value we can extract from our information assets. However, granular data access control is essential to comply with international regulatory and contractual requirements. BigQuery row-level security helps us comply with data residency and export restrictions,” says Jarrett Garcia, Iron Mountain’s Enterprise Data Platform Senior Director. “It enables us to manage fine-grained access controls without replicating data. What used to take months for approval and access provisioning can now be done more efficiently and effectively. We are looking forward to implementing additional data security capabilities on the BigQuery roadmap to address other critical business use cases.”

How BigQuery row-level security works

Row-level security in BigQuery enables different user personas access to subsets of data in the same table. Customers who are currently using authorized views to enable these use cases can leverage RLS for ease of management. To express the concept of RLS, we have introduced a new entity in BigQuery called row access policy. Row access policies map a group of user principals to the rows that they can see, defined by a SQL filter predicate. 

Secure logic rules created by data owners and administrators determines which user can see which rows through the creation of a row-level access policy. The row-level access policies created on a target table by administrators or data owners are applied when a query is run on the table. One table can have multiple policies applied to it.

Below is an example, where row-level access policies have been created to filter data based on users’ “region”.

In the illustrated scenario above, row-level access policies have been created to verify a querying user’s region and to give them access only to the subset of data relevant to that region. Access policies are granted to a grantee list which support all types of IAM principles such as individual users, groups, domains or service accounts. In this example, when a user queries the table, row-level access policies are evaluated to assess which, if any, policies are applicable to that user. The group ‘sales-apac’ is granted access to view a subset of rows where region = ‘APAC’ whereas the group ‘sales-us’ is granted access to view a subset of rows where the region = ’US’. Likewise, users in both groups will see rows in both regions, and users in neither group will not see any rows.

Row-level access policies can also be created using the SESSION_USER() function to restrict access only to rows that belong to the user running the query. If none of the row access policies are applicable to the querying user, the user will have no access to the data in the table.

When a user queries a table with a row-level access policy, BigQuery displays a banner notice indicating that their results may be filtered by a row-level access policy. This notice displays even if the user is a member of the `grantee_list`.

When to put BigQuery row-level security to work

Row-level access policies are useful when you have a need to limit access to data based on filter conditions. The row-access policies’ filter predicate supports arbitrary SQL, and is conceptually similar to the WHERE clause of a SQL query. Filter predicates support the SESSION_USER() function to restrict access only to rows that belong to the user running the query. If none of the row access policies are applicable to the querying user, the user will have no access to the data in the table. Currently, the column used for filtering must be in the table, but we anticipate adding support for subqueries in the filter expression, opening up access to use cases where data is filtered based on lookup tables and calculated values. Row-level access policies can be created, updated and dropped using DDL statements. You will be able to see the list of row-level access policies applied to a table using the BigQuery schema pane in the Cloud Console,  which simplifies the management of policies per table, or by using the bq command-line tool.

Row-level security is compatible with other BigQuery security features, and can be used along with column-level security for further granularity.  Since row-level access policies are applied on the source tables, any actions performed on the table will inherit the table’s associated access policies, to ensure access to secure data is protected. Row-level access policies are applicable to every method used to access BigQuery data (API, Views, etc). 

Try it out

We’re always working to enhance BigQuery’s (and Google Cloud’s) data governance capabilities, to provide more controls around managing your data. With row-level security, we are adding deeper protections for your data. You can learn more about BigQuery row-level security in our documentation and best practices.

For the fourth consecutive year, Gartner has positioned Google as a Leader in the 2021 Gartner Magic Quadrant for Cloud Infrastructure and Platform Services (formerly titled as Magic Quadrant for Cloud Infrastructure as a Service upto 2014 Infrastructure as a Service, or (IaaS).

With our customers and communities adjusting to new ways of working and doing business, Google Cloud has remained focused on building services and platforms that help you be more resilient and derive even more value from your cloud infrastructure. We believe Gartner’s analysis and recognition gives our customers the confidence needed to choose Google as the platform for customer-centric innovation. Here are just a few recent examples.

Ready for the most demanding, mission-critical workloads

Our enterprise-ready cloud provides you the uptime, performance, and scale to run even your most demanding workloads. Examples of recent launches: 

• The largest single-node GPU-enabled VM in the industry with up to 16 NVIDIA A100 instances so that our customers can run their ML workloads 
• The only cloud to support scale-out out 96TB SAP HANA so that customers can confidently bring their most critical workloads to GCP
• Strategic partnerships with leading partners like SAP 
• Several regions and an expanded global network footprint including new subsea cables, Firmina, Dunant, Blue and Raman
• High bandwidth 50/75/100Gbps networking for VMs
• Persistent Disk Extreme (block storage) with 120K IOPS 
• Filestore High Scale scale-out NFS for HPC

Saves you money

Save money with a transparent and innovative approach to pricing and intelligent recommendations. In the past year, we’ve launched several innovations to help you save costs:

• Tau VMs, which offer the best price-performance among leading clouds for scale-out workloads 
• Machine-learning-driven predictive auto-scaling for VMs and GKE Autopilot, enabling infrastructure to scale up and down as needed with minimal waste 
• Standard network tier which routes traffic over the internet for cost optimization 

Open

We have a long history of leadership in open technologies—from projects like Kubernetes, the industry standard in container orchestration and interoperability, to TensorFlow, a platform to help anyone develop and train machine learning models. Here are a few recent improvements we’ve made to ensure your cloud is an open cloud: 

• Extended Anthos to bare metal and Microsoft Azure to support customers who want a multi-cloud and hybrid cloud posture. 
• Announced a new network dataplane for Google Kubernetes Engine (GKE) and Anthos that supports eBPF, an open-source Linux kernel technology optimized for Kubernetes. 
• Google Kubernetes Engine (based on the Kubernetes standard) received the top overall score based on 2021 Gartner Solution Scorecard for Google Kubernetes Engine.

Secure

Google Cloud’s trusted infrastructure uses layers of security to protect your data with advanced technologies and operations, keeping your organization secure and compliant. For example, we offer:

• Confidential VMs and Confidential GKE with in-memory encryption and encryption keys controlled by you, with a single checkbox
• Enhanced security for Cloud Run
• Strong support against DDoS attacks. In 2017, our infrastructure absorbed the largest-known DDoS attack at 2.5Tbps with no impact to customers. 

Sustainable

Google Cloud helps customers transform their business sustainably. We operate the cleanest cloud in the industry to make sure your digital footprint doesn’t leave a carbon one. Here are a few proof points:

• Google has been carbon neutral since 2007, and for the past four years has matched 100% of the electricity we consume globally with wind and solar purchases. Everything you run on Google Cloud is net carbon neutral. 
• We continue to innovate towards greater energy efficiency in our data centers, and compared with five years ago, now deliver around seven times as much computing power with the same amount of electrical power.
• Recently we announced new features to help customers reduce the carbon footprint of their applications and infrastructure, including a region picker to help with architecture decisions, and low carbon indicators in the Google Cloud Console.  

Supporting our customers

Most importantly, our field organizations and partner organizations work with a singular focus to ensure customer success. This has made Google Cloud the fastest growing hyperscaler, with a rapidly expanding customer base across all geos and industries.

Since launching Customer Care last year, we consolidated and simplified the post-sales engagement with customers, increased the support channels, created an API to allow programmatic case creation, and combined product specific support into a single package for all of Google Cloud. Enterprises with Customer Care continue to report high levels of satisfaction with their focused technical account managers (TAMs), helping them get the most business value out of Google Cloud.

We are committed to sustaining and accelerating the pace of customer-centric innovation. You can download a complimentary copy of the 2021 Magic Quadrant for Cloud Infrastructure and Platform Services on our website. 

Join us to learn much more about Google Cloud at the upcoming Google Cloud Next ‘21 digital conference.  

^{Gartner, Magic Quadrant for Cloud Infrastructure and Platform Services,  Raj Bala | Bob Gill | Dennis Smith | Kevin Ji | David Wright, 27 July 2021
Gartner, Solution Scorecard for Google Kubernetes Engine,  Tony Iams | Traverse Clayton | Megan Bain, 12 April 2021
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.}

Kohl’s is an omnichannel retailer focused on driving traffic, operational efficiency and delivering seamless omnichannel customer experiences.

Ratnakar Lavu is Kohl’s Senior Executive Vice President and Chief Technology Officer. He, and Kohl’s, are at the forefront of retail technology innovation, focusing on a frictionless customer journey across digital, mobile and more than 1,150 stores.

As part of this journey to more closely unify its online and offline experiences for customers, the company was looking for supporting cloud services that would continue to drive  best-in-class data center infrastructure; the ability to manage data at a very large scale; and industry leading analytics and machine learning tools to continually understand real time data streams and help personalize experiences for their customers.

Kohl’s recognized the opportunity to take on a cloud partner to help drive the improvement of the speed and reliability of their operations, while they focused on a number of innovations to deepen customer experiences.

“At the time, I was looking for an open and scalable platform to partner with our Kohl’s technology team as we transform our business by shifting to the cloud,” says Ratnakar.

“Google has great engineering talent as well as demonstrated experience solving stability and scale in its own Ads and Search business. At Kohl’s, we need to be bold and innovative in today’s retail environment, and therefore need partners who deeply understand how to manage risk.” 

Kohl’s leveraged several capabilities of Google Cloud. For example:

• They built applications to automate deployment, scaling and operations.
• They used monitoring capabilities to monitor for things like response time.
• Scalable technology provided an infrastructure to elastically scale to site traffic.
• They ran their infrastructure across multiple regions for high availability.

In 2017 and 2018, record-setting numbers of customers visited Kohls.com during the Thanksgiving holiday weekend and the digital platform experienced high double-digit growth both years.

The capabilities provided by Google Cloud Platform (GCP) and Google’s data center infrastructure supported Kohl’s servers and systems during these key timeframes.

In addition, the Kohl’s team partnered together with Google’s core engineering team and services organization to optimize applications and make them more reliable.

Google Cloud’s Customer Reliability Engineers (CREs) worked with them in advance of their peak time frames to test the infrastructure for performance, scaling, and fault tolerance.

“Google CRE and services teams collaborated with us as we ran drills and exercises during each phase of preparation for peak time frames,” Ratnakar said. “As we continued to understand better how to scale, monitor, and support our applications in GCP and we are pleased that we worked with the CRE team as partners on monitoring services, alerting teams, and triaging work.”

Why Higher Ed Needs to Go All-in on Digital

In the wake of the COVID-19 pandemic, the majority of students within the 18-24-year-old demographic now expect hybrid learning environments–even once we are beyond the pandemic. And a vast number of adult learners are seeking options that accommodate their work and family lives now that it’s clear that effective learning can indeed occur virtually. Implementing cloud technologies and achieving digital maturity within higher education will enable institutions to be innovative and responsive to evolving student preferences, while being prepared for future disruptions.

The state of digital maturity

In February and March 2021, Boston Consulting Group (BCG), in partnership with Google, surveyed U.S. higher education leaders on their views of the state of digital maturity in the higher education sector. This survey found that institutional and technology leaders strongly agreed that moving legacy IT systems to the cloud, centralizing and integrating data, and increasing the use of advanced analytics is necessary to make a successful digital transformation, and ultimately achieve digital maturity.

But what is digital maturity? Digital maturity—a measure of an organization’s ability to create value through digital delivery—focuses on three areas of technological advancement that drive large-scale innovation:

1. Using cloud infrastructure
2. Expanding access to data
3. Using that data to improve processes through advanced analytics, such as Artificial Intelligence and Machine Learning (AI/ML)

Although university leaders agree on prioritizing digital maturity, more than 55% said they considered their schools to be “digital performers” or “digital leaders.” However, only 25% of tech leaders at these universities stated that their schools regularly use data analytics. As with corporations and governments, higher education institutions face barriers to technological innovation, such as:

• Competing priorities to meet step-change goals and decentralized decision making
• Budget constraints
• Cultural resistance to change
• Tech staff skillset gaps

Still, leaders understand that the way to overcome institutional inertia is with a strong, goal-oriented vision of what is best for the institution overall. Although only a handful of schools have reached digital maturity as we define it, others can learn a great deal from their examples. Here are the top takeaways from higher education leaders who successfully transformed their institutions:

Digital solutions can improve the student journey in many ways

As digital capabilities hold the key to dealing effectively with declining enrollment and rising costs, higher ed leaders identified four goals that are critical to improving performance:

1. Improve the student journey
2. Increase operational efficiency
3. Scale computing power in advanced research
4. Innovate education delivery

The research found that technology investments can help enhance the student journey in the recruiting and retention of students, improving digital education delivery, government funding, and donations from alumni. Digital maturity can make institutions more agile and efficient in delivering education that aligns with the changing societal norms, evolving student preferences, and future disruptions. Survey participants shared that they plan to increase the use of the cloud by more than 50% over the next three years. By shifting legacy IT systems to the cloud, institutions can increase scalability, lower the cost of ownership, and improve operational agility, while offering a more secure, long-term data storage solution.

Cloud-native software-as-a-service (SaaS) solutions provide an excellent platform for centralizing data. However, institutions that attempt to “lift and shift” their legacy systems to the cloud may encounter challenges to achieving measurable improvements in data integration and cost reduction. Higher ed leaders must realize that centralizing data and transitioning to the cloud do not happen simultaneously.

Leaders who are able to articulate a strong vision and commitment will experience a more successful technology transformation. By linking their vision to specific needs, such as more effective recruiting, leaders will find their technology investments will have a more substantial return. University presidents should base their decisions about which systems to move, when, and how on desired performance outcomes.

Big visions become a reality with small steps. Small pilot projects are an excellent way to start the journey toward digital maturity. Small steps toward a significant transformation can reduce resistance to change, build positive momentum, and produce better student outcomes. Read the full report here. If you’d like to talk to a Google Cloud expert, get in touch.