Do you want to fire up a bunch of techies? Talk about multicloud! There is no shortage of opinions. I figured we should tackle this hot topic head-on, so I recently talked to four smart folks—Corey Quinn of Duckbill Group, Armon Dadgar of Hashicorp, Tammy Bryant Butow of Gremlin, and James Watters of VMware—about what multicloud is all about, key considerations, and why you should (or shouldn’t!) do it.

Five important insights came out of these discussions. If you’re on a multicloud journey or considering one, keep reading.

Do: Choose to do multicloud for the right reasons

Don’t do multicloud because Gartner says so, implores Corey Quinn. Before embarking on a multicloud, define a “why” focused on business value journey, says Armon Dadger. For example, you might want to use services from each public cloud because of their differentiated services, according to Tammy Bryant Butow. Armon also calls out regulatory reasons, existing business relationships, and accommodating mergers and acquisitions. On the topic of M&A, Corey points out that if you acquire a company that uses another cloud, it’s usually expensive and difficult to consolidate. It can be smarter to stay put.

https://youtube.com/watch?v=xFSDexQhCUY%3Fenablejsapi%3D1%26

Don’t: Over-engineer for workload or data portability

Thinking that you’ll build a system that moves seamlessly among the various cloud providers? Hold up, says our group of experts. Armon points out that aspects of your toolchain or architecture may be multicloud—think of some of your workflows or global network routing—but that shifting workloads or data is far from simple. Corey says that trying to engineer for “write once, run anywhere” can slow you down, and ignores the inherent uniqueness that’s part of each platform. Specifically, Corey calls out the per-cloud stickiness of identity management, security features, and even network functionality. And data gravity is still a thing, says James, that causes some to dismiss multicloud outright.

If you’re using multiple public clouds, you take advantage of the distinct value each offers, Armon says. Use native cloud services where possible so that you see the benefits from useful innovations, built-in resilience, and baked-in best practices. The value from that cloud-infused workload may outweigh the benefits of seamless portability.

https://youtube.com/watch?v=B1VH56_L8f8%3Fenablejsapi%3D1%26

Do: Recognize different stakeholder interests and needs

James smartly points out that many multicloud debates happen because people are arguing from different perspectives. Context matters. If you’re an infrastructure engineer who invests heavily in a given cloud’s identity and access management model, multicloud looks tricky. Or if you’re a data engineer with petabytes of data homed in a particular cloud, multicloud may look unrealistic. James highlights that many developers default to multicloud because their local tools—where all the work happens—are multicloud. A developer’s IDE and preferred code framework(s) aren’t tied to any given cloud. Be aware that groups within your organization will come at multicloud from distinct directions. And this may impact your approach!

https://youtube.com/watch?v=I9sqXDqkKBM%3Fenablejsapi%3D1%26

Don’t: Go it alone

Corey talks about the importance of asking others what worked, and what didn’t. Tammy offers her best practices around sharing results from experiments. It’s about sharing knowledge and tapping into it for community benefit. Others have probably tried what you’re trying, and can help you avoid common pitfalls. If you’ve just made an architectural choice that didn’t work out, share it, and help others avoid the pain. 

Read research from analysts, go to conferences or watch videos to observe case studies, and join online communities that offer a safe place to share mistakes and learn from others.

https://youtube.com/watch?v=mrSb5vqOfuI%3Fenablejsapi%3D1%26

Do: Experiment first using techniques like multi-region deployments

If you think you can operate systems across clouds, how about you first try doing it across regions in a specific cloud, suggests Corey. Getting a system to properly work across cloud regions isn’t trivial, he says, and that experience can help you uncover where you have architectural or operational constraints that will be even worse across cloud providers.

This is great guidance if your multicloud aspirations involve using multiple clouds to power one application—versus the more standard definition of multicloud where you use different clouds for different applications—but can also surface issues in your support process or toolchain that fail when faced with distributed systems. Start with muti-region deployments and chaos engineering experiments before aggressively jumping into multicloud architectures.

The Google Cloud take

Do the things above. It’s great advice. I’ll add three more things that we’ve learned from our customers.

1. Don’t fear multicloud. You’re already doing it. You don’t single-source everything. As Corey mentioned, you probably already have one cloud for productivity tools, another for source code, another for cloud infrastructure. You’ll use software and application services from a mix of providers for a single app. You have that experience in your team and have been doing that for decades. What people do rightly worry about is using more than one infrastructure service beneath an application, as that can introduce latency, security, and logistical hurdles. Make sure you know which model your team is considering.
2. Embrace the right foundational components, including Kubernetes. Will everything run on Kubernetes? Of course not. Don’t try to do that. But it also represents the closest thing we have to a multicloud API. Companies are using Kubernetes to stripe a consistent experience across clouds. And this isn’t just to orchestrate containers, but also to manage infrastructure and cloud-native services. Also, consider where you need other fundamental consistency across clouds, including areas like provisioning and identity federation.
3. Use Google Cloud as your anchor. Here’s a fundamental question you have to decide for yourself: Are you going to bring your on-premises technology and practices to the cloud, or bring cloud technology and practices on-prem? We sincerely believe in the latter. Anchor to where you’re trying to get to. We offer Anthos as a way to build and run distributed Kubernetes fleets in Google Cloud and across clouds. By using a cloud-based backplane instead of an on-prem one, you’re offloading toil, leveraging managed services for scale and security, and introducing modern practices to the rest of your team.

We learned a lot about multicloud through these discussions, and it seems like others did too. That’s why we’re going to do a second round of interviews with a new crop of experts so that we can keep digging deeper into this topic. Stay tuned!

I’m excited to share our first Cloud CISO Perspectives post of 2022. It’s already shaping up to be an eventful year for our industry and we’re only in month one. There’s a lot to recap in this post, including the U.S. government’s recent efforts to address critical security issues, like open source software security and zero trust architectures. We’ve also released new resources from our Google Cybersecurity Action Team like the Cloud Security Megatrends and the Boards of Directors whitepaper on cloud risk governance. 

Cloud Security Megatrends 

We’re often asked if the cloud is more secure than on-prem (and why) so we shared our answer in a recent blog post. At Google Cloud, security by design is our priority. We’ve long adopted zero-trust principles for our baseline security architectures and built a global network that relies on defense in depth layers to protect against configuration errors and attacks. But security is always evolving and that is why we also take advantage of the following megatrends:

1. Economy of scale: Decreasing the marginal cost of security raises the baseline level of security. 
2. Shared fate: A flywheel of increasing trust drives more transition to the cloud, which compels even higher security and even more skin-in-the-game from the cloud provider.
3. Healthy competition: The race by deep-pocketed cloud providers to create and implement leading security technologies is the tip of the spear of innovation. 
4. Cloud as the digital immune system: Every security update the cloud gives the customer is informed by some threat, vulnerability, or new attack technique often identified by someone else’s experience. Enterprise IT leaders use this accelerating feedback loop to get better protection.
5. Software-defined infrastructure: Cloud is software defined, so it can be dynamically configured without customers having to manage hardware placement or cope with administrative toil. From a security standpoint, that means specifying security policies as code, and continuously monitoring their effectiveness.
6. Increasing deployment velocity: Because of cloud’s vast scale, providers have had to automate software deployments and updates, usually with automated continuous integration/continuous deployment (CI/CD) systems. That same automation delivers security enhancements, resulting in more frequent security updates.
7. Simplicity: Cloud becomes an abstraction-generating machine for identifying, creating and deploying simpler default modes of operating securely and autonomically. 
8. Sovereignty meets sustainability: The cloud’s global scale and ability to operate in localized and distributed ways creates three pillars of sovereignty. This global scale can also be leveraged to improve energy efficiency.

If you’re an IT decision maker, pay attention to these megatrends that will continue to drive and reinforce cloud security and will outpace the security of on-prem infrastructure well into the future. 

U.S. Federal government cybersecurity momentum 

• Open source software security: Earlier this month, Google participated in the White House Summit on open source software security. The meeting came at a critical time for the industry following December’s Log4j vulnerabilities and was both a recognition of the challenge and an important first step towards addressing it. The open source software ecosystem is not homogenous, despite the fact that the industry often thinks of or treats it this way. Some of it, like Linux, is highly curated, while other critical software is supported through diffuse communities including technology companies and other stakeholders. There is also a long tail of many other critical projects driven by a dedicated community of maintainers around the world, including Googlers. In light of this reality, we welcomed the chance to share our recommendations to advance the future of open source software security. Some work we’ve done includes founding the Open Source Security Foundation, which has been instrumental already in making security improvements. We’ve also helped drive a number of key security initiatives within the open source community including security scorecards, the SLSA framework to improve the security and integrity of open source packages, and Secure Open Source Rewards to financially incentivize improvements to critical open source security projects.  
• OMB’s Federal zero trust strategy: The publication of the Office of Management and Budget’s zero trust architecture strategy marks an important step for the U.S. federal government’s efforts to modernize under Executive Order 14028. Google Cloud supports this approach, which recognizes the immense security benefits offered by modern computing architectures. For the past decade, Google has successfully applied zero trust principles through our BeyondCorp and BeyondProd frameworks for providing end-user access and securing our cloud workloads. And we’ve brought these best practices from our own journey to global governments and businesses of any size through solutions like BeyondCorp Enterprise and capabilities like Binary Authorization and Anthos Service Mesh, which are embedded in Anthos, our managed application platform. For Federal agencies embarking on this zero trust journey, the Google Cybersecurity Action Team will offer our expertise by conducting Zero Trust Foundations strategy workshops, which can help organizations in the public and private sectors develop actionable and achievable strategies and plans for zero trust implementation. 

Google Cybersecurity Action Team Highlights 

Here are the latest updates, products, services and resources across our security teams this month: 

Security

• Democratizing security operations: We recently announced that Siemplify, a leading security orchestration, automation and response (SOAR) provider, is joining Google Cloud to help companies better manage their threat response. Providing a proven SOAR capability with Chronicle’s approach to security analytics is an important step forward in our vision to advance invisible security and democratize security operations for every organization.
• Security by design: The Highmark Health security team is using “secure-by-design” techniques to address the security, privacy, and compliance aspects of its Living Health solution with Google Cloud’s Professional Services Organization (PSO). Google has long advocated for and followed security by design principles, which is why we’re continuously building enhanced security, controls, resiliency and more into our cloud products and services. 
• Secure collaboration for hybrid work environments: The Google Workspace team shared its recommendations for businesses as they prepare for the future of work,  where the hybrid/flexible work model is becoming standard practice and a new approach to security is essential.
• Anthos Policy Controller CIS Benchmark enforcement: A big part of our shared fate philosophy is to build secure products and not just security products. A recent example of this in action is embedding CIS benchmark policy conformance in the Anthos Policy Controller. We believe the more we embed approaches like this into our products, the more application and infrastructure teams can intrinsically embed security at the start and reduce toil for the security team.
• DevOps for technology-driven organizations and startups: A key success factor for many security programs is the partnership and integration with development teams, and there are some great resources and lessons in our DORA research.
• Security by design with Chrome OS: ABN AMRO’s Asia-Pacific region team recently shared how they are using Chrome OS and CloudReady to work securely in the cloud, reduce total cost of ownership, and add flexibility for employees. This is a great example of secure by design principles in the use of Chromium.

Risk & Compliance

• Boards of Directors summary guide to cloud risk governance: The latest whitepaper from the Google Cybersecurity Action Team outlines how boards of directors can prioritize safe, secure, and compliant adoption processes for cloud technologies within their organizations.  
• TruSight Risk Assessment of Google Cloud: TruSight recently released a comprehensive
  risk assessment report on Google Cloud. Our Enterprise Trust team collaborated on this robust assessment of Google Cloud services to validate the design and implementation of controls. TruSight’s risk assessment of our security controls will help customers accelerate and complete their risk management due diligence.
• Data governance: Check out this new blog series on data governance where our teams explain the role of data governance, its importance, and the necessary processes to run an effective data governance program. Implementing data governance will help maximize value derived from business data, build user trust, and ensure compliance with required security measures.

Controls and Products

• Encrypting Data Fusion: To help meet the security, privacy and compliance requirements of customers in regulated industries like finance or public sector, we announced the general availability of Customer Managed Encryption Keys (CMEK) integration for Cloud Data Fusion, which enables encryption of both user data and metadata at rest with a key that customers can control through our Cloud Key Management Service (KMS). 

Don’t forget to sign-up for our newsletter if you’d like to have our Cloud CISO Perspectives post delivered every month to your inbox. We’ll be back next month with more updates and security-related news.

Job seekers can often feel lost or disconnected—like the right opportunity is out there, but they don’t know where or how to look. Employers face a similar challenge when trying to attract the right candidates. Many companies, especially large enterprises, face a talent shortage across a range of critical roles.

For global companies like Johnson & Johnson (J&J), their online career website is an important recruiting tool. It’s the “front door” for talent that could make a vital difference in the company’s future and drive innovation for years to come.

However, career sites are often underutilized. If a job seeker doesn’t find a good job match with a quick search, they will likely move on. Too often, that represents a lost opportunity for both the company and the job seeker that could have been avoided with better search results.

“Partnering with Jibe and using Cloud Talent Solution for our career site allows us to do a much better job matching opportunity to talent on a very large scale.”

—Sjoerd Gehring, Global VP of Talent Acquisition, Johnson & Johnson

While J&J receives approximately 1 million applications for 25,000 positions each year, the percent of applicants that were highly qualified for open positions was low.

Although the company always has a variety of open jobs on its career site, it noticed that even when strong matches existed between online job seekers and available positions, search results often didn’t highlight or even display the right opportunities. The user interface wasn’t intuitive enough, and job seekers couldn’t easily find their ideal positions.

As J&J began to reevaluate recruiting to take a more relationship-centric and digitally-driven approach, the company began working with Jibe, a career-site solutions provider.

Jibe introduced J&J to Cloud Talent Solution, which uses machine learning to better match job listings with job seekers’ interests and qualifications. Using Cloud Talent Solution, companies can build a compelling career-site search experience that helps candidates easily find the jobs most relevant to them. With smarter job searches and recommendations, J&J improved the effectiveness of its career site in just a few weeks.

“Jibe and Google make it easy for a large company to make a real difference in the candidate experience without investing a lot of time, money, or internal resources,” says Sjoerd Gehring, Global VP of Talent Acquisition at Johnson & Johnson. “Now that we’re using Cloud Talent Solution, our career site search results are exponentially better.”

Transforming job searches with better matches

Cloud Talent Solution better connects job seekers with jobs, because it understands the nuances of job titles, descriptions, industry jargon, and skills, matching job seeker preferences with relevant listings based on sophisticated classifications and relational models. It helps decipher job seeker queries and employer job postings, removing the manual effort of optimizing job content for search.

By using the Jibe platform to integrate Cloud Talent Solution with its career site, job seekers are more easily finding what they’re looking for and J&J is filling business critical roles more efficiently.

Since integrating Cloud Talent Solution, J&J has seen a 41% increase in high-quality job applicants per search and a nearly 45% increase in click-through rate on its career site.

“Partnering with Jibe and using Cloud Talent Solution for our career site allows us to do a much better job matching opportunity to talent on a very large scale,” adds Sjoerd. “We’re able to take a more personal approach and really connect with job seekers, which is a win.”

“Today’s job seekers expect a prospective employer’s career site to work like the other cloud services they use. Using Google’s machine learning and artificial intelligence, we can help customers like J&J get better search results and return jobs that candidates are more likely to apply to.”

—Joe Essenfeld, Founder & CEO, Jibe

Connecting people with opportunities

J&J is now offering job seekers experiences in line with what they have come to expect as consumers—searching for a job should be as easy as searching for flights, restaurants, products, and other services. Because candidates are familiar with the experience, their level of interaction and engagement goes up, creating a larger pipeline of qualified candidates and filling jobs faster.

“Today’s job seekers expect a prospective employer’s career site to work like the other cloud services they use,” says Joe Essenfeld, Founder & CEO at Jibe. “Using Google’s machine learning and artificial intelligence, we can help customers like J&J get better search results and return jobs that candidates are more likely to apply to.”

A new digital revolution for recruiting

J&J continues to work with Jibe and Google to offer new features which make its career site even more effective. By offering job seekers a transformative, engaging experience, J&J is a more attractive and visible employer, increasing the value of its brand. It’s also continuously improving its recruiting process with end-to-end visibility and feedback from interactions with a million people every year.

“Transforming our career site with Jibe and Cloud Talent Solution directly impacts our ability to attract high-quality talent and hire those candidates faster,” adds Sjoerd. “Lots of people are looking for their dream job, and if it’s here at J&J, we want them to find it quickly and easily.”

It’s incredible to see how startups across industries are using cloud technology to help address some of our most pressing, important, and life-altering challenges. Startups and high-growth technology companies are choosing Google Cloud and using technologies like Google Compute Engine (GCE), BigQuery, Looker, Firebase and more to help businesses reduce energy consumption, build more inclusive and sustainable workforces, and in the case of high-growth biotech company Freenome, are creating diagnostic tests that will help detect life-threatening diseases like cancer in the earliest, most-treatable stages.

Freenome is driven by its mission to develop high-quality diagnostic tests to detect and treat diseases like cancer from a simple blood draw. In 2022, Freenome significantly accelerated its growth on Google Cloud to support the business as it began the clinical trials of its diagnostic blood testing technology. Today, the high-growth biotech is further deepening its partnership with Google Cloud in order to support its rapid growth and scale as it concludes clinical validation, takes its tests through FDA approvals, and prepares to bring its product to market.

When detected early, data shows that there is a higher probability for cancer to be beaten, yet not everyone has access to early detection measures. By creating a way to detect the earliest warning signs of cancer with a standard blood test, Freenome is helping bridge the gap between accessibility and early cancer detection. To do this, Freenome built a multiomics platform capable of analyzing and detecting disease-associated patterns in the blood using molecular biology, advanced biology, and machine learning. By applying machine learning models trained to scan for tumor and non-tumor biomarkers to the diagnostic process, Freenome’s tests can identify suspicious molecular patterns in a patient’s blood, which will ultimately help more people detect cancer at its earliest stages in the body.

The amount of molecular data extracted from blood samples can quickly add up to hundreds of terabytes worth of data, so it was clear early on that Freenome would need infrastructure that could support the fast sequencing and processing of large amounts of data. In addition, Freenome’s collaboration technology needed to provide flexibility, security, and proper identity management safeguards, given the nature of its business. To meet these needs and support the company’s plans for growth and innovation, Freenome selected Google Cloud as its primary cloud provider, utilizing services like Google Cloud Storage and Google Kubernetes Engine (GKE), along with Google Workspace as its collaboration platform.

Using Cloud Storage alongside GKE gives Freenome the computing power needed to sequence and process mass amounts of blood sample data with high-performance, speed, and at scale. Cloud Storage also makes it easy for Freenome to leverage other Google Cloud capabilities like BigQuery for analytics with built-in query acceleration. Additionally, the built-in cluster management capabilities of GKE make it easy for Freenome’s engineering and IT teams to manage and deploy new workflows to the high-performance computing clusters used by the machine learning components of its multiomics platform to speed up cancer detection. Freenome also uses Google Cloud technologies like Artifact Registry and Cloud SQL, which help the company ensure a managed and secure software supply chain of containers and other artifacts.

Today, as a part of its expanded partnership with Google Cloud, Freenome is significantly increasing its use of Cloud Storage and GKE as it works to complete the clinical trials related to its diagnostic test. By expanding its use of GKE and Cloud Storage, Freenome will be equipped to perform the compute-intensive analytical work required for running its research workflow and diagnostic classifier algorithms. In addition, Freenome teams will continue leveraging Google Workspace products across the company so they can securely manage and collaborate on business-critical content.

Besides using Cloud Storage, GKE, and Google Workspace to support the company’s rapid growth, Freenome plans to leverage Google Cloud technologies like BigQuery to support the research and development of new products. The company is also testing security technologies like BeyondCorp to keep its growing workforce secure and productive at scale.

As the future of disease detection continues to evolve, Google Cloud is proud to support the growth of innovative companies like Freenome with infrastructure and cloud technologies so they can help empower more people with early disease detection solutions and ultimately, change more lives for the better.