How to mitigate data exfiltration risks with Google Cloud security controls

Key Takeaways

foreign [Music] thank you all for joining good afternoon everybody welcome to day two of next I know y'all have busy schedule so I appreciate you spending the next 45 minutes with us so what are we talking about today to do that I just want to do a quick show of hands um how many of you in this room do not know or have not heard of VPC service controls okay one okay there's a few um that's good um the reason for the question was to make sure how much of time I need to spend on the introduction this these sessions are being recorded so uh United anyway do an introduction on the technology but what you're going to do in the next 30 odd minutes is to Deep dive into what VPC service controls are as I'll Now call it vpcsc is uh why it is one of the more popular security controls coming out of Google Cloud Stables and how it is evolving then I'll hand the session off to Christian Christian Gorky uh who is the vice president and head of cyber Center of Excellence at Commerce Bank he'll walk you through his his bank's Journey with vpcsc and how it provides a unique value proposition and data exfiltration so about me uh my name is sriram balasubramanian I go by SRI I am a senior product manager here at Google and as you begin this session I want to start off with a quick congratulations to everybody in the room the folks in the room are here because you're all highly attuned to the risks of data exfiltration and the challenges encountered in securing data I shouldn't have to say this but data exfiltration is a costly problem for almost all organizations the reasons are many but what is important to keep in mind is that data acceleration happens not because of the absence of security controls in fact it happens in spite of strong controls because ultimately misconfigurations can happen vulnerable code continues to show up credentials get stolen or leaked now to put an analogy into this you know when you have with your vehicle you have a collection of safety controls but among all of this one way to think of what a data acceleration control is is like a child lock for a car door you know just as you want your precious Commodities in this case probably your kids or anybody else who are in the back seat you want to control when they leave the vehicle you similarly want to have controls around how and when data goes out of your organization this will ensure that data doesn't just leave an organization in the event of a compromise caused by one of these factors I'm sure you've all heard of the well-known stories of Defense in depth and security layers of onion so on and so forth at Google We Believe security is a shared responsibility and we follow a shared responsibility model here we work to secure our networks and our infrastructure and our goal is to provide customers the tools necessary to do so on your own projects at many various levels of the networks track whether it's from an infrastructure perspective networking perspective identity perspective internet facing application perspective and so on and so forth however when building a stack and we realize this uh two three years ago that most organizations have the challenge when it comes to defending against exfiltration you know the problem is typically addressed by making a determination to go off internet and use tools like caspi secure web proxies or other proxies for any internet access and even have controlled access there however if there is an attack Vector that is targeting your multi-tenant Cloud delivered services it is extremely hard to use a secure web proxy or even go off internet and use that as a vehicle to prevent that primarily because it is almost impossible to separate what is legitimate access versus what is an Excel attempt you can at that point only be as secure as your credentials or configuration is this is the problem that VPC service controls aims to solve it aims to provide you for Google multi-cloud uh apis or Services API level exfiltration controls in it to put it simply and I'm going to throw a few buzzwords here VPC service controls is a zero trust based Cloud offers security Centric model for preventing data exfiltration from multi-tenant Google services Justice Network Identity or device controls but operate as an overlay on top of all these boundaries and working in conjunction with other security controls as I mentioned to you API based acceleration is the most common way by which bulk data exfiltration happens in organizations so it functions by controlling and restricting APA communication for Google managed Services across the three paths for service access which is internet to service other VPC networks to the service and service to service how it does this at its basic level is it operates by creating an abstract boundary around the group of resources and services that you want to protect we call this a vpcsc perimeter once created resources within the perimeter are free to talk to each other however all APA access that spans perimeter boundaries gets blocked in such a scenario any credential theft misconfiguration that could allow data movement across the perimeter is rejected by vpcsc we however realize that this kind of a binary state of allow inside the parameter and denied outside the parameter might be too restrictive for legitimate access parts to support that we built into vpcsc what we call directional rules that allow you to explicitly permit the flow of apis for a particular service in either direction from outside the parameter to inside or from inside to outside these rules are very powerful and allow you to ensure granular granular least privileged access to your services please keep in mind you don't use vpcsc and then say Oh I don't need my firewalls anymore this works in conjunction it focuses on a particular Threat Vector and it does its job very well now how do we make this happen what are the building blocks of vpcsc uh first and and I think there's a step that I did not mention in the slide is first I I you need to sit with your teams and figure out various sensitive data is in most cases you'll probably start with um a bigquery data set a GCS bucket or a collection of buckets but identify which data sets you are worried about leaving your environment once you identify that identified a set of resources and services that are connected to that that you want to protect you could Define these uh as projects and or VPC Networks you then create an abstract parameter a perimeter is just an abstraction it's not something that's set in stone it's an abstract it's an abstract boundary that you create around all these projects and services once you create this parameter next step is to figure out which Services you want to restrict in the parameter those are the only services that will be restricted by vpcsc my recommendation here is to read what we publish in google.com called supported Services document or our supported Services page around vpcsc before you start to roll it out this is important because what is unique about vpcsc is not only does it restrict what we call Visible access paths where a particular user or a workload access service it also controls service to service access Parts if we perceive that that could be a way by which data can be extracted from a perimeter so what is this would mean is for services it would in it would create additional restrictions on how a particular service can be used with the goal of threat exfiltration prevention in mind no there is a Next Step called VPC accessible Services I'll skip it for a moment and I'll come back to it now beyond that that's when you you have to decide once this parameter is created are there legitimate access flows that I need to permit and that's where our directional rules come into play these directional rules are extremely granular you can restrict it at an individual identity an identity and a network or just a network based on locations and so on and so forth and on the other side when the service itself is being accessed you can either broadly allow or deny access to a service or a group of services or you can get more granular and say for this service I will only allow these methods to be accessed this will ensure that truly any access is controlled by you irrespect and you can still have administrative permissions for the project handed off to the project owner so this allows the security team to provide this overlay umbrella protection against exfiltration now finally before you roll it out we have what is called a dry run mode in VPC AC which essentially turns on the controls but operates in a log only mode so putting a service in dry run mode and watching traffic flows and violations over a period of time will allow you to decide what violations are legitimate violations that you would want to block and what violations are not legitimate that could lead to business impact that you want to allow by adding an additional rule so my recommendation is whenever you create a VPC policy or whenever you make changes to the policy use the dry run mode going back to VPC accessible services we have in many conversations with customers the security teams want to be much more prescriptive with in terms of what workloads and resources within a VPC can even access that is what vbc accessible services does because when you create a parameter obviously there is free conversations within a parameter and there is if you have a policy workload within the perimeter can access Services outside the perimeter VPC accessible Services provides an additional layer of control and restriction that you can take advantage of finally you can move to enforce mode and you should be protected lots of interesting questions come here when you talk about this how do I decide how big my perimeter is do I need to build this Perimeter at an organization level do I need to build this at a at a project level do I have to combine a bunch of projects together there is no one answer to this what I have seen is customers either primarily they operate in one of three models either they have one perimeter across all their organization and ensure that all projects whenever they are created are part of this parameter the idea here is I am worried about external threats that's outside my gcp organization and I want to protect it then there are customers who have strict policies around cross functional conversations so you know my Dev environment should not talk to my broad environment there we see this multi-parameter model group of customers who don't want strict restrictions but want to protect their critical data sets create small perimeters around their critical data sets to just protect access to it these are the three common models seen there are more in between and and around it but um as you mentioned vpcsc's capabilities don't stop with the English secret rules within these rules as well as outside of the rules you can leverage our context of our access capabilities to create Access Control based on non-network non-identity attributes particularly based on uh sustaining attributes like session time or time in general identity IP address and more importantly device based attributes like whether an X5 online certificate is present on the device or not we we require Beyond carb the Beyond Corp Enterprise product or Beyond car Essentials product to be available for you to do this um so that's my quick overview on vpcsc before I leave I do want to give you a quick view on what we have and what's coming vpcsc's roadmap is is robust and I feel like I've talked a lot already but uh this is interesting um we decided when we looked at vpcsc that our roadmap should cover multiple pillars because there is needs across multiple pillars the first one is scale and as you can see from the numbers here we have seen vpcsc being used and used as a default Security Control in a large number of customers so we have asks anyway from supporting you know 5000 perimeters to 20 000 projects uh in a perimeter so our environment is now scaled to 40 000 resources ten thousand parameters ten thousand policies and we also have a way to scale out uh through a capability called scope policies the next function how specific or granular you can be with your English secret rules which is how you allow access into the perimeter you can Define these rules based on VPC networks and what we are announcing in preview is the ability to use your private IP addresses to extend vpcsc network protections and allow for controlled access to your gcp services from on-premise prior to this for any of your on-prem resources you just have a Landings on VLAN and that VLAN if it's part of the perimeter it's free range for on-prem you can't you don't need to do that anymore of course we did work on flexibility as well which is how you define a perimeter and we extended what you can use to define parameters to include VPC networks too uh finally uh ease of management is critical delegated Administration that we have come up with so that you can distribute management of your perimeters itself in large environments and finally what is VPC service controls but protection for Google services so it is imperative that Google services adopted for you to see True Value out of it we are 85 I think we are close to 90 coverage as of Q 223 and we have mandated that any new service coming out of Google's table will support vpcsc SGA with the star there that says conditions are play I think I've spoken enough I'd like to welcome welcome Christian on stage to talk about his experience with vpcsc and the tenants that he's using Christian welcome thank you very much SRI for the thank you very much three for the for the uh introduction of EPC service controls and also on the roadmap on the features next to come presented from uh or provided by Google and now let's switch over a little bit to a dialogue with comments bank so as reset who am I I'm Christian guaca head of cyber Center of Excellence from coax bank and um I want to talk to you a little bit about comets bank before we are switching over back to VPC service controls and how we are leveraging VPC service controls so first of all whose comments Bank comments bank is the leading bank for the general middle stand meaning we're having uh around 26 000 corporate clients and uh roughly 11 Millions private and small business customers so this is also um the reason why we have a client focused portfolio we are separate into these two categories private and small business customers as well as corporate clients then what you see in the in the center we have a focused business model uh comprised of Five Points versus personal advice we're offering meaning we see the customer as the main focus point so we want to be the personal partner for our customers second consistent customer focus this means customers demands are changing and we need to put the key again the customer first in order to provide the right services to the customer third comprehensive digitalization means that we are constantly evolving to become and provide better faster and more advanced products in a digital portfolio fourth is profitability before growth so Focus totally on the on the on the customer demands and last but not least sustainability which includes both sustainable products Financial products as well as helping customers to achieve their sustainable transformation now this is comments bank and within comets bank there's a division key area which is called Big Data and advanced analytics and before I talk to you what we are exactly doing there I want to give you some some numbers first of all we are roughly 500 people uh dispute across four countries um interesting is that we were the first business area of Commerce Bank in the public cloud and when we work with other key areas in the bank we actually get a very good rating from the others so meaning what we are doing is probably quite quite quite good and an interesting fact that I want to share especially with this audience is um we drive a certain kind of innovation and one point of this Innovation is that we actually contribute towards Google Cloud's repository code repository so we did I guess a hat trick last year and this year again contribute multiple times to the source code so if you use containers on Google cloud or do anything with security on Google Cloud there's a chance that there's somewhere some part of Commerce Bank running in it and so on a more factual basis what is PDA doing doing big data and advanced analytics so we are creating value from data meaning we are gathering very hardly speaking the data of the bank and then we are providing analytics services on top of it and offer both as a product or service so for example two use cases one is electronical self-disclosure so meaning automated scanning and machine learning algorithms applied to transaction data and the Second Use case is what we call press for today so this is more like looking at the overall Global available news and then connecting these news with our corporate clients now back to me I'm heading as that's a cyber center of excellence and our vision is to force the secure scalable and standardized public Cloud create the infrastructure and framework to become a cloud first business we are responsible in BDA for data protection information security and cloud and the important part for now of course is information security and and cloud and within Cloud we are helping the bank the banks use cases to transition into the cloud to land into the cloud we have engineering rehab with the architecture we also do product development which we call the cloud Enterprise Suite because we can make the cloud very secure but our goal is not only to make the close in queue but also trustworthy and last but not least we are also doing knowledge sharing we call it E equals MC squared so this means excitement equals multiplication of knowledge times culture times curiosity because you know we don't only want to talk about Cloud we also want everyone we are talking to to also experience cloud and to learn why Cloud would help them to achieve their benefit their business goals okay now we have learned about Commerce bank and now back to VPC service controllers before we introduce service controls on our roadmap there too we actually had five questions and I want to explain to you how we answer these five questions um the first question that I want to show to you is when bringing organizations and applications to the cloud which threat threat vectors shifted with a high impact and actually if you look at it and you move to the cloud one thing that changes drastically is the model of the shared responsibility or shared fate meaning the services the customer is taking care of is by it reduced to actually the data and the applications of the cloud service customer and the cloud service provider is taking care of let's say the data center of the cables and of the lower level management and you can shift this up to a maximum where the customer is only dealing with applications data and maybe it's processes so this means the threat landscape moves completely to data and applications second point the data transmission is completely handled differently than on-prem so if you compare what you most likely know from on-prem is imagine you have a house and in this house you have a lot of rooms if you want to go from one room to another room or from one room and one house to another room in another house you need a lot of keys you need to know where to go now if you compare this to cloud cloud is completely different Cloud works like this room here it's a large room and actually everyone can talk to anyone I just need to ask you hey can I talk to you is a user yes or no and that's it and no one else is stopping me so the question is now okay data transmission you have to think about how do we secure this how does data movement actually is controlled and so this is an inherent question we need to ask and we need to resolve and resolve result was that we actually as I've seen a 10 times increase of importance of IIM controls and but IM controls isn't enough because you can control I am but can you control where your data flows do you want to control that your data or do we want to see your data moving anywhere of course not so this boils down to data exfiltration prevention where data exfiltration means your data is moving from your assets to external assets and lateral data movement means that your data is uncontrolled flowing within your organization and actually we don't want any of that no knowing this second question was what are your main security requirements When selecting a cloud service so now we have learned okay um which how did the threat model change but how do we select now the right services on Google Cloud where we build a model for that and we first start with the security foundations and as we are strongly regulated company in Germany in Europe underlying multiple regulations local regulations in-house regulations Europe regulations there's a lot coming together telling us what to do and especially what not to do and these are external drivers we also have internal drivers which come from different setups from organization requirements which again Define the internal standards on security and if we take both together you actually get us output the system security requirements and system here as the Google cloud and now we know we have security guidelines we have security measurements and now we need to know how to steer the Google Cloud but this is very generic how do you map it like a very generic model to specific things like let's say Google Cloud Storage or VPC service controls there is no mapping and so we built a mapping we call it the cloud service security assessment and so for each service that the cloud Google cloud is offering we actually evaluate evaluating a series of security features for example we want to see if the data can be encrypted with our key customer management encryption Keys We want to make sure that the data stays in Europe so we need to have a Geo recognization applied to it we want to see that the services that Google is offering to for us actually certified in the sense that there's a certification from ISO 27001 or psic5 or other equivalent standards and after that as an outcome we get this metrics that you see here on the on the bottom right part of the of the slide so that your lines are your services and your columns are all the the the security requirements that we apply and then on the right hand bottom side as an outcome you get the cloud service secure configuration so for each service that was slow whitelisted we also need to Define how to use the service just because you know cloud storage is secure doesn't mean that everyone knows how to use cloud storage securely yeah because I can trust create a cloud storage and cloud storage supports customer management encryption keys but this doesn't mean that every bucket that I create will immediately have a cloud managed encryption key so that's why we need both now next question how do we protect our Cloud Google Cloud workloads against data exfiltration threads so we have learned about data exploration and we have learned about the Google cloud services Nexus how do we protect them and first let me share with you a very interesting fact so if you move to Cloud and you use a lot of Google Cloud native services like cloud storage bigquery Pub sub you name it it's a one thing you will you will encounter is the more you use stuff on Google Cloud the less you will deal with IP addresses or your there are the IP stuff will come in transparent for you it just it's happened magically by Google in the background and we did a survey on on all of the video Cloud resources on the cloud actually over your 90 of all our services that we are using across all use cases um leverage API communicate communication only so meaning that no IP address is used and as a result is that all the traditional and classical security that we have built over the years for managing IP addresses securing HP address suddenly doesn't apply anymore so meaning we have two results the first one is all the firewalls as we mentioned the firewalls are still important for the other 10 but for the 90 we cannot apply it and for this 90 we need a new model a new thread model how to think about how can we secure our workloads on Google Cloud and now I I talked a lot about how to secure it but what are we exactly securing again so I talked about data exfiltration and this slide shouldn't scare you but I want to show you how you can access trade data from your organization like within seconds so the first step what you need to do you need to have an employee who can read some data so here's part of your organization and he's part of the good project of the green project and he gets Rich access to data this is totally usual this is part of every organization because otherwise you can process the data but now what is happening in the second step this same employee in his free time back at home just creates another Google Cloud project no one is going to stop him and well on this project what he's doing in this is just I mean he's the owner of the project obviously when he's created it but he is right permissions on the evil project outside the organization on the left hand side yes read permissions and all he's doing is just using Chia Studio copy left bucket right bucket and that's it so three easy steps to exfiltrate the data and this is not what we want to have we need a tool in order to make sure that we control how the data is flowed how the data flows and this is of course where we come to PPC service controls and here I've listed some reasons why we went for VPC service controls so you can I mean to to name one one term how you can imagine which service controls it's like a like a zero trust API firewall it is much more than that but um maybe it's easy to to imagine something like this you have organization administrators who are responsible for making sure that this setup is only controlled by the organization admins it's not under control by the use cases it is based on identities and services and it is cut into parameters limited Bridges and access levels parameters you can imagine like is one project is one parameter and with all the settings you can access you cannot access as part of a parameter if two use cases want to speak to each other you need a parameter Bridge and the functional properties actually are well now suddenly we can control our access to the Google apis because we have this parameter boundary around the services around identities around projects and so we have a very fine Crest fine grained access model for all our data for all our assets and yeah the only thing uh left on the list which is important to think about is that it's non-transitive what does this mean this means if I grant three access to my buckets and three grants access to some of his friends access to his bucket his friends don't have access to my bucket so I need everyone who needs access to my bucket needs to explicitly ask me so this then in the end leads to the vpcsc standard architecture that we have established and it consists actually four elements for easy to understand elements the first one is so and these elements each element of this talks about data transfer when I'm talking about data transfer I of course mean controlled data transfer the first one is we want to make sure that no data leaves comets Banks environment the second point is we want to make sure that no one from outside of comments Bank can access the data inside of commands Bank these are maybe the obvious ones but now even inside of comets Bank we want to make sure that use case one cannot share data with use case b without permission so there's no no bleeding no overlap between the use cases and the third thing or here on the slide fourth thing is you even want to control the data flow between stages within a single use cases so as an example we have a developer and the developer is a very good developers the best developer we have in Commerce Bank and this is developing a new cool business product in depth and is that well I need I need productive data in order to see that my tool is working and if you don't have a VPC standard actual standard architecture in place this developer in depth will have access to production workloads because he can just you know copy it as I said just as one one command so we need to make sure this is this developer gets of course its own desk test data but on the other hand but it's still more important does not have access to productive data and so the vpcsc standard architecture greatly reduce the thread surface and establish automated control this is fully automated it is zero trust architecture and we have validated multiple times with several Security Experts as well as from also from Google and as far as I know the best of my knowledge we were the First Financial Institute rolling out the security architecture back in 2020. so you can say why are we using VP service controls using for three reasons one is as a data acceleration a mitigation second is to control the data flow the data sharing and third is to build environments next question given your VPC service control standard that you have seen right now how do you monitor violations internal usage of the standard this is actually quite easy we have two dashboards the dashboard on the left with Lucas Studio we are monitoring the VPC as the effectiveness so we see how many violations we have which kind of violations against which services against which projects from which country and then we are evaluating this together with our zoc team on the right hand side you see actually with everything Cloud monitoring we are monitoring the vpcsc limits in quarters so when when here we see how many parameters we have on on Google cloud and the more red you see here the more I will call series number and tell them hey please scale more and so this is how we make sure on the left hand side that the service is working correctly we can drag it and on the right hand side we see how much we grow into into Google Cloud and this brings me to my last question which may be the most important one for for you as the audience here how can other Google Cloud customers achieve the same high level of data exfiltration mitigation as we do and of course there's no one fits all answer but first thing that you need to do is you need to build a vision so what are you trying to achieve do you want to have Cloud for cloud do you do you use the cloud actually for cloud workloads or do you use the cloud for on-prem workloads how do you secure your data workflow to implement zero trust and if you have when you have established this Vision the next step is what do you need to actually bring this Vision to life do you need Executive sponsoring do you need Security Experts do you need Cloud experts who do you need to involve in general and after you have placed division admission the next goes towards process and technology so the question is how much have you matured into the cloud already how many of your workloads are Cloud native which workloads do you need to secure and how do you embed the VPC service control into your organization do you have probably a lot of projects a lot of services how do you make sure that all of these are covered by the by the security standards and last but not least but often the most important part is the people so how do we make sure that that is clear who owns the standardization so I just showed you our standardization how do you make sure it is correctly implemented how do you make sure there's an owner who drives the standard how do you control the monitoring and last but not least how do you share knowledge how do you make sure that this doesn't feel as a burden to the organization but this field actually actually as an enabler for a company and after you have answered these questions then it's on YouTube of course implement it and hopefully have a more secure security posture on Google clouds this brings me to the end of the Commerce Bank part for VPC service controls and thank you for your attention I will now head over back to three foreign