3 ms·

I know security is not compliance, and I'm not here to compare the two, but Google goes to great lengths to protect security. [0] TL;DR: - Google's global SDN

by vgt 10y ago

I know security is not compliance, and I'm not here to compare the two, but Google goes to great lengths to protect security. [0] TL;DR: - Google's global SDN is ultra-secure, and Google carries your packets on its network rather than dumping them onto public web. Google's undersea cables are shark bite-proof! [1] - Google Data Centers are mostly homogeneous and rely on Google-build hardware rather than vendors. This greatly helps with securing infra - only one vendor (Google) to trust, only one set of best practices to follow, lower risk of misconfiguration, and exposure risk is minimal. - > 600 security engineers. - Encryption-at-rest and in-transit is ubiquitous. [0] https://cloud.google.com/security/whitepaper https://cloud.google.com/security/whitepaper [1] https://www.youtube.com/watch?v=XMxkRh7sx84 https://www.youtube.com/watch?v=XMxkRh7sx84 (work on Google Cloud, not in marketing :) )

Johnny555 10y ago
I can't find "ultra-secure" in any of our security certification docs. Is that better or worse than "super-duper secure"? For security, I don't care whether my traffic as routed over a private network or public web as long as the data is encrypted, because a "private network" is only as private as thousands of miles of fiber and every single network facility it traverses can be. Which means 'not very'. Does Google build it's own hard drives/SSD's and CPU's? If not, then that's at least 2 other vendors to trust since both CPU's and hard drives are related to hardware security.
- vgt 10y ago
  Ha.ha. Did I mention I'm not in marketing? I do appreciate your passion! On your first point. There is a very strong risk of inadvertent misconfiguration or your employees not following best practices.. Or even poor documentation. Google cloud by default gives you a global secure vpc that never traverses public internet, so there's less risk because the baseline of security is high. Sure, you can run VPN tunnels between data centers. Point is, with Google cloud you don't need to. On the latter point, of course you cannot eradicate every vendor, especially within the obvious context of this specific Intel announcement... But, again, not having three dozen flavors of configs and four network router vendors does make a difference. I would encourage you to read the paper I linked to above (discussed this topic in great detail), and also perhaps [0]. Also security folks at Google, who are much more qualified to discuss this topic than I am, frequently post on hn. [1] [0] https://cloudplatform.googleblog.com/2016/02/Google-seeks-new-disks-for-data-centers.html?m=1 https://cloudplatform.googleblog.com/2016/02/Google-seeks-ne... [1]https://news.ycombinator.com/item?id=13388941 https://news.ycombinator.com/item?id=13388941

by vgt 10y ago

Johnny555 10y ago

I can't find "ultra-secure" in any of our security certification docs. Is that better or worse than "super-duper secure"? For security, I don't care whether my traffic as routed over a private network or public web as long as the data is encrypted, because a "private network" is only as private as thousands of miles of fiber and every single network facility it traverses can be. Which means 'not very'. Does Google build it's own hard drives/SSD's and CPU's? If not, then that's at least 2 other vendors to trust since both CPU's and hard drives are related to hardware security.

vgt 10y ago
Ha.ha. Did I mention I'm not in marketing? I do appreciate your passion! On your first point. There is a very strong risk of inadvertent misconfiguration or your employees not following best practices.. Or even poor documentation. Google cloud by default gives you a global secure vpc that never traverses public internet, so there's less risk because the baseline of security is high. Sure, you can run VPN tunnels between data centers. Point is, with Google cloud you don't need to. On the latter point, of course you cannot eradicate every vendor, especially within the obvious context of this specific Intel announcement... But, again, not having three dozen flavors of configs and four network router vendors does make a difference. I would encourage you to read the paper I linked to above (discussed this topic in great detail), and also perhaps [0]. Also security folks at Google, who are much more qualified to discuss this topic than I am, frequently post on hn. [1] [0] https://cloudplatform.googleblog.com/2016/02/Google-seeks-new-disks-for-data-centers.html?m=1 https://cloudplatform.googleblog.com/2016/02/Google-seeks-ne... [1]https://news.ycombinator.com/item?id=13388941 https://news.ycombinator.com/item?id=13388941