Four Questions On Google App Security

Need proof that the computing world is dominated by applications engineered by search giant Google? Just stare into your laptop.

The Web-wandering public has increasingly forsaken Microsoft Outlook and Lotus Notes in favor of Gmail as their e-mail program of choice. Companies that sell software to measure website performance have a tough competitor in Google Analytics. And the list goes on.

Naturally, this makes the Google universe a tempting target for those who would exploit application security holes to infect computers with malware, steal credit card and Social Security numbers and make off with a company’s intellectual property.

In this Q&A, Eran Feigenbaum, senior security manager for Google Apps, and Adam Swidler, product marketing manager for Google Apps, explain the steps Google has taken to defend their users against online evil and how, as a result, the company has become a serious contender in the security industry.

There’s been some debate over whether it’s truly possible to have secure cloud computing. What’s the Google argument in favor of it?

Eran Feigenbaum: The reason we’re doing cloud computing and we think it works is — first of all, we see tremendous security issues with the traditional client-side server: misconfiguration, missing patches, having things turned on you didn’t know you had turned on, and so on. Then there’s the complexity of running multiple versions of different applications on the network. It all becomes very difficult to secure. Before joining Google in 2007, I lived that problem at my last job as CSO in a financial services organization.

Talk about what Google has done to learn from those problems.

Feigenbaum: With cloud computing and specifically Google apps, we’ve been able to learn from those lessons and design a relatively newer infrastructure that doesn’t have those problems. For example, our millions and millions of servers all look identical. We manage all the physical and virtual components, the hardware, the operating system, and since everything is identical, it’s easier to manage the technology. When you need to make a change it’s much easier to do when everything is more uniform.

Chris Hoff (chief security architect for the systems and technology division at Unisys and an advisor on the Skybox Security customer advisory board) is one of the more vocal skeptics of cloud computing and virtualization security in general. He believes there’s too little understanding of the technology to secure it properly. virtualization. Cloud computing is just saying, we have a large infrastructure — one that is identical in our case and easier to manage — and we are going to use that to benefit customers via a shared service. Google Apps, specifically, is built around message application, security and compliance. A lot of companies and vendors intentionally or unintentially get it mixed up.

Feigenbaum: There’s a misconception around grouping cloud computing with

Adam Swidler: When we talk about cloud computing, this is not a virtualization strategy. This is about outsourcing a lot of the security to us. We build in the security from the ground up. The only way to be more secure is to constantly test your defenses. Google is always under attack, and so we are currently adjusting and hardening security. We feel increasingly that the cloud is the best place to solve your e-mail challenges. The fact that your first line of defense is in the cloud, in the path of incoming threats like e-mail spam, putting a solution in the cloud keeps all of this out of your infrastructure, which makes things more cost-effective and allows us to stay a half-step ahead of the bad guys, who are always getting smarter and more sophisticated. How is Google using the recently-acquired Postini filtering service to address application security concerns?

Swidler: We really continue to sell Postini as a separate offering, separate from Google Apps, for companies that are still running their own e-mail servers such as Lotus Notes or Microsoft Exchange. We have taken a big chunk of Postini’s technology and incorporated it into the Gmail client. But the heaviest usage is still among companies that have not yet switched to the cloud. But given how Postini technology has been incorporated into Google Apps, companies using Postini are in a better position to make the switch over to cloud computing.