Google’s Eighth Employee On Safeguarding The Company’s Business Cloud

Like every one of the vast number of Google employees roaming San Francisco’s Moscone Center for the company’s Google Cloud Next Conference this week, Urs Hölzle is wearing a name badge identifying him as a “Googler.” That isn’t exactly the whole story. Hölzle joined Google in 1999 as its eighth staffer. Ever since, he’s been working on the never-ending challenge of ensuring that the company’s data centers are fast, reliable, efficient, and secure. His innovations in these areas have played a huge role in the Google story.

Today, as senior VP, technical infrastructure for Google Cloud, Hölzle is focusing his efforts on the services the company offers to business customers, including the on-demand web resources that compete with Amazon Web Services, as well as G Suite (the productivity tools formerly known as Google Apps). I spoke with him at the Next conference on Tuesday afternoon, before his Wednesday-morning keynote—one of three at the event, which runs through Friday. He gave me a preview of some of the topics he planned to talk about, many of which involved helping companies secure the software and information they store on Google’s servers:

A phishing fighter

Two-factor authentication—logging into a service using a password and another piece of evidence to prove that you’re you—is far safer than a password alone. But it’s not hack-proof. If you enter a six-digit code retrieved from your phone, for instance, you still run the risk of someone creating a fake log-in screen, fooling you into entering the password and six digits, and them using them to break into your account.

Working with companies such as PayPal, Google has developed a tiny USB key with a capacitive nub. Plug it into a computing device running Chrome or Android, touch it, and it communicates with Google’s servers to authenticate your identity in a way that isn’t susceptible to phishing tricks by interlopers. “Without compromising Google, [an attacker] can’t compromise your account,” says Hölzle. Google is adding the technology to G Suite and the Google Cloud platform.

An intranet killer

Many companies store confidential information and tools for employees on an intranet—basically, a website that’s only available inside the corporate firewall or via a VPN. That introduces problems relating both to security (a snoop who has access to the network has access to the intranet) and usability (nobody loves using a VPN).

Google’s Identity-Aware Proxy technology–building on research it published in a paper called “BeyondCorp”–is deployed within the company, and a work in progress as a commercial service. It aims to render intranets and VPNs obsolete by giving companies the ability to authenticate users and offer finely granulated access to internal tools over the internet. The goal is to let the right people reach the right tools and files from any authorized device in any permissible location, and block everyone else. “Once you’ve expressed what you want, it’s always enforced,” says Hölzle.

Servers that can spot tampering

Google is upgrading its servers with a custom-designed security chip called Titan that can check the software that’s running and verify that it’s exactly what it should be–starting at the lowest level with the BIOS firmware, which, if compromised, gives a hacker the keys to the kingdom. “If someone can put a bad BIOS on your machine, than the whole security system above that falls down,” Hölzle says.

In the early days of the great migration from on-premise servers to the cloud, many big companies believed that entrusting an outsider such as Google with their business-critical apps and data was riskier than managing their own servers. Today, once Google gets a chance to explain everything it’s doing, Hölzle says, “it’s a different conversation.” One example: A single Google data center employs 175 security guards. The company rolls that expense, which few customers could bear on their own, into the pay-as-you-go price it charges for computing services.

The way Hölzle looks at it, if 10,000 companies each spend $10,000 on securing their online presences, it adds up to a $100 million budget that’s better invested in the sort of fundamental reinforcements that Google can deploy to all its customers. “There’s no question,” he says. “And actually, you don’t have to spend $100 million.”