Because Google has seven services with more than a billion users,
you can bet security is always on the minds of Google's employees.
Design for security is pervasive,
throughout the infrastructure, the GCP and Google services run-on.
Let's talk about a few ways Google works to keep customers data safe.
Starting at the bottom and working up.
Both the server boards and
the networking equipment in Google data centers are custom designed by Google.
Google also designs custom chips,
including a hardware security chip called Titan
that's currently being deployed on both servers and peripherals.
Google server machines use
cryptographic signatures to make sure they are booting the correct software.
Google designs and builds its own data centers which
incorporate multiple layers of physical security protections.
Access to these data centers is limited to
only a very small fraction of Google employees not including me.
Google's infrastructure provides cryptographic privacy and
integrity for remote procedure called data-on-the-network,
which is how Google services communicate with each other.
The infrastructure automatically encrypts our PC traffic in transit between data centers.
Google central identity service which usually manifests to end users as
the Google log in page goes beyond asking for a simple username and password.
It also intelligently challenges users for additional information based on
risk factors such as whether they have logged in
from the same device or a similar location in the past.
Users can also use second factors when signing in,
including devices based on the universal second factor U2F open standard.
Here's mine. Most applications like Google access
physical storage indirectly via
storage services and encryption is built into those services.
Google also enables hardware encryption support in hard drives and SSDs.
That's how Google achieves encryption at rest of customer data.
Google services that want to make themselves available on the Internet
register themselves with an infrastructure service called the Google front end,
which checks incoming network connections for correct certificates and best practices.
The GFE also additionally,
applies protections against denial of service attacks.
The sheer scale of its infrastructure,
enables Google to simply absorb many denial of service attacks,
even behind the GFEs.
Google also has multi-tier,
multi-layer denial of service protections that
further reduce the risk of any denial of service impact.
Inside Google's infrastructure,
machine intelligence and rules warn of possible incidents.
Google conducts Red Team exercises
simulated attacks to improve the effectiveness of it's responses.
Google aggressively limits and actively monitors the activities of
employees who have been granted administrative access to the infrastructure.
To guard against phishing attacks against Google employees.
Employee accounts including mine require use of U2F compatible security keys,
I don't forget my keys as much as I used to.
To help ensure that code is as secure as
possible Google stores its source code
centrally and requires two party review of new code.
Google also gives its developers libraries that keep
them from introducing certain classes of security books.
Externally, Google also runs a vulnerability rewards program,
where we pay anyone who is able to discover and
inform us of bugs in our infrastructure or applications.
Không có nhận xét nào:
Đăng nhận xét