Google Session at Cloud Expo

In what he called "traditional" IT, the security model - according to Eran Feigenbaum - is broken.

Feigenbaum, who is Director of Security at Google Enterprise, gave a talk in Washington this morning offering the hope that, because of Cloud Computing, some of the existing challenges may now be surmounted.

How do we build our systems to allow for fast recovery times, for zero or very limited loss of data...

"Not all cloud providers are created equal," Feigenbaum explained. Google has one of the biggest security teams anywhere in the world of the Internet, he added. Furthermore physical security is tip-top: Google's datacenters are very low profile, at undisclosed locations - most often unmarked for added protection. They have 24/7 armed guards. He explained how Google "chunks up" users' data into small, obfuscated pieces, Gmail's email data for example, and thereby makes the attack service much harder to understand. There are also six live replications of each email.

Because Google builds its own machines and writes its own OS, it has a very homogenous environment - making it easy to issue patches to the entire system, for example. It doesn't use virtualization; it uses cheap x86 drives in vast numbers. It has a barcode on every hard drive that tracks how it is being used, who has accessed it, and what they did.

Who outside Google gets to see and appraise all these internal checks and balances? The company does a yearly thirdparty "security penetration test."

Moreover it has a rigorous code development process.