Portfolio:Google Cloud

Google Cloud is a Google-driven suite of public, private, hybrid, and multicloud computing services that runs on the same infrastructure that Google uses internally for its end-user products. Google Cloud boasts data centers in 37 regions, 112 zones, and 187 network edge locations. More than 100 different products and services are associated with Google Cloud, representing elastic computing, networking, content delivery, data storage, database management, security management, enterprise management, data analysis, media management, container management, developer support, scientific computing, internet of things, and artificial intelligence.

Provider research

This section uses public information to provide some answers to the 18 questions posed in Chapter 6 of the wiki-based guide Choosing and Implementing a Cloud-based Service for Your Laboratory. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.

1. What experience do you have working with laboratory customers in our specific industry?

Examples of labs that have worked with Google Cloud at some point include the Department of Energy's National Labs, Hologic, IDEXX Laboratories, Spectra Laboratories, and Washington Laboratories. It's also worth noting that some laboratory information management system (LIMS) developers have offered their solution on Google Cloud over the years, including GoMeyra Corporation, Online LIMS Canada Limited, and Persistent Systems Ltd. A Google Cloud representative is likely to be able to supply more examples of laboratories and laboratory informatics developers that use or have used Google Cloud.

2. Can your solution readily integrate with our other systems and business processes, making it easier for our end users to perform their tasks?

It will ultimately be up to your organization to get an answer tailored to your systems and business processes. However, this much can be said about Google Cloud integrations. Google provides documentation about how to integrate your applications with its backend and frontend, including its APIs. Additionally, Google Cloud discusses at length the concept of data integration, including its Cloud Data Fusion (CDF) offering for hybrid and multicloud integration. The CDF library of connectors and transformations, along with its "end-to-end data lineage, integration metadata, and cloud-native security and data protection services," helps customers keep data integrated no matter its location.

3. What is the average total historical downtime for the service(s) we're interested in?

Some public information is made available about historic outages and downtime. Google Cloud has a systems status page with status history (you have to click on the "View Summary and History" link at the bottom). You should be able to read through the incident details for each issue, going back through a fair amount of history. This will give you a partial picture of the issues experienced in the past, as well as any scheduled maintenance and currently impacted services. A follow-up on this question with a Google Cloud representative may reveal more historical downtime history for the services you are interested in.

4. Do we receive comprehensive downtime support in the case of downtime?

Google Cloud does not make this answer clear. However, the answer is likely tied to what after-sales support plan you choose. Confirm with Google Cloud what downtime support they provide based on the services your organization are interested in.

5. Where are your servers located, and how is data securely transferred to and from those servers?

Google Cloud has 37 regions it operates in, with each region having at least three zones, with more three-zone regions planned. Google Cloud uses its content delivery network Cloud CDN, which "gives you the same world-class infrastructure to accelerate and secure mission critical web experiences at a global scale." When moving data to and from on-premises and Google Cloud systems, multiple transfer options exist, including normal online transfer, a full-scale transfer service, transfer appliances, and scheduled SaaS data transfers. Data in motion is encrypted following a strict company policy. As for data localization and residency requirements, Google Cloud gives customers many controls, including organization policies, Cloud IAM configurations, and VPC service controls.

6. Who will have access to our data (including subcontractors), and what credentials, certifications, and compliance training do they have?

In its security whitepaper, Google states the following:

The physical security in Google data centers is a layered security model. Physical security includes safeguards like custom-designed electronic access cards, alarms, vehicle access barriers, perimeter fencing, metal detectors, and biometrics. In addition, to detect and track intruders, we use security measures such as laser beam intrusion detection and 24/7 monitoring by high-resolution interior and exterior cameras. Access logs, activity records, and camera footage are available in case an incident occurs. Experienced security guards, who have undergone rigorous background checks and training, routinely patrol our data centers. As you get closer to the data center floor, security measures also increase. Access to the data center floor is only possible through a security corridor that implements multi-factor access control using security badges and biometrics. Only approved employees with specific roles may enter. Less than one percent of Google employees will ever set foot in one of our data centers.

For information about specific certifications and compliance training, discuss this with a Google Cloud representative.

7. Will our sensitive and regulated data be stored on a machine dedicated to complying with the necessary regulations?

Not all Google Cloud machines have the same controls on them; it will depend on the region, product, and compliance requirements of your lab. That said, verify with a representative that the machine your data will land on meets all the necessary regulations affecting your data.

8. How segregated is our cloud data from another customer's, i.e., will lapses of security of another customer's cloud affect our cloud? (It typically won't, but asking the question will hopefully prompt the provider to better explain how your data is segregated.)

Unlike other cloud providers, it's not entirely clear what Google Cloud's stance is on physical separation. The only information to be found was a sentence in their security whitepaper: "Our infrastructure is designed to logically isolate each customer's data from the data of other customers and users, even when it's stored on the same physical server." Presumably the type of data you have will determine which servers you should use, based upon those servers compliance ratings. You'll have to have a discussion with a Google Cloud representative to learn more about their position on physical separation of data.

Tenant isolation is addressed by Google Cloud under the scope of Kubernetes both here and here. However, like many aspects of security, configuration and best practices are a shared responsibility. Additional details about multi-tenancy and related security on Google Cloud can be found under the "Secure Service Deployment" section of their Google Infrastructure Security Design Overview document. Consult with a representative to learn more.

9. Do you have documented data security policies?

Google Cloud documents its security practices in several places:

• Google cloud security showcase
• Google infrastructure security design overview
• Google security whitepaper
• Google SOC 2 documents

Some security-related documents may not be publicly available, requiring direct discussion with a Google Cloud representative to obtain them.

10. How do you test your platform's security?

Google Cloud has information scattered around in its documentation. Most notable is this passage from its security whitepaper:

Our dedicated security team includes some of the world's foremost experts in information security, application security, cryptography, and network security. This team maintains our defense systems, develops security review processes, builds security infrastructure, and implements our security policies. The team actively scans for security threats using commercial and custom tools. The team also conducts penetration tests and performs quality assurance and security reviews.

The company also mentions that they conduct "intensive automated and manual penetration efforts, including extensive Red Team exercises."

There are other pieces of information related to non-Google Cloud personnel testing the platform. Under its Cloud Data Processing Addendum, customers have some audit rights, though there are limited to those affected by GDPR or Model Contract Clauses. Otherwise, the customer must rely on third-party audit results.

11. What are your policies for security audits, intrusion detection, and intrusion reporting?

Audits: Google Cloud has this to say about security audits:

• "We vet the component vendors that we work with and choose components with care. We work with vendors to audit and validate the security properties that are provided by the components."
• "We have a dedicated internal audit team that reviews our products' compliance with security laws and regulations around the world. As new auditing standards are created and existing standards are updated, the internal audit team determines what controls, processes, and systems are needed in order to help meet them. This team supports independent audits and assessments by third parties."
• "Our dedicated security teams, privacy teams, and internal audit teams monitor and audit employee access, and we provide audit logs to you through Access Transparency for Google Cloud."

Intrusion detection and reporting: Google Cloud provides Security Command Center to its customers for intrusion detection and reporting. As for its own intrusion detection, Google Cloud discusses this in its Google Infrastructure Security Design Overview document:

We use sophisticated data processing pipelines to integrate host-based signals on individual devices, network-based signals from various monitoring points in the infrastructure, and signals from infrastructure services. Rules and machine intelligence built on top of these pipelines give operational security engineers warnings of possible incidents. Our investigation and incident-response teams triage, investigate, and respond to these potential incidents 24 hours a day, 365 days a year.

12. What data logging information is kept and acted upon in relation to our data?

Google Cloud mentions data logging in several places:

• Google employee access to end user information
• speech-to-text information and various other types of information (if opted in to data logging program)

However, it's not clear what other data logging they may conduct and act upon related to your data. Talk to a representative to determine this.

13. How thorough are those logs and can we audit them on-demand?

Google Cloud users can view their own logs through tools like Google's Cloud Logging service and its Cloud Audit Logs. However, unlike Alibaba, it's unclear if you are able to audit internal Google Cloud operation logs on-demand. This is a conversation to have with a Google Cloud representative.

14. For HIPAA-eligible data (e-PHI) we may have, will you sign a business associate agreement?

Yes, AWS will sign a business associate agreement. Consult their HIPAA compliance page for more details on their approach to HIPAA compliance.

15. What happens to our data should the contract expire or be terminated?

Google Cloud makes several statements about customer data in its platform terms:

• "If the Agreement is terminated, then (a) all rights and access to the Services will terminate (including access to Customer Data, if applicable), unless otherwise described in this Agreement ..."
• "If Customer wishes to retain any Customer Data after the end of the Term, it may instruct Google in accordance with Section 9.1 (Access; Rectification; Restricted Processing; Portability) to return that data during the Term. Subject to Section 6.3 (Deferred Deletion Instruction), Customer instructs Google to delete all remaining Customer Data (including existing copies) from Google’s systems at the end of the Term in accordance with applicable law. After a recovery period of up to 30 days from that date, Google will comply with this Instruction as soon as reasonably practicable and within a maximum period of 180 days, unless European Law requires storage."

16. What happens to our data should you go out of business or suffer a catastrophic event?

It's not publicly clear how Google Cloud would handle your data should they go out of business, nor do they mention much about catastrophic loss on their site. Google Cloud discusses disaster recovery and data loss in its Cloud Architecture Center. The company states in their platform terms, however, that "neither party will be liable for failure or delay in performance to the extent caused by circumstances beyond its reasonable control, including acts of God, natural disasters, terrorism, riots, or war." Like other cloud providers, Google Cloud uses three-zone regions for redundancy: "Putting resources in different zones in a region reduces the risk of an infrastructure outage affecting all resources simultaneously. Putting resources in different regions provides an even higher degree of failure independence. This lets you design robust systems with resources spread across different failure domains." It's highly unlikely that all three zones would be affected in an catastrophic event. However, if this is a concern, discuss further data redundancy with a Google Cloud representative.

17. Can we use your interface to extract our data when we want, and in what format will it be?

Google Cloud advertises their Cloud Storage Transfer Service as a software service that allows you to "transfer data quickly and securely between object and file storage across Google Cloud, Amazon, Azure, on-premises, and more." They also provide guidance on extracting data out of its multi-cloud data warehouse BigQuery. Google Cloud has also published a Transparency Declaration that maps their processes to the voluntary SWIPO (Switching Cloud Providers and Porting Data) codes of conduct. Read more about this on their SWIPO page.

18. Are your support services native or outsourced/offshored?

It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with a Google Cloud representative.

Managed security services

Google discontinued its managed services offerings in the United States in 2019.

Additional information

Documentation and other media

• Disaster recovery whitepaper
• HIPAA whitepaper repository
• Security overview

External links

• Google Cloud architecture framework or description
• Google Cloud shared responsibility model
• Google Cloud trust center