Google tool signals move to greater cloud transparency

Google opens its logs

Organizations use Access Transparency to examine Google's internal data center logs pertaining to their accounts and to gain control over the vendor's related actions. Google admins occasionally access user content for a variety of reasons, including user support requests, system maintenance and audits to check for security, fraud and compliance with the terms of service.

The logs outline what steps an administrator took to address any issues that occur with the customer's service. Google must receive permission from the account manager to tinker with software or hardware that's tethered to any of the organization's workloads with sensitive information.

The service works with six Google Cloud Platform services: Compute Engine, App Engine, Cloud Storage, Persistent Disk, Cloud Key Management Service, and Cloud Identity & Access Management. Google plans to add support for more services in the future, including BigQuery.

It's also only available to customers with one of the following support packages: Gold, Platinum, Enterprise, four or more Development roles, four or more Production roles, or a combination of the two role-based supports.

Access Transparency helps customers to closely monitor Google's maintenance work. For example, if a customer previously opened a ticket with Google Support in response to slow user response times, it couldn't track what steps the vendor took to resolve the problem. Now, users have access to that information and a degree of cloud transparency.

Logs are vital to system security. Data center teams examine the logs for aberrant behaviors that may illustrate repeated attempts by an outsider to break into a system. If a breach occurs, the trail is usually in the logs, so the IT team can go back and determine how the intruder accessed its system.

An auditing aid

The feature helps companies with tasks such as system audits. Often, with an audit, a company has to produce reports that illustrate how its systems work and what steps it has taken to perform tasks, including the protection of confidential information.

These data center process reports have become more important as new regulations emerge. Standards, such as the Health Insurance Portability and Accountability Act, have been in effect for decades, but more recent regulations, like GDPR, have been added to the growing list of cloud reporting requirements.

It can take an organization months to create a report that illustrates that its system meets these various requirements, Volk said. An IT team needs to write software to pull the pertinent information from different systems and put it in a format that illustrates the organization's compliance with various regulations.

Noncompliant companies could face censure and fines, so customers will want automation to sort through the massive amounts of data these logs generate. To that end, enterprises can incorporate Cloud Access Transparency logs into their existing security information and event management tools.

 "Ideally, a company wants its system to be audit-ready so they can generate needed reports in a timely manner," Volk said.

Cloud transparency and the competitive landscape

Microsoft has a similar feature, Customer Lockbox, with its Office 365 service. The vendor asks for permission before it looks at or alters customer data. This feature is only available to high-priced Office 365 clients and not all of its customers, Riley said.

Microsoft also has a public preview of Customer Lockbox for Azure. Currently, AWS does not offer users access to any of its internal data center tools.

The various logging services available represent the first in a series of steps from suppliers. These logs provide large companies with a small glimpse into what happens when public cloud vendors run their applications. They can see what a system administrator did -- perhaps run a test to identify why a connection is running late -- but they can't monitor the test that was run or the actual results.

Ideally, customers that are accustomed to micromanagement of their data center assets want even more cloud transparency, including access to all the monitoring and security tools a vendor uses to support their services.

However, it will be a significant undertaking for cloud providers to offer even more transparency. They'll have to do considerable integration and development work, while still ensuring they don't create new security holes in the process.

"Google's data center is complex, and the company needs to ensure that clients access only their own service logs," Riley said.

Enterprises that want total cloud transparency won't get it overnight. It will take time, but Google has taken an important step in that journey.

"I expect that the public cloud vendors will provide customers with access to more of their operations information in the future," Volk said.