How Does Google Do Security? - Twenty-Four Seven Security

« Cisco and RSA Parter to Protect Data | Main | IBM Deepens Their Data Protection »

April 09, 2008
How Does Google Do Security?

With the biggest online presence of pretty much any company anywhere (I just read somewhere that Google's search percentage is at it's highest ever), and with a well honed sense of reputation management -- does anyone remember the day when you first started using Google, and thought, Damn, how did they find that Michael Bolton bio so fast -- Google clearly has the most to lose if word suddenly got out that all those emails in gmail and spreadsheets in Google docs weren't being properly secured.

So what's Google's security culture like? According to Search Security, if you can't code, you can't do security at Google (let's hope that if you're lousy at security you can't do security at Google as well).

"Google has a decidedly go-at-it-alone conventional approach to solving problems," security director Scott Petry said Tuesday during an interview at RSA Conference 2008. "This is most evident in the value of security inside engineering."

In essence, Google has integrated security throughout their development lifecycle. Nooglers (which are new developers at Google), have to attend multi-day security training seminars before they're even assigned to a team or project. At the seminars the Nooglers learn everything from policy to process development to code hacking.

And before a project goes live, the production code has to pass peer-review with Google security teams along with any member of the engineering community. "No one person is authorized to write code into production," Petry said. And that's just from the inside.

In terms of outside attacks, Google keeps a database of attacks against the company which is then tested against any future Google code. The idea at, instead of looking at an attack as something only criminals do, Google looks at attacks as a lesson to be learned.

This pretty much squares with what's becoming standard operating procedure when developing web applications (or at least should be): think about security early and think about it often. And if you do that, then maybe you too can be a Moogle (that's my term for an old person at Google, you know, someone about to be put out to pasture).