Google at odds with the locked-down enterprise

Douglas Merrill, Google's vice president of engineering and chief information officer talks about the company's security practices

Security has been a bit of a black art at Google. Unlike rival Microsoft, which publishes detailed information on its monthly patches and has openly evangelized the steps it takes to secure software, Google has generally been quiet when it comes to talking about security and it has kept the team that keeps Google's Web sites secure under wraps.

Not so anymore. In April, Google researchers presented a paper on Web security at a technical conference in Cambridge, Massachusetts, discussing the results of the company's ongoing effort to "identify all Web pages on the Internet that could potentially be malicious." A month later, Google started its first-ever security blog, and since then observers have had their first glimpse into the lives of Google's 100-person security team.

That team is managed by Douglas Merrill, Google's vice president of engineering and chief information officer, who spoke with IDG News Service recently. Merrill wouldn't say anything about Google's recent acquisition of secure browsing software vendor Green Border, but he did explain what Google gets from its security investments, and why his company believes that locking down the enterprise PC is not the way to go. Following is an edited transcript of the interview.

Google is trying to identify all of the malicious Web pages on the Internet. Can you tell me about that effort?

We believe that by trying to find badware out there we can materially help our users. We can do it by flagging it in Toolbar, we can do it by using things like Stopbadware.org to try and help people address them. Information is power in this context, and our goal is to make all the information in the world accessible and useful.

That set of work by Niels [Google security specialist Niels Provos] and others is a really great scientific advance toward understanding what the world looks like. And in fact the coverage of that line of work is part of what led us to step over the curb and start the Google security blog. Because some of the coverage in the [press], Dr. Provos found misleading. He actually got so energized about it that he came to Barry, [Google spokesman Barry Schnitt] and said "I want to start a malware blog." And Barry said why don't we just do this security blog. We'd been talking about it forever, we just never got around to doing it. So we had a long internal conversation and our initial worry was we wanted to be transparent and engage our users in a discussion about security, but we didn't want to have one posting and have the thing die. We want to have an ongoing discussion.

Does Google ever think of security as something it could turn into a product?

In some sense, the answer is clearly "Yes," because part of Checkout is a security product. But fundamentally, we are a search company. We do search. We want to do things that make users feel safe and secure on the Internet to do searches. I have no idea what we'll do in the future. I don't have a crystal ball. But we're a search company, and what we want to do is help people be able to do searches and learn things and make all the world's information universally accessible and useful. And part of being useful is being secure.

Niels Provos was quoted recently as saying that the firewall is dead. What are your thoughts on that?

Niels's point was that, increasingly, business technology and enterprise technology can't be separated from the Internet and can't be separated from what consumers do. And businesses, increasingly, are using partnerships to get things done. Increasingly when I go off and I give discussions to other CIOs, what we talk about is the consumerizaiton of enterprise technology. The increasing integration of consumer technology into the enterprise space. So what Niels was talking about was that, this idea that you can't live your whole life behind one set of walls anymore. Everything that your employees do every day will include stuff they do at home, stuff that other companies have done.

We obviously believe in this idea of the Web 2.0, where you're collecting different kinds of applications together to meet consumer needs. The firewall is one line of defense, and it's still useful, just like locks on front doors are still useful. But you need other kinds of defenses as well. You may need application development standards, you may need inter-organizational understanding of things, like Stopbadware.org. It's no longer that security is something you can write a check for. Security is a process. There are no lasting technical solutions to social problems. You can't write a check to solve a social problem. So Niels is absolutely right. We think security of the future is a far more complex community based activity. It takes a village. We want to be part of the village.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?