About Google Apps Security

It amuses us when we encounter the occasional prospect that brings up the old “Them vs. Google” when dealing with security.  You may have fallen into that boat at one point too.  You know the type.  They usually say something along the lines of “We don’t want our important information at Google.  It is safer on OUR servers, in our data center”.  Granted, you have to give credit where credit is due, so if you’re a company like Microsoft, or Yahoo, Amazon, etc…. They may have a leg to stand on.  The cost to truly ‘secure’ data is INSANE so you need to have the budget to do pull it off.   But let’s be real for a second; the vast majority of companies are NOT those big guys.  They are small and medium sized companies, like yours for example.   So with that in mind, let me really break down the facts behind these statements and why, sadly, it does amuse us a bit.

First, it would be really easy for us, and we usually do, to simply point out that the requirements of many of Google’s customers are CERTAINLY more demanding than most companies.  Consider the City of Los Angeles, or the Colorado state government.  Can you imagine what their demands on data security must be? Ok, let’s pull out of the public sector for a minute and consider companies like Delta Hotels, Motorola Wireless or National Geographic.  These are companies with budgets to meet the demands of data security. They are under regulations by the SEC to adhere to data security requirements.  Companies such as these have already looked at the requirements and deemed that the ability to meet the high demands is as simple as putting their data with Google.  As you can see, in many cases just pointing this out should be example enough; but interestingly enough, sometimes it isn’t and people still feel that their data is more important and can’t be trusted in Google data centers.

Very well, so let’s get down to the underlying points. Let’s start with an audit.   In terms of data security, an audit is a way of verifying that specific security requirements are met.  The security requirements are often outlined by various ‘authorities’ who aim to setup a standard for data security for a specific segment of businesses.  Many people are familiar with HIPAA, which is the standard to which Medical Care industries must comply by law.   Another well known standard is Sarbanes Oxley, which dictates how publicly traded companies in the United States must secure data (well, it is technically more about reporting the data, which in turn relates to data protection so that it can be assured that data is properly reported…. but that is for another article).  But what many people aren’t aware of is that there are often underlying requirements that either roll-up into these well known standards and/or deal with specific industry niches within and around the well known requirements.   One great example is an SSAE-16 Audit.  Let me start by saying that I am NOT an expert in SSAE-16,  but with any luck, you’ll get the gist of my message; to pass this audit is INSANELY cool and daunting.

For example, the essence of the SSAE-16 Audit (and in turn the underlying requirements of the security guidelines) is summarized by ssae16guide.com:

• “The primary reason for the SSAE 16 (SOC 1), SOC 2 and SOC 3 audits is to provide assurance to a third party and their auditors that a Company providing an outsourced service is doing so with proper controls in place to prevent financial misstatements and provide an appropriate level of security, availability, processing integrity, confidentiality, and/or privacy.”

In plain English:  If you are a company that is going to secure data for someone else than passing an SSAE-16 Audit is proof that you can do it safely.   These audits can only be executed by an independent CPA firm that is listed with the American Institute of Certified Public Accountants (AICPA).  Look at just SOME of the hundreds of requirements to pass this audit:

• Evaluations of daily operations
• Management and supervisory activities
• Internal audit functions
• System checks and balances | Manual checks and balances
• Communication with third party entities
• Additional safeguards, controls, processes, procedures, and oversight activities that assist in monitoring a service organization’s system.

Did Google pass this very important Audit?  Yes; as well as many others.  Yes, I said many others.  If this is just ONE audit that Google has passed, imagine the time, money, effort and more that Google has put in to instill confidence with their clients that their data is secured.   Here is just a short list of some of the other audits that Google has passed (you can click each one for more details):