Modern Insurance Magazine Issue 65

INSURTECH
2. Shared Fate
We also touched on this idea of Shared Fate, where
Google Cloud is going beyond the shared responsibility
model which most cloud providers focus on. In the Shared
Responsibility Model, a cloud provider is responsible for
the security of the infrastructure, while the customer is
responsible for maintaining a secure configuration on top
of that.
While the setup might be technically correct, this can
create an ‘Us vs. Them’ model. Alternatively, Google
instead wants to partner more deeply with customers,
providing more default guidance and ensuring that
security is built into our products and not ‘bolted on’.
This will help us to tackle the broader cyber risk landscape
together, partnering with the insurance industry to provide
access to cyber insurance via a program that I oversee
called the Risk Protection Program. Shared Fate is now
really built into our ethos as a company, and you’ll see it
in many things we do.
3. Mandiant Expertise
We also had our Mandiant Threat Intelligence and
Mandiant Consulting teams speak at Cyber Day, and it’s
truly incredible to hear firsthand from leaders on the front
line. Mandiant talked through the latest trends in what
they’re seeing by way of threat actor activity, and how
organizations should best respond.
As a Risk Manager, it’s important to work with incident
response providers that are experienced in what they
do. In insurance terms, this can reduce the frequency of
an event by applying their threat intel and suggestions
to harden an environment; however, it can also greatly
reduce the severity of an event if you work with the right
incident response provider from the start. The integration
that Mandiant has with the insurance industry, and the
impact they have when given the chance to remediate
incidents quickly, was truly incredible to see.
Q
In this era of ‘work from anywhere’, how are providers
like Google positioned to stave off cyberattacks that
occur in the Cloud?
We’ve put some Cloud Security Megatrends
principles together, which will form the best general
A reference material when it comes to discussing
how cloud providers can help drive security. There’s lots
of good content in there that speaks to how the divide
between security in a cloud environment vs. an on-premise
environment will widen over time, simply because these
trends will compound.
Monica leads business risk and insurance
for Google Cloud, including managing
insurance product development and
partnerships for Google Cloud’s Risk
Protection Program. Monica is also the
Head of Actuarial, Analytics & Systems for
Alphabet’s Business Risk & Insurance team.
She is passionate about driving innovation
in the industry through combining her
experience in both tech and insurance. Prior
to her current role at Google, she focused
on managing new and emerging risks
through working closely with Alphabet’s
Other Bets.
Responding to your question more specifically, there
are layers to this. Google focus on developing what
security practitioners call a ‘Zero Trust’ approach, which
means that from a technical perspective, every network,
device, person and service is untrusted until it proves
itself. Access decisions consider multiple factors like
user identity, device health, and context, making it more
difficult for attackers who breach a single device to
move with a network. You never trust and always verify,
which enhances security and reduces the likelihood that
attackers will get in. This is particularly important when
your workforce is distributed and there’s no physical
boundary to where employees are logging in from.
Additionally, we often talk in depth about the importance
of defense, which focuses on multiple layers of
controls and capabilities to protect against the impact
of configuration errors and attacks. This helps with
cyberattacks in the sense that it stops them happening
in the first place, and prevents attackers from moving
laterally.
Monica Shokrai,
FCAS, MAAA, Head of Business Risk and
Insurance, Google Cloud
MODERN INSURANCE | 69