Google CIO Talks Security
Google CIO Douglas Merrill reveals security investments and approaches at the formerly security-secretive company.
IDG News Service (San Francisco Bureau) — Unlike Microsoft , which publishes detailed information on its monthly patches and has openly evangelized the steps it takes to secure software, Google has generally kept quiet when it comes to talking about security and has kept the team that keeps Google's Web sites secure under wraps.
No longer. In April, Google researchers presented a paper on Web security at a technical conference in Cambridge, Mass., discussing the results of the company's ongoing effort to "identify all Web pages on the Internet that could potentially be malicious." A month later, Google started its first-ever security blog, and since then observers have had their first glimpse into the lives of Google's 100-person security team.
That team is managed by Douglas Merrill, Google's vice president of engineering and chief information officer, who spoke with IDG News Service recently. (IDG is the parent company of CXO Media.) Merrill wouldn't say anything about Google's recent acquisition of secure browsing software vendor Green Border, but he did explain what Google gets from its security investments, and why his company believes that locking down the enterprise PC is not the way to go. Following is an edited transcript of the interview.
IDGNS: Google is trying to identify all of the malicious Web pages on the Internet. Can you tell me about that effort?
Merrill: We believe that by trying to find badware out there we can materially help our users. We can do it by flagging it in Toolbar, we can do it by using things like Stopbadware.org to try and help people address them. Information is power in this context, and our goal is to make all the information in the world accessible and useful.
That set of work by Niels [Google security specialist Niels Provos] and others is a really great scientific advance toward understanding what the world looks like. And in fact the coverage of that line of work is part of what led us to step over the curb and start the Google security blog. Because some of the coverage in the [press], Dr. Provos found misleading. He actually got so energized about it that he came to Barry, [Google spokesman Barry Schnitt] and said "I want to start a malware blog." And Barry said why don't we just do this security blog. We'd been talking about it forever, we just never got around to doing it. So we had a long internal conversation and our initial worry was we wanted to be transparent and engage our users in a discussion about security, but we didn't want to have one posting and have the thing die. We want to have an ongoing discussion.
