Today, we published a new Google research report on software supply chain security because we’ve seen a sharp rise in software supply chain attacks across almost every sector —and expect these trends to continue for the foreseeable future. We urge all organizations to act now to improve their software supply chain security.

Among the report’s conclusions, there are two key findings we want to highlight. First, the lessons we’ve learned from various security events call for a more holistic approach to strengthen defenses against software supply chain attacks. Second, we have worked with the security community to develop and deploy a common Supply-chain Levels for Software Artifacts (SLSA) framework that can mitigate threats across the entire software supply chain ecosystem. These frameworks can help organizations securely build and verify the integrity of software. You can find more information on the report’s conclusions here.

We know that modern day software supply chains continue to grow deeper, wider, and more complex. That complexity can make it challenging for customers to even know where to begin analyzing their supply chains for security issues. Our research shows that organizations must deal with these same complex issues regardless of which environments they operate in.

At Google Cloud, we’re deeply committed to working with our customers to help ensure that they have the support they need to evaluate their security posture, resiliency, and hygiene. Below, we suggest five steps to protect software across processes and systems, and tap into relevant Google Cloud products and services. These recommendations can enable customers to benefit from Google’s extensive security experience and reduce their need to develop, maintain, and operate complex processes to secure their open source dependencies.

Implementing best practices with Google Cloud

Customers who are interested in improving their software supply chain security can take immediate steps to implement best practices.

1. Enhance your existing Google Cloud security features with the Google Cloud security foundation guide. The guide can help you weigh important considerations including organizational structure, authentication and authorization, resource hierarchy, networking, logging, and detective controls. You can further engage Mandiant experts to assess your readiness.

You can also view centralized information about vulnerabilities and possible risks using Google Cloud services like Security Command Center, and get information about your service usage with Recommender, including recommendations that can help you to reduce risk. For example, you can identify IAM principals with excess permissions or unattended Google Cloud projects. You can also find additional resources from the Google Cybersecurity Action Team (GCAT), our premier security advisory team, here.

2. Explore fast software delivery and reliable and secure software with Google Cloud’s DevOps capabilities. You also should review foundational practices for designing, developing, and testing code that apply to most programming languages.

We strongly recommend you evaluate how you distribute software and the terms of software licenses in all of your dependencies. For more information on Google’s approach to helping organizations address vulnerabilities in open source software, see Appendix B in the research report.

3. Document the policies for your organization and incorporate validation of policies into your development, build, and deployment processes as you implement best practices. For example, your organization’s policies might include criteria for deployment that you implement with Binary Authorization. GCAT has published additional information on security policies and other cloud security transformation tips for CISOs here.

You can also explore Minimum Viable Secure Product, a security checklist of controls to establish a baseline security posture for a product. You can use the checklist to establish your minimum security control requirements and to evaluate software by third-party vendors.

Tapping into new Google product and service offerings

At Google Cloud, we continue to focus on delivering new and innovative security capabilities to help customers address the latest security threats. From the attack on SolarWinds to the community response to open source vulnerabilities such as Log4j, we’re seeing a spike in demand from customers on what we can do to help them manage software supply chain risk. We’ve made several recent announcements on that front that can help customers get started with Google Cloud today.

4. Use Google Cloud’s Software Delivery Shield. It provides a fully managed software supply chain security solution that offers a modular set of capabilities to help equip developers, DevOps, and security teams with the tools they need to build secure cloud applications. Software Delivery Shield spans across a family of Google Cloud services from developer tooling to runtimes including GKE, Cloud Code, Cloud Build, Cloud Deploy, Artifact Registry, and Binary Authorization. To learn more about Software Delivery Shield, check out the solution page, or watch this Google Cloud Next session to get a quick overview of Software Delivery Shield.
5. Enable our Assured Open Source Software (OSS) service, which can help enterprise and public sector open source software users to easily incorporate the same OSS packages that we use at Google into their own developer workflows. Packages curated by the Assured OSS service:

• are regularly scanned, analyzed, and fuzz-tested for vulnerabilities;
• have corresponding enriched metadata incorporating Container/Artifact Analysis data;
• are built with Cloud Build including evidence of verifiable Supply chain Levels for Software Artifacts (SLSA)-compliance;
• are verifiably signed by Google;
• and are distributed from an Artifact Registry that is secured and protected by Google.

If you are interested in learning more about software supply chain security in general, please contact us or reach out to your sales representative to schedule a software supply chain security workshop.

Creating a secure-by-default experience based on robust defenses has always been a core design principle for Gmail. That’s why we’ve established a strong baseline of security in Gmail, with built-in protections to help automatically filter out potentially malicious messages. While these defenses help keep Gmail users safe, email functions as part of a large, complex, interconnected ecosystem that we continually invest in and work to protect. After first announcing Gmail’s Brand Indicators for Message Identification (BIMI) pilot last year, today we’re announcing that over the coming weeks we’re rolling out Gmail’s general support of BIMI, an industry standard that aims to drive adoption of strong sender authentication for the entire email ecosystem. BIMI provides email recipients and email security systems increased confidence in the source of emails, and enables senders to provide their audience with a more immersive experience.

“Bank of America has a wide range of security measures in place to support our customers, and we constantly evolve our program to deliver best in class protection. Part of this effort is our partnership with Google on BIMI, which provides an easy way to validate if correspondence is from us.” — Bank of America

BIMI enables organizations that authenticate their emails using Domain-based Message Authentication, Reporting, and Conformance (DMARC)—a standard for providing strong sender authentication that allows security systems to perform better filtering, separating legitimate messages from potentially spoofed ones—to validate ownership of their logos and securely transmit them to Google. BIMI is designed to be easy: for organizations with DMARC in place, validated logos display on authenticated emails from their domains and subdomains.

Here’s how it works: Organizations who authenticate their emails using Sender Policy Framework (SPF) or Domain Keys Identified Mail (DKIM) and deploy DMARC can provide their validated trademarked logos to Google via a Verified Mark Certificate (VMC). BIMI leverages Mark Verifying Authorities, like Certification Authorities, to verify logo ownership and provide proof of verification in a VMC. Once these authenticated emails pass our other anti-abuse checks, Gmail will start displaying the logo in the existing avatar slot.  

“Gmail’s support of BIMI is a win for email authentication, brand trust, and consumers alike. BIMI gives organizations the opportunity to provide their customers with a more immersive email experience, strengthening email sender authentication across the entire email ecosystem.” — Seth Blank, Chair of the AuthIndicators Working Group

This is just the start for BIMI. The standard expects to expand support across logo types and validators. For logo validation, BIMI is starting by supporting the validation of trademarked logos, since they are a common target of impersonation. Today, Entrust and DigiCert support BIMI as Certification Authorities, and in the future the BIMI working group expects this list of supporting validation authorities to expand further. To learn more about BIMI and see the latest news, visit the working group’s website.

To take advantage of BIMI, ensure that your organization has adopted DMARC, and that you have validated your logo with a VMC. For Gmail users, no action is required. We’re proud to be one of the leading members in both establishing and supporting the BIMI standard and will continue to support efforts that contribute to security for the entire email ecosystem.

When it comes to cloud security, 2022 will be the year that the past catches up with the future. Trends that businesses have been ignoring for too long will force organizations large and small to confront and control their security debt. 

That’s according to Google Cloud’s own cybersecurity experts, who have identified four security trends that organizations need to watch out for—and get ahead of. We have predictions on what to expect in the coming year from MK Palmore, director of the Office of the CISO; Brian Roddy, vice president of engineering for Cloud Security; Tim Dierks, engineering director for data protection; and Panos Mavrommatis and Vikram Makhija, senior directors of security engineering for Google Cloud.

Supply chain shenanigans

“We will see continued asymmetric attacks from adversaries as they exploit supply chains and other previously ‘trusted’ third-party entities,” says Palmore. 

Supply-chain problems in cloud computing should be easily solvable, right? Software versions and any vulnerabilities they contain should be trackable and patchable, but the reality of fixing software is that “just patch it” is hard to execute—just look at the challenges posed by the Log4j 2 vulnerability. Supply chain is such a huge problem that President Biden addressed it in an Executive Order in May 2021. Customers can expect the issue to be top of mind at Google Cloud.

Not exactly many happy returns (to the office)

“Return to office around the world will drive changes as office infrastructure has not been invested in for a year and a half while the focus has been on remote users. This likely will drive a short-term boom in traditional on-prem security, but it will be the last boom for that as people adapt their remote, zero-trust style strategies to a more modern on-prem approach,” says Roddy.

The misconception that on-prem infrastructure is categorically more secure than cloud is driven by the desire to have physical access to servers and backups so that only the organization which owns the data controls it and has access to it, even in cases of a catastrophic failure or successful cyberattack. In the early years of cloud computing, that may even have been true. But the conditions that drove the myth of on-prem security primacy changed years ago, and the needs driving secure cloud infrastructure help ensure that cloud stays more secure. 

Paying down your security debt

“While there’s all the new hotness of cutting-edge concerns, many enterprises still carry security risks and security debt from not yet fully adopting controls which have been broadly accepted as important for years. For example, loads of companies are still not using phishing-resistant two-factor authentication such as FIDO keys,” says Dierks.

Authentication keys such as those made by Yubico and Google’s own Titan Security key support the zero-trust security principles that require user identities to be authenticated, authorized, and then continuously validated before they can access applications and data. Strong authentication is such an important part of contemporary user security that even weaker forms of it that rely on text messages are significantly more secure than not using it at all. That said, why use a less-secure standard when you can reduce risks to your data and bottom line even further by requiring a phishing-resistant hardware key?

Dierks stresses another challenging but important part of eliminating security debt: using social connections to encourage best security practices. “It’s important for CISOs to use their business relationships to emphasize the importance of baseline controls [such as 2FA] for their partners. Enterprises have close relationships that attackers can leverage, so it’s critical that partners hold each other accountable to maintain high security.” 

KYD (Know Your Data)

The impact of a data breach can harm organizations as they currently are as well as far into the future. Current tough-to-crack encryption standards protecting data could become easier to decode in the years ahead, so even if cybercriminals can’t access stolen data now there’s no guarantee that paradigm will hold. This means it’s crucially important that organizations understand what data they’re storing, how they’re storing it, and where they’re storing it, say Mavrommatis and Makhija.

“You can’t secure what you don’t know about, and not all data breaches are equal. Stolen machine logs are not as bad as customer data. But how many security teams know the difference? So you have to crawl your own data to automatically classify and discover where sensitive data lives,” they say.

Makhija adds that the shared fate model requires the cloud providers and cloud customers to have a mutual understanding of the quantitative risks each faces. “Shared fate models will pick up significantly in 2022,” he says, as more organizations move to the cloud, and those already using cloud infrastructure improve their security postures. 

“To date, there’s been a disparate set of tools for understanding your posture. It’s difficult for third-party tools to stitch together what cloud services should be providing from the start,” he says. 

What you can do to make your organization more secure

One cloud security trend that’s ever-present is the ever-increasing importance of keeping cloud deployments secure. As cloud infrastructure becomes more commonplace across businesses and industries of all sizes, it will continue to grow as an attractive target for cybercriminals and other threat actors.

• Because enterprise data has expanded exponentially, the ability to identify and detect threats have become increasingly challenging. To better secure the enterprise software supply chain, use advanced threat detection and analysis tools—especially those designed to catch anomalies. 
• The faster that organizations adopt a zero-trust architecture, the more secure the new normal can be. Zero trust helps limit the blast radius of any potential intrusion, while maximizing new enterprise access expectations. Part of adopting zero trust means many end-users can abandon legacy technology like VPNs, but the benefits of segmentation and context-aware access for both identity and device will make all the difference for large scale enterprises. When coupled with a full zero-trust approach and the use of a zero-trust maturity model for improvement, organizations will be better positioned to manage their digital risks.
• Security debt can come in many forms and one critical payoff that needs to be made is for organizations to migrate en masse to hardware two-factor authentication keys. They make user accounts significantly more resistant to takeovers, and are much harder to circumvent than two-factor authentication over SMS. 
• It’s past time to get to know your data, and a bouquet of flowers and a bottle of red wine won’t help. There are third-party tools that can do this, but for Google Cloud customers who use BigQuery there’s automatic Data Loss Prevention. It continuously monitors existing tables and profiles new ones; it can be customized for selected folders or projects, or for an entire organization; and it generates data profiles in the same geographic region as the original data.

Understanding and managing the security challenges of cloud infrastructure helps maximize its benefits, and makes for a safer security landscape in 2022—and beyond.

Today, we are putting the power of Google’s insights and intelligence in the hands of risk, fraud, and security teams everywhere. We are pleased to announce the general availability of reCAPTCHA Enterprise Fraud Prevention, a new product that uses Google’s own fraud models, machine learning, and intelligence from protecting more than 6 million websites to help stop payment fraud.

reCAPTCHA Enterprise Fraud Prevention can help protect payment transactions by identifying targeted manual attacks and large-scale fraud attempts. It automatically trains fraud models based on behavior and transaction data to identify events that are likely fraudulent and could cause a dispute or chargeback if accepted. 

When threat actors are identified and blocked on any site in the reCAPTCHA network, the intelligence is made available to help protect other organizations from those same attackers. Organizations can then use the scores to send the transaction for manual review or directly block suspicious transactions, drive increased trust in their legitimate transactions, reduce the amount of friction for good users, and reduce erroneous rejection rates.

“Being a safe and trusted place to give and receive help is our top priority. We are constantly innovating, refining and enhancing our fraud defenses and Google’s reCAPTCHA Enterprise Fraud Prevention adds another layer of industry-leading protection for our users. Combining Google’s rich security expertise with GoFundMe’s focus on fraud prevention is already showing promising results as we strive to keep our platform the safest place to give online,” said Matthew Murray, director of risk, GoFundMe.

According to data obtained from our customers using reCAPTCHA Enterprise Fraud Prevention in private Preview, the new solution can help drive comprehensive value for organizations by:

• Reducing fraud losses: Get behavior modeling (not just mouse movements), stop financial damage created by account takeovers (ATOs), and connect fraud and abuse intelligence across your site and application.
• Increasing legitimate sales: Fraud Prevention can help businesses increase their revenue by providing insights to understand who good users are, who may otherwise be caught in an overly aggressive, customer restrictive fraud model.*

These benefits  are enabled for organizations by:

• Preventing advanced attacks: Stopping sophisticated attacks in an environment where attackers use cloud fraud infrastructure, and data leaks, virtual cards and VPN usage are on the rise
• Increasing trust in good transactions: Focus on good approval rates through a unique combination of supervised and unsupervised models
• Improving customer experience: By preventing fraudulent transactions with zero user friction, Fraud Prevention can help businesses protect legitimate users and increase customer retention

Our customers have used these new capabilities in preview in customer experiences that include online checkouts and payment transactions. Fraud Prevention has been used by merchants and payment processors to block millions of dollars in fraudulent transactions in a frictionless way. 

reCAPTCHA Enterprise provides a comprehensive online fraud detection platform that helps prevent fraudulent, spammy, and abusive digital client activity across your web and application footprint. This platform includes Account Defender, which protects users from account takeovers (ATO), frictionless bot management capabilities, and password leak detection to identify compromised accounts. With an additional API call for Fraud Prevention, organizations can leverage a comprehensive solution to secure financial transactions along with core reCAPTCHA Enterprise capabilities. 

To get started, organizations can install a score-based site key on each part of the payment user flow front end and send transaction data when a purchase occurs. This site key helps train site-specific fraud models and start returning fraud scores for each transaction. 

Ready to put reCAPTCHA Enterprise Fraud Prevention to work? Contact our fraud specialists or your customer success CSM team and sign up with the free tier. You learn more about these new capabilities in reCAPTCHA Enterprise in our product documentation. You can also register for our webinar where our experts will be discussing this capability in great detail on June 1, 2023. 

Coming up at our Security Summit on June 13-14, you can hear how reCAPTCHA Enterprise helped GoFundMe secure their donors from fraud. Sign up here for free Security Summit registration.

Cloud transformation and the adoption of modern DevOps technology presents both opportunities and challenges for IT compliance functions. With DevOps style application development, the feedback loop for developers and engineers is much tighter than with traditional application development pipelines, enabling speed and agility of application release cycles. While speedy CI/CD is a critical advantage of DevOps, it also shifts compliance left in the development timeline, and therefore puts pressure on the IT risk & compliance organization to modernize their approach to regulatory compliance as well. With the ongoing shift towards cloud technologies and DevOps, modernization of regulatory compliance is no longer optional for an IT compliance function

Compliance modernization is a broad mandate that spans the way the function is governed; the tools, technology, and analytics it uses; the number and nature of its connections to other parts of the business; verifiability and auditability of the controls’ evidence, the expectations assigned to it; and more.

Public cloud technology is becoming a core part of many industries today, and with this comes some potential risks such as cloud misconfigurations exposing intellectual property, loss of physical control of assets, skillset scarcity around cloud based security and compliance. 

Given the constantly changing risk landscape, it is critical that regulations more closely align to address these risks. As regulations and risks evolve, the aim of a modern compliance function is to help an organization stay compliant as it goes through a digital transformation. As organizations go through digital transformation, IT compliance also needs to transform — via upgrading the technology stack, modifying the business processes and most importantly re-skilling people to become cloud aware.

Today we are releasing the new paper by Google Cloud’s Office of the CISO. In the paper we reveal a new approach for modernizing your compliance approach using modern approaches and Google Cloud toolsets. Your team can leverage the paper to add value to enterprises, both by charting a course to the safe use of cloud technology and by reducing risk through the use of the public cloud.

Read the paper “Assuring Compliance in the Cloud.”

Also, review these related resources:

• “Risk Governance of Digital Transformation in the Cloud“ paper
• “Making Compliance Cloud-native” (episode 14) with Zeal Somani
• Google Cloud Compliance resource center
• Our compliance blueprints: PCI DSS on GKE and GCP FedRAMP Blueprint
• Google Cloud security best practices center