How to Detect and Eliminate New Cloud Security Threats: Tips for Your Security Teams
4055
Of your peers have already read this article.
4:30 Minutes
The most insightful time you'll spend today!
Why do we keep talking about security all the time? Why hasn’t anyone just gone and fixed it?
You’ve probably heard these questions, whether from your leadership, or a board member or just from friends. Then you labor at explaining why security in the cloud is so complex and challenging, the constant arms race, and eventually, their eyes glaze over. But you’re right: It is complex, and it can be hard.
As a security leader today, you likely spend a lot of your time focused on getting information: what’s going on, what new vulnerability just surfaced, what threats are present in your environment, and how to remediate them. And you probably already have a few dozen tools in place to measure, analyze, collect, and search through your data.
Right now, with your set of existing tools, you hopefully have a good sense of your on-prem systems and your overall attack surface. But across all those datasets, you’re juggling incongruous access patterns, stale data, and cluttered information coming from disparate tools—it’s not organized by topic, risk, or project. So unifying and rectifying the data sources, to really give you a full picture, just doesn’t happen.
Then you add cloud systems to the mix, and it’s a whole ‘nother ball of wax. We wanted to detail a few security features we’ve developed—most recently Event Threat Detection, available today in beta—and highlight some information that can help you reduce the complexity of your organization’s security, and improve your security posture.
Gain visibility and control, and prevent threats
With Cloud Security Command Center (Cloud SCC), Google brings a flexible platform to give you wide visibility and rapid response capabilities. Beyond just risk and vulnerability management, Cloud SCC focuses on active defense, showing you threats that have been detected and the path to greater holistic security in your cloud resources.
It integrates with existing partner security solutions you already use and Google Cloud security tools. And its API is accessible to you and your vendors, so any additional data is easy to integrate.
The model above is a centralized dashboard for threat prevention, detection, and response, with views of your current state that you can change based on your needs. For example, you can focus on assets to get a comprehensive list of every firewall, network, disk, bucket, and so on in your organization.
You can also orient your view based on findings (results) of what’s wrong in your Google Cloud Platform (GCP) environment. We recently launched the Vulnerabilities dashboard to show findings from Security Health Analytics. It’s an integrated security product that helps you identify misconfigurations and compliance violations in your GCP resources and take action.
Reduce threat exposure with Event Threat Detection
Reducing your exposure to threats goes hand-in-hand with being able to respond quickly to those threats that are present in your environment. Today, we’re excited to announce the beta of Event Threat Detection, a security product that integrates into Cloud SCC, and was inspired by how Google protects itself. We wanted to extend our scale and threat intelligence to help you protect your environment and improve your security posture.
Event Threat Detection helps you detect threats in your logs and send high-risk threats to your SIEM (Security Information and Event Management system) for further investigation. It also can help you save time and money by focusing your attention on the most worrisome cloud-based threats.
Due to the growth in cloud computing, we’ve seen an increase in the number of customers running VPC Flow logs, Cloud DNS logs, Cloud Audit logs, and syslog delivered via the fluentd agent on GCP. Event Threat Detection uses Google’s threat intelligence to surface threats present in these logs, including anomalous IAM grants, malware, cryptomining, outgoing DDoS, and brute-force SSH.
When Event Threat Detection finds a threat in your logs, it shows up as a finding on the Cloud SCC dashboard. If you need to further analyze any of these threats, you can send them to your SIEM, saving time and money because Event Threat Detection has already determined the high-risk logs you need to investigate further.
Event Threat Detection integrates with Cloud Functions to make it easier for you to export findings to your SIEM of choice. You can also use Cloud Functions to automate responses and changes to Event Threat Detection findings. See the video below for more information.
Respond to threats
Once threats have been detected, the final step is, obviously, responding to them. To help speed up your response game, you can set up automated actions for when threats are detected. When Cloud SCC detects an anomaly, or an active threat, you can have it change a VM configuration, perhaps cutting the VM off from other parts of your network.
You can also change firewall rules automatically. Using these events to trigger Cloud Functions, you can set up any response you like, fully automated. At the same time, you can send incident metrics and data to Stackdriver or your own SIEM to make sure your incident response team has everything they need.
Together, these features give you the power to structure and organize the data you gather, which is key to making cloud security work for large, mature organizations. Cloud SCC lets you create tags for items to assist with incident response or project-based inquiry, and to aid in custom dashboard creation. The constant goal: give you the information you need quickly, so you can take the necessary action.
Cloud SCC details
Now that you have a high-level view of how Cloud SCC and Event Threat Detection can help your organization become more secure, here are some other resources highlighting Google security features that integrate into Cloud Security Command Center, how they work, and how they can help you improve your security posture:
- Find and fix misconfigurations in your Google Cloud resources with Security Health Analytics
- Stop data exfiltration with Cloud Data Loss Prevention
- Detect and remediate security anomalies with Cloud Anomaly Detection
- Catch web app vulnerabilities before they hit production with Cloud Web Security Scanner
These blogs feature step-by-step instructions with screenshots, and each has a companion video. Check them out, and let us know if there are any other issues and solutions you’d like us to detail.
3249
Of your peers have already watched this video.
3:00 Minutes
The most insightful time you'll spend today!
Why CISOs Need to Know This to Protect Users From Unsafe Websites
Unsafe web resources include social engineering sites—such as phishing and deceptive sites—and sites that host malware or unwanted software. For CISOs and their teams, this can quickly become an insurmountable challenge if it’s not nipped in the bud.
But there’s a way to enable companies to find unsafe URLs before their users do, identify phishing and deceptive sites, as well as sites that host malware or unwanted software.
Google Cloud’s Web Risk API was built to help admins protect users from unsafe websites. If a URL is known to be unsafe, Web Risk API responds with the threat type and the amount of time during which the website should be considered unsafe.
The Web Risk API can be integrated into both cloud-based and on-premises hosted applications and websites.
Watch this three-minute video to find out how Web Risk APIs can break the chain of malicious attacks and protect the data of your customers and users.
Center for Internet Security’s Latest Benchmark for Securing Chrome
5400
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
As the way people work continues to evolve, keeping security policies in place that protect organizations but give workers the ability to get things done is more important than ever. IT and security teams must aim to stay a step ahead of web-based security threats that come their organization’s way. To help, the Center for Internet Security (CIS) team has released the latest CIS Benchmark 2.1 for Google Chrome. This Benchmark offers independent recommendations on which Chrome policies to configure to help support organizations’ security and compliance needs. Thanks to Chrome being built with security at its core, in many cases, Chrome default settings are aligned with CIS recommendations.
Chrome is secure by default, but we also pride ourselves on providing customizations for enterprises to allow Chrome to better fit the needs of their business. And with hundreds of policies available through Chrome Browser Cloud Management and Group Policy Objects (Note: The CIS Benchmark is also available as a GPO), organizations can do just that.
Throughout the CIS guide you’ll notice that there are different designations for configuration profiles. Any labeled Level 1, are considered to be a good baseline for an organization. Level 2 profiles are recommended for deployments that require the highest level of security, but note that these settings could have a trade off on user productivity. We recommend looking at each setting and determining if it’s a good fit for your business.
The benchmark is made up of five sections:
- Enforced Defaults — Notes policies that are configured by default when you install Chrome. Enforcing these settings at an enterprise level can prevent these settings from being changed by business users to less secure options.
- Attack Surface Reduction — Details how to disable web features that may not be necessary in your enterprise environment and could reduce your overall attack surface.
- Privacy — Surfaces settings that improve user privacy.
- Data Loss Prevention — Contains settings that can help prevent data loss and protect your organization’s data. (Note: These recommendations cover additional capabilities that can be added to Chrome through BeyondCorp Enterprise).
- Forensics (Post Incident) — Shares recommendations on policies that give insights into post incident forensics and analysis.
Organizations can use these benchmarks to optimize the best way to secure Chrome in their environment. Download the CIS Benchmark here and check out our team’s configuration guide for additional recommendations on how to configure Chrome.
Note: This benchmark was created using a consensus review process composed of subject matter experts. Consensus participants provide perspective from a diverse set of backgrounds such as consulting, software development, audit and compliance, security research, operations, government, and legal. While these recommendations come from a trusted source, it’s important for each organization to weigh which policies make the most sense for their business.
Bringing Multiple Security Elements Together: Chrome
5387
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
Security and the way we’ve been able to advance user protections over the years is hands down one of my favorite topics when it comes to Chrome. I’ve been on the Chrome team for over 14 years and have seen the browser evolve to become a critical tool that helps people get work done at home or in the office. At the same time, Chrome is often the best line of defense to protect users against malicious software on the internet.
Now more than ever, security has to be top of mind for IT and security teams. Cybercrime is up 600% due to the COVID-19 pandemic, and remote work has increased the average cost of a data breach by $137,000. Those numbers are staggering. And IT teams need to make sure every piece of their tech stack helps support their security needs.
Chrome has worked for years to quickly mitigate risks, block malicious sites and content, and proactively improve web security to keep your users and corporate data safe, pioneering new layered defenses like sandboxing and site isolation. When we think of security and Chrome, we believe it takes multiple elements of security coming together to give organizations the best protection possible.
Security you don’t have to think about: Chrome has many built in protections in place by default that benefit all users. This includes our team’s work to minimize zero days and roll out fixes quickly. With auto updates enabled, Chrome offers enterprises fast and automatic fixes for zero day vulnerabilities. The Chrome security team recently published a post explaining the state of in-wild-bugs that’s worth a read. More examples of the defense-in-depth Chrome offers include capabilities like site isolation and sandboxing that keep malicious code from affecting other visited sites or impacting user machines. Our scanning infrastructure helps us detect and remove harmful extensions from the Chrome Web Store (in fact, last year we saw an almost 90% drop in malware) to prevent your end users from getting infected with malicious extensions. These are protections built directly into Chrome that automatically keep your users and organization safe.
Protections for Chrome users: We provide additional layers of protection that keep your end users safe while they’re on the web and give them helpful information whenever there are potential security risks. For example, Safe Browsing, offered natively in Chrome, helps protect devices by showing warnings to users when they attempt to navigate to dangerous sites or download malicious files. We also give users insights into the safety of their passwords, letting them know if their passwords have been compromised, or even prompting them to change their corporate password if they try to re-use it against company policies. You users are working hard to get things done, and Chrome’s layered security supports their workflows while helping them stay safe on the web.
Enterprise Controls: Every organization has unique security needs. That’s why Chrome provides enterprises with advanced safeguards and granular policy management to help meet those security goals. With hundreds of policy options, admins can use a variety of management tools, including Chrome Browser Cloud Management, to customize the browser. Chrome Browser Cloud Management goes even further, providing powerful enterprise extension management, a security priority for many organizations. Our extension request workflow allows end users to request extensions and admins to allow or deny extension requests. We also recently released extension pinning that allows admins to pin to specific versions of extensions to support any internal security review processes.
Visibility and reporting is another focus area to support IT teams. Through Chrome Browser Cloud Management, administrators can get more insight into their browser environment. This data can help IT teams make security decisions, better understand the devices running Chrome and investigate if issues arise.
Zero trust security: Finally, Chrome can help modernize an enterprise’s security strategy by migrating to Zero Trust access models. BeyondCorp Enterprise helps secure endpoints by directly integrating Threat and Data Protection in Chrome. This protects against intentional or accidental data loss and prevents malware and phishing in real-time. Additionally, Chrome and BeyondCorp Enterprise provide device trust and endpoint security signals directly from the browser, significantly easing deployment of zero-trust in your environment. In 2022, we plan to partner with leading players in the cybersecurity and zero trust space to add additional integrations.
For security recommendations, check out the new Chrome 2.1 CIS Benchmark that covers independent recommendations on which Chrome policies to configure to help support organizations’ security and compliance needs.
Conversations on Government Security with Dmitri Alperovitch, CrowdStrike’s Founder and Former CTO
4838
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
As I was preparing for my fireside chat with Dmitri Alperovitch, Founder and Former CTO of CrowdStrike and Executive Chairman of the Silverado Policy Accelerator, for the Google Cloud Government Security Summit taking place on Tuesday, July 20th, I was reflecting about recent developments in cybersecurity, Zero Trust best practices – including aspects of Google’s journey – and the benefits that this approach to cybersecurity brings to the public sector.
As Dmitri and I discussed what we wanted to share during our session at the Government Security Summit, I quickly realized how pertinent the information was to our public sector audience. For that reason, ahead of Tuesday’s event, I wanted to give you a glimpse of what is to come in our fireside chat. Read below for an exclusive preview of what we plan to discuss. If you are planning to attend on Tuesday, we encourage you to ask questions through our interactive chat function and sign up for 1:1 time with our Ask the Expert program.
Check out my chat with Dmitri below…
Heather: What do you see as the most significant changes in both the attack surface and cybercriminal tactics in recent years? And why do these changes present unprecedented challenges for public sector?
Dmitri: In terms of the threat landscape, the more things change, the more they stay the same. The adversaries haven’t changed that much. It’s actually striking. Not all threats are emanating from governments or state actors – either directly or by providing safe harbor to criminals – but a large portion are. That has not changed. The volume and scale of attacks have grown, however, and become massive. And now, the greatest challenge is that everyone is a target. Before, only top-end institutions and government organizations were facing nation state threats. That has changed either through targeted attacks or accidental ones, such as WannaCry. The question now is “How do we protect the most vulnerable and extend much-needed protection to smaller organizations that do not have deep security expertise or resources?”
Heather: Earlier this year, the Biden Administration released its Cybersecurity Executive Order (EO). What do you see as the most important takeaways and potential impact of the EO?
Dmitri: The Cybersecurity EO is set to have a significant impact. The biggest change is a shift in strategy. For many decades, we all had the mentality that we have to keep attackers out of the network. That is great in theory, but we all know that it is a virtual impossibility with a network of any significant size. Adversaries will find a way in. And, we used to think it was game over once they were in the network.
Then about 10 years ago, we began to see a change. Google led the way with its BeyondCorp strategy as did Lockheed Martin with its sentinel Kill Chain framework. Now, when an adversary penetrates a network, it’s not the end of the game, but the beginning. That is the case if the organization is prepared with a network architecture built around Zero Trust principles. The adversary now has to move laterally, steal credentials, and elevate privileges to get to the resources they want. A Zero Trust architecture can slow them down and give organizations time to detect and eject adversaries from the network. The EO recognizes the power of this approach and has made Zero Trust its fundamental tenet.
Heather: Federal agencies have spent the last 60 days looking at Zero Trust and developing their plans. What do you hope to see? What is critical to accelerating implementation?
Dmitri: The EO establishes a very ambitious timeline, and the US government is not known to move rapidly due to a number of restrictions and considerations. That said, the EO recognizes the idea that logging has to be at the center of modern architecture. Agencies need full visibility into what is going on at endpoints and across the network, have to hunt continuously across networks for adversaries, and must work to rapidly eject them. That is at the core of the EO, and it is a great shift. The private sector should be watching and learning as well.
Heather: What pitfalls should the Federal government look out for in moving forward to implement the EO?
Dmitri: One of the main challenges is the limited authority of the President. Congress is the only branch with the power to change the laws. While the establishment of the Cybersecurity and Infrastructure Security Agency (CISA) a few years ago allows for hunting across agency networks, CISA still has limited authority. It cannot manage the cybersecurity of more than 120 civilian agencies.
Some agencies are performing well when it comes to security, but we have to recognize that this is not the norm. Not all agencies have the capacity to recruit the best cybersecurity talent, but their needs may be just as great. We need to centralize capabilities and leverage the cloud, like Google, to provide all agencies with the best cyber talent and resources.
Join us at the Google Cloud Government Security Summit to hear the rest of our conversation. The event is complimentary. Register today to reserve your spot on July 20th. If you have any questions about the event, please reach out to us at cloudsummitsupport@google.com.
reCAPTCHA Keeps Unemployment Claims and COVID Vaccine Registration Portals Threat-free
3009
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
More people than ever have been conducting more of their lives online due to the COVID-19 pandemic. This creates a new landscape for fraudsters to create and release new attacks. Research commissioned by Forrester Consulting showed 84% of companies have seen an increase in bot attacks. 71% of organizations have seen an increase in the amount of successful attacks. 65% of businesses have experienced more frequent attacks and greater revenue loss due to bot attacks. With so many people visiting government websites to learn more about the COVID-19 vaccine, make vaccine appointments, or file for unemployment, these web pages have become prime targets for bot attacks and other abusive activities. But reCAPTCHA Enterprise has helped state governments protect COVID-19 vaccine registration portals and unemployment claims portals from abusive activities.
Assisting with unemployment claims during COVID-19
Alongside the wave of unemployment claims caused by COVID-19, many state government agencies, such as Wisconsin’s Workforce Development, have seen an increase in attempted malicious bot logins on their external websites. Many states have had malicious actors visit unemployment claims portals and enter stolen credentials to file fraudulent unemployment claims. Because many unemployment claims portals are mandated to pay a recipient within 2 weeks, the claims portal processes this fraudulent information and bad actors receive unemployment checks weeks before their false claims are recognized. By then, the fraudsters have their money and have repeated this process using other stolen credentials.
reCAPTCHA Enterprise helps state governments reduce false claims by preventing adversaries from automatically reusing credentials on unemployment claims portals. reCAPTCHA Enterprise’s scale and speed to determine fraudster behavior across the Internet helped some of the largest states in the United States, such as Texas.
Registering for the COVID-19 Vaccine and accessing state-sponsored resources
Several states, such as Pennsylvania, are challenged by web traffic that fluctuates based on the COVID-19 Vaccine Phase. For example, during Phase 1, there was a large increase in web traffic from both humans and bots because of the demand for the very few available vaccination slots. As more states move into Phase 2 and Phase 3, and the vaccine is more widely available, traffic is increasing because bad actors know more people are coming to these websites to register to be vaccinated.
reCAPTCHA Enterprise was implemented to stop bad actors from scripting bots to book vaccine appointments and then sell those appointment slots on another website for profit. These fake web pages are falsely promoted as websites where people can register for the vaccine. Vaccine appointments are not the only government system from which fraudsters try to profit. Transportation and social service departments also face frequent attacks, wherein fraudsters try to profit by booking and then selling appointments with those organizations.
Fending off these attacks was made easier thanks to reCAPTCHA Enterprise, a frictionless fraud detection service that leverages our experience from more than a decade of defending the internet and data for our network of more than 5 million sites. The reCAPTCHA Enterprise platform can understand fraudulent behavior, introduce friction to block bots from booking appointments, and allow legitimate users to access the vaccine portals and other state portals.
Because reCAPTCHA Enterprise does not require end users to complete captcha challenges, several state governments installed reCAPTCHA Enterprise across search, login, and registration web pages. State governments are also placing reCAPTCHA Enterprise on webpages where end users can access healthcare, receive assistance for housing or food, register motor vehicles, or propose legislation. With reCAPTCHA Enterprise on more pages, it becomes more difficult for malicious software or bots to carry out their attacks against different pages, but not for end users to browse, login into accounts, book appointments, or apply for resources. Because reCAPTCHA Enterprise requires no action from end users to stop fraud, state governments implemented reCAPTCHA Enterprise on all points of interaction on their webpages to ensure maximum security without impacting the user experience.
Providing security everywhere and pricing for all
Many state governments are familiar with buying cloud services in a pay-as-you-go model. reCAPTCHA Enterprise eased the purchasing process by providing state governments with predictable, scalable, and customizable pricing. State governments know up front how much they can expect to pay each month based on the number of assessments reCAPTCHA Enterprise performs. reCAPTCHA Enterprise’s flexible pricing model keeps pace with the natural fluctuations of visitors to vaccination registration and unemployment claims. reCAPTCHA Enterprise has a dedicated sales team that can tailor pricing to your specific use cases so both your webpages and budget are not compromised.
reCAPTCHA Enterprise has helped many state governments serve their constituents by making it easier to get vaccinated and collect unemployment. It helps constituents take advantage of public services and makes it more difficult for fraudsters to manipulate and interfere with them.
To start protecting your web pages from credential stuffing and other attacks, get started with reCAPTCHA Enterprise today.
More Relevant Stories for Your Company
If You Don’t Have These Features in Your Cloud, You’re Missing the Mark on Security
At Google Cloud, we work tirelessly to give our customers increased levels of control and visibility over their data. We've come out with new capabilities for data encryption, network security, security analytics, and user protection designed to deliver on that promise. External Key Manager: Store and manage encryption keys outside
Google Cloud & Siemplify Join Forces to Empower Companies to Manage Threat Responses Better
At Google Cloud, we are committed to advancing invisible security and democratizing security operations for every organization. Today, we’re proud to share the next step in this journey with the acquisition of Siemplify, a leading security orchestration, automation and response (SOAR) provider. Siemplify shares our vision in this space, and
How to Evolve Security for the Cloud: McKinsey with Google Cloud
Not too long ago, McKinsey released a report titled “Making a secure transition to the public cloud,” the result of interviews with IT security experts at nearly 100 enterprises around the world. Leveraging the expertise of Google Cloud and McKinsey security experts, the research presents a strategic framework for IT
The Rise of Cloud-Based Security Analytics and Operations Technologies
Security analytics and operations can be complex, requiring highly skilled professionals and detailed processes. To overcome these issues, security teams tend to deploy an array of security analytics tools and technologies to collect, process, analyze, and act upon growing volumes of security telemetry. Despite this investment, however, many organizations continue
