Announcing reCAPTCHA Enterprise’s Mobile SDK to Help Protect iOS, Android apps
4214
Of your peers have already read this article.
2:30 Minutes
The most insightful time you'll spend today!
reCAPTCHA Enterprise is Google’s online fraud detection service that leverages more than a decade of experience defending the internet. reCAPTCHA Enterprise can be used to prevent fraud and attacks perpetrated by scripts, bot software, and humans. When installed inside a mobile app at the point of action, such as login, purchase, or account creation, reCAPTCHA Enterprise can block fake users and bots while allowing legitimate users to proceed.
To provide more complete coverage for native mobile iOS and Android applications, we’re announcing the general availability of the reCAPTCHA Enterprise Mobile SDK. Designed with digital-first and mobile-first organizations in mind, the new Mobile SDK fully integrates reCAPTCHA Enterprise’s frictionless experience on end-users’ mobile devices.
Why should I use the Mobile SDK?
Unlike most web applications, iOS and Android apps run on physical devices that can provide a wealth of device telemetry to help identify fraud and bot activity. By combining both device and network signals, the new mobile SDK can better protect native mobile applications from bot attacks while unlocking the full potential of reCAPTCHA Enterprise. It provides:
- Frictionless customer experience — no picking fire hydrants from a grid
- Easy integration to your native mobile app with support for popular frameworks like Cocoa Pods and Swift Package Manager
- A regularly-updated device threat model to help stay ahead of attack evolution
Protecting against fraud across all your channels
Customers will be able to leverage the new mobile SDK to implement native iOS and Android protection against the OWASP Top 10 automated attacks common on the internet, which include fraudulent account creation, financial hijacking, and credential stuffing. This is particularly important for mobile workforces and end users who use a mobile app to access products and services. Since mobile traffic surpasses web traffic in many industries, it’s even more important to implement a comprehensive mobile app protection strategy to protect against the most prevalent attacks.
Integrating the new Mobile SDK
If you’re interested in learning more about how to integrate the new Mobile SDK, check out the documentation for iOS and Android. Mobile and Web integrations leverage the same easy to understand pricing for Assessments, found here.
Conversations on Government Security with Dmitri Alperovitch, CrowdStrike’s Founder and Former CTO
4844
Of your peers have already read this article.
2:00 Minutes
The most insightful time you'll spend today!
As I was preparing for my fireside chat with Dmitri Alperovitch, Founder and Former CTO of CrowdStrike and Executive Chairman of the Silverado Policy Accelerator, for the Google Cloud Government Security Summit taking place on Tuesday, July 20th, I was reflecting about recent developments in cybersecurity, Zero Trust best practices – including aspects of Google’s journey – and the benefits that this approach to cybersecurity brings to the public sector.
As Dmitri and I discussed what we wanted to share during our session at the Government Security Summit, I quickly realized how pertinent the information was to our public sector audience. For that reason, ahead of Tuesday’s event, I wanted to give you a glimpse of what is to come in our fireside chat. Read below for an exclusive preview of what we plan to discuss. If you are planning to attend on Tuesday, we encourage you to ask questions through our interactive chat function and sign up for 1:1 time with our Ask the Expert program.
Check out my chat with Dmitri below…
Heather: What do you see as the most significant changes in both the attack surface and cybercriminal tactics in recent years? And why do these changes present unprecedented challenges for public sector?
Dmitri: In terms of the threat landscape, the more things change, the more they stay the same. The adversaries haven’t changed that much. It’s actually striking. Not all threats are emanating from governments or state actors – either directly or by providing safe harbor to criminals – but a large portion are. That has not changed. The volume and scale of attacks have grown, however, and become massive. And now, the greatest challenge is that everyone is a target. Before, only top-end institutions and government organizations were facing nation state threats. That has changed either through targeted attacks or accidental ones, such as WannaCry. The question now is “How do we protect the most vulnerable and extend much-needed protection to smaller organizations that do not have deep security expertise or resources?”
Heather: Earlier this year, the Biden Administration released its Cybersecurity Executive Order (EO). What do you see as the most important takeaways and potential impact of the EO?
Dmitri: The Cybersecurity EO is set to have a significant impact. The biggest change is a shift in strategy. For many decades, we all had the mentality that we have to keep attackers out of the network. That is great in theory, but we all know that it is a virtual impossibility with a network of any significant size. Adversaries will find a way in. And, we used to think it was game over once they were in the network.
Then about 10 years ago, we began to see a change. Google led the way with its BeyondCorp strategy as did Lockheed Martin with its sentinel Kill Chain framework. Now, when an adversary penetrates a network, it’s not the end of the game, but the beginning. That is the case if the organization is prepared with a network architecture built around Zero Trust principles. The adversary now has to move laterally, steal credentials, and elevate privileges to get to the resources they want. A Zero Trust architecture can slow them down and give organizations time to detect and eject adversaries from the network. The EO recognizes the power of this approach and has made Zero Trust its fundamental tenet.
Heather: Federal agencies have spent the last 60 days looking at Zero Trust and developing their plans. What do you hope to see? What is critical to accelerating implementation?
Dmitri: The EO establishes a very ambitious timeline, and the US government is not known to move rapidly due to a number of restrictions and considerations. That said, the EO recognizes the idea that logging has to be at the center of modern architecture. Agencies need full visibility into what is going on at endpoints and across the network, have to hunt continuously across networks for adversaries, and must work to rapidly eject them. That is at the core of the EO, and it is a great shift. The private sector should be watching and learning as well.
Heather: What pitfalls should the Federal government look out for in moving forward to implement the EO?
Dmitri: One of the main challenges is the limited authority of the President. Congress is the only branch with the power to change the laws. While the establishment of the Cybersecurity and Infrastructure Security Agency (CISA) a few years ago allows for hunting across agency networks, CISA still has limited authority. It cannot manage the cybersecurity of more than 120 civilian agencies.
Some agencies are performing well when it comes to security, but we have to recognize that this is not the norm. Not all agencies have the capacity to recruit the best cybersecurity talent, but their needs may be just as great. We need to centralize capabilities and leverage the cloud, like Google, to provide all agencies with the best cyber talent and resources.
Join us at the Google Cloud Government Security Summit to hear the rest of our conversation. The event is complimentary. Register today to reserve your spot on July 20th. If you have any questions about the event, please reach out to us at cloudsummitsupport@google.com.
3251
Of your peers have already watched this video.
3:00 Minutes
The most insightful time you'll spend today!
Why CISOs Need to Know This to Protect Users From Unsafe Websites
Unsafe web resources include social engineering sites—such as phishing and deceptive sites—and sites that host malware or unwanted software. For CISOs and their teams, this can quickly become an insurmountable challenge if it’s not nipped in the bud.
But there’s a way to enable companies to find unsafe URLs before their users do, identify phishing and deceptive sites, as well as sites that host malware or unwanted software.
Google Cloud’s Web Risk API was built to help admins protect users from unsafe websites. If a URL is known to be unsafe, Web Risk API responds with the threat type and the amount of time during which the website should be considered unsafe.
The Web Risk API can be integrated into both cloud-based and on-premises hosted applications and websites.
Watch this three-minute video to find out how Web Risk APIs can break the chain of malicious attacks and protect the data of your customers and users.
3443
Of your peers have already watched this video.
2:30 Minutes
The most insightful time you'll spend today!
Learn to Use reCAPTCHA Enterprise to Protect Your Website from Fraud
One of the top questions enterprises have is: How can I use reCAPTCHA Enterprise to protect my website from online fraudulent activity?
Fraudulent web activities cost enterprises billions of dollars each year. Security teams need to keep the bad actors out of their websites and ensure that their customers can always get in.
Google reCAPTCHA has been defending millions of sites for almost a decade, and the reCAPTCHA Enterprise service built on this technology with capabilities designed specifically for enterprise security concerns.
In this demo, you can see how reCAPTCHA Enterprise identifies the difference between a real user and a bad actor and how you can view this within the Admin Analytics dashboard to see what is happening with your website.
Defining cloud’s future: How autonomic data security can help
2563
Of your peers have already read this article.
1:30 Minutes
The most insightful time you'll spend today!
“Ninety percent of all data today was created in the last two years—that’s 2.5 quintillion bytes of data per day,” according to business data analytics company Domo. That would be a mind-bending statistic, except that it’s already five years old.
As data usage has undergone drastic expansion and changes in the past five years, so have your business needs for data. Technology such as cloud computing and AI have changed how we use data, derive value from data, and glean insights from data. Your organization is no longer just crunching and re-crunching the same data sets. Data moves, shifts, and replicates, as you mingle data sets and gain new value in the process, as we say in our Data Cloud story. All the while, your data resides in—and is being created in—new places.
Data lives in a myriad of locations now and requires access from different locations and mediums, yet many of today’s security models are not geared towards this. In short, your data has fallen out of love with your security model, but attackers have not. So, how do we realign data and security so they are once again in a healthy relationship?
Google Cloud, as a leader in cloud data management and cloud security, is positioned uniquely to define and lead this effort. We’ve identified some challenges around the classic approach to data security and the changes triggered by the near-ubiquity of the cloud. The case is compelling for adopting a modern approach to data security. We contend that the optimal way forward is with autonomic data security.
A relatively new concept, autonomic data security is security that’s been integrated with data throughout its lifecycle. It can make things easier on users by freeing them from defining and redefining myriad rules about who can do what, when, where. It’s an approach that keeps pace with constantly evolving cyberthreats and business changes.
Autonomic data security can help you keep your IT assets more secure and can make your business and IT processes speedier. For example, data sharing with partners and data access decisions simultaneously becomes faster and more secure. This may sound like magic, but in fact relies on a constant willingness to change and adapt to both business changes and threat evolution.
Taking the precepts, concepts, and forward-looking solutions presented in this paper into consideration, we strongly believe that now is the right time to assess where you and your business are when it comes to data security. Cloud also brings an incredible scale of computing. Where gigabytes once roamed, petabytes are now common. This means that many data security approaches, especially the manual ones, are no longer practical.
To prepare for the future of data security, we recommend you challenge your current model and assumptions and ask critical questions, evaluate where you are, and then start to put a plan in place of how you could start incorporating the autonomic data security pillars into your data security model.
There are two sets of questions organizations need to discover the answers to as they start this journey. The first set of questions will help you identify the nature and status of your data, and inform the answers to the second set.
- What data do I have?
- Who owns it?
- Is it sensitive?
- How is it used?
- What is the value in storing the data?
The second set focuses on higher-level problems:
- What is my current approach to data security?
- Where does it fail to support the business and counter the threats?
- Does it support my business?
- Should I consider making a change? And if yes, in what direction?
The path to improved data security starts by asking the right questions. You can read the full Autonomic Data Security paper for a more in-depth exploration here and learn more about the idea in this podcast episode.
3306
Of your peers have already downloaded this article
11:30 Minutes
The most insightful time you'll spend today!
Today’s security professionals face not only an ever-expanding list of threats, old and new, but also an excruciating choice of security approaches and tools.
Nearly 2000 security vendors are trying to sell to large enterprises and small businesses. Most organizations have already invested heavily in cybersecurity solutions. From firewalls to proxies and endpoint protection to DLP, the average firm has more than 40 types of security technologies in place, each generating telemetry that grows every year.
With employees, contractors, partners, and customers all accessing online business processes that were once hidden in a back office, corporate network traffic has also increased significantly. There is more noise than ever before, hiding more attacks than ever before — with greater impacts than ever before.
Security analytics promises to help analysts make sense of this data, to find useful signals in the noise before it’s too late.
For most organizations, however, an effective security analytics solution is an expensive and complex exercise in systems integration, with heavy IT operations support required simply to keep the system up and
running as it grows.
As CIOs migrate corporate IT to the cloud, CISOs roll out advanced threat protection such as EDR and network traffic analyzers to protect the pieces
that remain under their control.
In theory, a SIEM or centralized log management product consolidates and correlates all of this information, but in practice, SIEMs buckle under large data volumes.
Moreover, high-volume telemetry from EDR systems is rarely fed into a SIEM. If high volume telemetry is ingested, it’s typically only retained for a few weeks, if at all.
While it sounds counter-intuitive that we need another type of a tool, the world has changed dramatically and many existing security tools did not evolve fast enough to maintain relevance.
Today, organizations still operate legacy systems, have vast on-premise IT presence, but also a large cloud presence, often across multiple cloud providers. The types of security telemetry they collect expands,
and the volumes grow.
More Relevant Stories for Your Company
How Google Workspace Helps Manage, Govern and Protect Sensitive Data
The shift towards a hybrid work style and trends accelerated by the pandemic has resulted in data deluge. With companies and individuals sharing increasingly large volumes of information and collaborating with internal and external stakeholders, the need for innovations for higher security also escalates. View this video to learn how
Encryption in Transit: The Next Level in Cloud Security
Security is often a deciding factor when choosing a public cloud provider. At Google Cloud, security is of the utmost importance and the security strategy encompass authentication, integrity, and encryption, for both data at rest and in transit. Hence, Google Cloud encrypts and authenticates all data in transit at one
Google Cloud’s Metric Scope Makes Multi-project Monitoring Simple
Customers need scale and flexibility from their cloud and this extends into supporting services such as monitoring and logging. Google Cloud’s Monitoring and Logging observability services are built on the same platforms used by all of Google that handle over 16 million metrics queries per second, 2.5 exabytes of logs per month, and over
Introducing IAM Deny: Harden Your Security Posture at Scale the Easy Way
At Google Cloud, we’re focused on making it easy for organizations to build solutions quickly and securely. Identity and Access Management (IAM) is the core security control for establishing who has access to which cloud resources and making sure access permissions are aligned to your company’s business and security policies.
