A critical component of any security operations team’s job is to deliver high-fidelity detections of potential threats across the breadth of adversary tactics. But increasingly sophisticated threat actors, an expanding attack surface, and an ever-present cybersecurity talent shortage make this task more challenging than ever.

Google keeps more people safe online than anyone else. Individuals, businesses and governments globally depend on our products that are secure-by-design and secure-by-default. Part of the “magic” behind Google’s security is the sheer scale of threat intelligence we are able to derive from our billions of users, browsers, and devices.

Today, we are putting the power of Google’s intelligence in the hands of security operations teams. We are thrilled to announce the general availability of curated detections as part of our Chronicle SecOps Suite. These detections are built by our Google Cloud Threat Intelligence (GCTI) team, and are actively maintained to reduce manual toil in your team.

Our detections provide security teams with high quality, actionable, out-of-the-box threat detection content curated, built and maintained by Google Cloud Threat Intelligence (GCTI) researchers. Our scale, and depth of intelligence, gained by securing billions of users everyday, gives us a unique vantage point to craft effective and targeted detections. These native detection sets cover a wide variety of threats for cloud and beyond, including Windows-based attacks like ransomware, remote-access tools (RAT), infostealers, data exfiltration, suspicious activity, and weakened configurations.

With this launch, security teams can smoothly leverage Google’s expertise and unique visibility into the threat landscape. This release helps understaffed and overstressed security teams keep up with an ever evolving threat landscape, quickly identify threats, and drive effective investigation and response. With this new release, security teams can:

• Enable high quality curated detections with a single click from within the Chronicle console.
• Operationalize data with high-fidelity threat detections, stitched with context available from authoritative sources (such as IAM and CMDB).
• Accelerate investigation and response by finding anomalistic assets and domains with prevalence visualization for the detections triggered.
• Map detection coverage to the MITRE ATT&CK framework to better understand adversary tactics and techniques and uncover potential gaps in defenses.

Detections are constantly updated and refined by GCTI researchers based on the evolving threat landscape. The first release of curated detections includes two categories that cover a broad range of threats, including:

• Windows-based threats: Coverage for several classes of threats including infostealers, ransomware, RATs, misused software, and crypto activity.
• Cloud attacks and cloud misconfigurations: Secure cloud workloads with additional coverage around exfiltration of data, suspicious behavior, and additional vectors.

Let’s look at an example of how you can put curated detections to work within the Chronicle dashboard, monitor coverage, and map to MITRE ATT&CK®.

An analyst can learn more details around specific detections and understand how they map to the MITRE ATT&CK framework. There are customized settings to configure deployment and alerting, and specify exceptions via reference lists.

You can see each rule which has generated a detection against your log data in the Chronicle rules dashboard. You can observe detections associated with the rule and pivot to investigative views. For example, here is the detection view from the timeline of an Empire Powershell Stager launch triggered by the Windows RAT rule set. You can also easily pivot to associated information and investigate the asset on which it was triggered.

By surfacing impactful, high-efficacy detections, Chronicle can enable analysts to spend time responding to actual threats and reduce alert fatigue. Our customers who used curated detections during our public preview were able to detect malicious activity and take actions to prevent threats earlier in their lifecycle. And there’s more to come. We will be delivering a steady release of new detection categories covering a wide variety of threats, community-driven content, and other out-of-the-box analytics.

Ready to put Google’s intelligence to work in your Security Operations Center? Contact Google Cloud sales or your customer success CSM team. You can also learn more about all these new capabilities in Google Chronicle in our product documentation.

Download our guidebook to learn how reCAPTCHA Enterprise can help strengthen your website security quickly.

Cyber threats on the rise

In 2021, the United States saw 40.5% of website attacks committed through “bad bots” on the internet, with 37.2% of government website traffic being bad bots, according to research by cybersecurity firm Imperva1. As cyber threats increase, government agencies need a way to safely let constituents access digital services. Google Cloud reCAPTCHA Enterprise protects websites by distinguishing between humans and bots. Full-scale implementation of reCAPTCHA Enterprise solution expands on bot detection to protect public sector websites from a broad range of digital fraud. Below are some highlights from our new reCAPTCHA Enterprise guidebook detailing functional enhancements and ways for government agencies to take advantage of enterprise capabilities.

Advanced website protection

reCAPTCHA Enterprise builds upon the existing reCAPTCHA API that has defended 5+ million websites for over a decade. It uses advanced risk analysis techniques to distinguish between humans and bots, protecting sites from spam and abuse as well as detecting other fraudulent activities, including credential stuffing, account takeovers (ATO), and automated account creation.

How it works

Detecting password leaks and credential breaches
With reCAPTCHA Enterprise’s password leak protection, agencies can conduct regular audits of user credentials, such as passwords, to detect leaks and breaches and prevent account takeovers (ATOs), as well as credential stuffing attacks.

UI challenge vs. frictionless
reCAPTCHA Enterprise returns a score, giving you the ability to take a number of actions, including requiring additional factors of authentication or throttling bots that may be scraping content. This functionality allows you to verify if an interaction is legitimate without any user interaction.

User-friendly migration
Google Cloud’s reCAPTCHA Enterprise offers a simple migration process in which your account is moved from the reCAPTCHA Admin to the Google Cloud Platform (GCP) after you create a project to migrate it to. Watch our 10-minute webinar to see how.

A cost-effective upgrade to a standard cybersecurity solution
Google reCAPTCHA Enterprise comes with 99.9%+ uptime, multi-factor authentication, and support for Android, iOS, and web applications. Our reCAPTCHA offering is structured in a way that allows you to fully control your investment and responsibly allocate taxpayer dollars.

reCAPTCHA Enterprise in action

Google Cloud’s reCAPTCHA protects against key automated attacks, including account creation, credential stuffing, cashing out, denial of inventory, and skewing. State governments have found success with using Google Cloud’s reCAPTCHA for cyber risk management. Wisconsin’s Workforce Development Agency used fraud detection and identification, including reCAPTCHA, to mitigate malicious bot logins on its external website, and several agencies in the Commonwealth of Pennsylvania have implemented reCAPTCHA to prevent bots from booking and reselling COVID-19 vaccine appointments.

Protecting public sector websites from bad actors can be challenging, especially with emerging threats from adversaries and extremist groups. Google Cloud’s reCAPTCHA Enterprise offers comprehensive website security solutions to successfully protect against cyber threats.

Download our reCAPTCHA Enterprise guidebook for a detailed look at how you can use reCAPTCHA Enterprise to strengthen your website security and implement the solution quickly and easily.

References:

1. Bad Bot Report 2021: The Pandemic of the Internet

Last July, Google Cloud launched our ambassador partnership with the Health Information Sharing and Analysis Center (Health-ISAC) and committed to working with industry leaders to better protect our healthcare ecosystem. Securing healthcare technology and data is a global challenge, and to meet it security professionals need to have better channels for sharing information and effective security practices. 

To that end, we’re pleased to announce that our relationship with Health-ISAC is now expanding to include CISOs and security leaders in Europe, the Middle East, and Africa (EMEA).  

On May 23, 2023, we’ll join the Health-ISAC on a 17-city tour across the region, starting in Zurich, Switzerland, as part of its European Healthcare Threat Landscape Tour. In each session, we will bring together experts from across the region with cybersecurity practitioners from the Health-ISAC, Google Cloud, law enforcement, and regulatory bodies.  

Our goals is to focus the discussions on several topics:

• How the threat landscape is unique to each country we visit;
• How we can better share threat intelligence; 
• What are the emerging European laws and regulations  that can affect healthcare and cybersecurity;
• How ransomware continues to evolve and the threat that poses to healthcare; organizations;
• What we can do to improve cyber incident response;
• What impact digital sovereignty can have on European healthcare;
• And which initiatives Health-ISAC and Google Cloud are launching to better protect Europe’s healthcare system.

The timing for the tour could not come at a more critical time. Ransomware and digital extortion threatens healthcare and its subsectors, with national health systems in Ireland, UK, Germany, and Spain all recently experiencing extended outages because of ransomware. Threat actors continue to target proprietary data at biotechnology and pharmaceutical firms. Meanwhile, existing regulations such as the Digital Markets Act and GDPR, and new regulations such as the NIS2 Directive (Directive (EU) 2022/2555), which seek to protect EU citizens and businesses from risks posed by the digital world, are raising the bar that CISOs and security leaders must surpass to ensure their businesses can stay compliant and able compete in the global digital economy.

“The European Healthcare Threat Landscape Tour is one of many efforts we have undertaken to build a closer community of trust around threats and cybersecurity practices that keep health organization’s safe,” said Denise Anderson, executive director, Health-ISAC.

“We all rely on these organizations to take care of us and produce therapies that keep us healthy. Delivering these engagements alongside Google Cloud helps us achieve global scale and shows off both organizations’ commitments to building a sustainable, resilient healthcare ecosystem for entire societies.” 

Each stop in the tour will provide opportunities to dive deep into these topics, grow an understanding of these challenges, create a space for collaboration, and build closer, trusted partnerships. The meetings are open to member and non-member organizations working in healthcare. Interested participants can contact the Health-ISAC through their contact form or register on their website for the nearest event.

“The Google Cybersecurity Action Team’s mission is to secure customers, secure the cloud, and secure the planet (and beyond). Working with industry groups like Health-ISAC helps us achieve this mission while respecting each other and the unique challenges European health systems face. Myself and our EMEA-based Google Cloud and Mandiant security teams are looking forward to another great collaboration,” said Phil Venables, chief information security officer, Google Cloud.

At Google Cloud, we’re committed to helping build a secure and resilient healthcare ecosystem for everyone. As we hit the road with the Health-ISAC this summer, we’ll be sure to send updates on what we learn through this collaboration and how we can all work together to secure smarter in 2023 and beyond.