Today, we are putting the power of Google’s insights and intelligence in the hands of risk, fraud, and security teams everywhere. We are pleased to announce the general availability of reCAPTCHA Enterprise Fraud Prevention, a new product that uses Google’s own fraud models, machine learning, and intelligence from protecting more than 6 million websites to help stop payment fraud.

reCAPTCHA Enterprise Fraud Prevention can help protect payment transactions by identifying targeted manual attacks and large-scale fraud attempts. It automatically trains fraud models based on behavior and transaction data to identify events that are likely fraudulent and could cause a dispute or chargeback if accepted. 

When threat actors are identified and blocked on any site in the reCAPTCHA network, the intelligence is made available to help protect other organizations from those same attackers. Organizations can then use the scores to send the transaction for manual review or directly block suspicious transactions, drive increased trust in their legitimate transactions, reduce the amount of friction for good users, and reduce erroneous rejection rates.

“Being a safe and trusted place to give and receive help is our top priority. We are constantly innovating, refining and enhancing our fraud defenses and Google’s reCAPTCHA Enterprise Fraud Prevention adds another layer of industry-leading protection for our users. Combining Google’s rich security expertise with GoFundMe’s focus on fraud prevention is already showing promising results as we strive to keep our platform the safest place to give online,” said Matthew Murray, director of risk, GoFundMe.

According to data obtained from our customers using reCAPTCHA Enterprise Fraud Prevention in private Preview, the new solution can help drive comprehensive value for organizations by:

• Reducing fraud losses: Get behavior modeling (not just mouse movements), stop financial damage created by account takeovers (ATOs), and connect fraud and abuse intelligence across your site and application.
• Increasing legitimate sales: Fraud Prevention can help businesses increase their revenue by providing insights to understand who good users are, who may otherwise be caught in an overly aggressive, customer restrictive fraud model.*

These benefits  are enabled for organizations by:

• Preventing advanced attacks: Stopping sophisticated attacks in an environment where attackers use cloud fraud infrastructure, and data leaks, virtual cards and VPN usage are on the rise
• Increasing trust in good transactions: Focus on good approval rates through a unique combination of supervised and unsupervised models
• Improving customer experience: By preventing fraudulent transactions with zero user friction, Fraud Prevention can help businesses protect legitimate users and increase customer retention

Our customers have used these new capabilities in preview in customer experiences that include online checkouts and payment transactions. Fraud Prevention has been used by merchants and payment processors to block millions of dollars in fraudulent transactions in a frictionless way. 

reCAPTCHA Enterprise provides a comprehensive online fraud detection platform that helps prevent fraudulent, spammy, and abusive digital client activity across your web and application footprint. This platform includes Account Defender, which protects users from account takeovers (ATO), frictionless bot management capabilities, and password leak detection to identify compromised accounts. With an additional API call for Fraud Prevention, organizations can leverage a comprehensive solution to secure financial transactions along with core reCAPTCHA Enterprise capabilities. 

To get started, organizations can install a score-based site key on each part of the payment user flow front end and send transaction data when a purchase occurs. This site key helps train site-specific fraud models and start returning fraud scores for each transaction. 

Ready to put reCAPTCHA Enterprise Fraud Prevention to work? Contact our fraud specialists or your customer success CSM team and sign up with the free tier. You learn more about these new capabilities in reCAPTCHA Enterprise in our product documentation. You can also register for our webinar where our experts will be discussing this capability in great detail on June 1, 2023. 

Coming up at our Security Summit on June 13-14, you can hear how reCAPTCHA Enterprise helped GoFundMe secure their donors from fraud. Sign up here for free Security Summit registration.

The cybersecurity industry is faced with the tremendous challenge of analyzing growing volumes of security data in a dynamic threat landscape with evolving adversary behaviors. Today’s security data is heterogeneous, including logs and alerts, and often comes from more than one cloud platform. In order to better analyze that data, we’re excited to announce the release of the Cloud Analytics project by the MITRE Engenuity Center for Threat-Informed Defense, and sponsored by Google Cloud and several other industry collaborators.

Since 2021, Google Cloud has partnered with the Center to help level the playing field for everyone in the cybersecurity community by developing open-source security analytics. Earlier this year, we introduced Community Security Analytics (CSA) in collaboration with the Center to provide pre-built and customizable queries to help detect threats to your workloads and to audit your cloud usage. The Cloud Analytics project is designed to complement CSA.

The Cloud Analytics project includes a foundational set of detection analytics for key tactics, techniques and procedures (TTPs) implemented as vendor-agnostic Sigma rules, along with their adversary emulation plans implemented with CALDERA framework. Here’s a overview of Cloud Analytics project, how it complements Google Cloud’s CSA to benefit threat hunters, and how they both embrace Autonomic Security Operations principles like automation and toil reduction (adopted from SRE) in order to advance the state of threat detection development and continuous detection and response (CD/CR).

Both CSA and the Cloud Analytics project are community-driven security analytics resources. You can customize and extend the provided queries, but they take a more do-it-yourself approach—you’re expected to regularly evaluate and tune them to fit your own requirements in terms of threat detection sensitivity and accuracy. For managed threat detection and prevention, check out Security Command Center Premium’s realtime and continuously updated threat detection services including Event Threat Detection, Container Threat Detection, and Virtual Machine Threat Detection. Security Command Center Premium also provides managed misconfiguration and vulnerability detection with Security Health Analytics and Web Security Scanner.

Cloud Analytics vs Community Security Analytics

Similar to CSA, Cloud Analytics can help lower the barrier for threat hunters and detection engineers to create cloud-specific security analytics. Security analytics is complex because it requires:

• Deep knowledge of diverse security signals (logs, alerts) from different cloud providers along with their specific schemas;
• Familiarity with adversary behaviors in cloud environments;
• Ability to emulate such adversarial activity on cloud platforms;
• Achieving high accuracy in threat detection with low false positives, to avoid alert fatigue and overwhelming your SOC team.

The following table summarizes the key differences between Cloud Analytics and CSA:

Together, CSA and Cloud Analytics can help you maximize your coverage of the MITRE ATT&CK® framework, while giving you the choice of detection language and analytics engine to use. Given the mapping to TTPs, some of these rules by CSA and Cloud Analytics overlap. However, Cloud Analytics queries are implemented as Sigma rules which can be translated to vendor-specific queries such as Chronicle, Elasticsearch, or Splunk using Sigma CLI or third party-supported uncoder.io, which offers a user interface for query conversion. On the other hand, CSA queries are implemented as YARA-L rules (for Chronicle) and SQL queries (for BigQuery and now Log Analytics). The latter could be manually adapted to specific analytics engines due to the universal nature of SQL

Getting started with Cloud Analytics

To get started with the Cloud Analytics project, head over to the GitHub repo to view the latest set of Sigma rules, the associated adversary emulation plan to automatically trigger these rules, and a development blueprint on how to create new Sigma rules based on lessons learned from this project.

The following is a list of Google Cloud-specific Sigma rules (and their associated TTPs) provided in this initial release; use these as examples to author new ones covering more TTPs.

Sigma rule example

Using the canonical use case of detecting when a storage bucket is modified to be publicly accessible, here’s an example Sigma rule (copied below and redacted for brevity):

The rule specifies the log source (gcp.audit), the log criteria ( storage.googleapis.com service and storage.setIamPermissions method) and the keywords to look for (allUsers, ADD) signaling that a role was granted to all users over a given bucket. To learn more about Sigma syntax, refer to public Sigma docs.

However, there could still be false positives such as a Cloud Storage bucket made public for a legitimate reason like publishing static assets for a public website. To avoid alert fatigue and reduce toil on your SOC team, you could build more sophisticated detections based on multiple individual Sigma rules using Sigma Correlations.

Using our example, let’s refine the accuracy of this detection by correlating it with another pre-built Sigma rule which detects when a new user identity is added to a privileged group. Such privilege escalation likely occurred before the adversary gained permission to modify access of the Cloud Storage bucket. Cloud Analytics provides an example of such correlation Sigma rule chaining these two separate events.

What’s next

The Cloud Analytics project aims to make cloud-based threat detection development easier while also consolidating collective findings from real-world deployments. In order to scale the development of high-quality threat detections with minimum false positives, CSA and Cloud Analytics promote an agile development approach for building these analytics, where rules are expected to be continuously tuned and evaluated.

We look forward to wider industry collaboration and community contributions (from rules consumers, designers, builders, and testers) to refine existing rules and develop new ones, along with associated adversary emulations in order to raise the bar for minimum self-service security visibility and analytics for everyone.

Acknowledgements

After more than a year of remote collaboration, many people are showing signs of digital fatigue. Throughout the pandemic, millions of employees bridged the physical distances with their colleagues by making themselves more available, joining a deluge of virtual meetings, and leaning into a dizzying array of tools and applications. As part of our mission to build the future of work, we’re addressing these challenges in Google Workspace.

As we announced today at I/O, we’re launching smart canvas—a new product experience that delivers the next evolution of collaboration for Google Workspace. Between now and the end of the year, we’re rolling out innovations that make it easier for people to stay connected, focus their time and attention, and transform their ideas into impact.

Specifically, we’re enhancing the apps that hundreds of millions of people use every day—like Docs, Sheets, and Slides—to make them even more flexible, interactive, and intelligent. With smart canvas, we’re bringing the content and connections that transform collaboration into a richer, better experience in Google Workspace.

When we launched Google Docs and Sheets 15 years ago, these apps introduced the world to a new way of working. They enabled anytime, anywhere teamwork—a stark contrast to the legacy tools that were designed for an era of individual work on office desktops. For over a decade now, we’ve been pushing documents away from being just digital pieces of paper and toward collaborative, linked content inspired by the web. Smart canvas is our next big step.https://www.youtube.com/embed/SDBbFETGiA4?enablejsapi=1&

Making collaboration more flexible and helpful

The evolving hybrid work model gives new urgency to existing collaboration challenges. How do teams stay focused and connected as they work together, regardless of where people are located? With smart canvas, we’re building deeper connections across Google Workspace to transform collaboration anywhere it happens. 

For example, we’re taking something that people already use every day—@-mentions—to open up new, powerful collaboration capabilities. New interactive building blocks—smart chips, templates, and checklists—will connect people, content, and events into one seamless experience.

Already available, when you @ mention a person in a document, a smart chip shows you additional information like the person’s location, job title, and contact information. And starting today, we’re introducing new smart chips in Docs for recommended files and meetings. To insert smart chips into your work, simply type “@” to see a list of recommended people, files, and meetings. From web or mobile, your collaborators can then quickly skim associated meetings and people or preview linked documents, all without changing tabs or contexts. Smart chips will come to Sheets in the coming months.

Additionally, we’re making it easier to drive projects forward by streamlining common team workflows. Starting today in Docs, checklists are available on web and mobile, and you’ll soon be able to assign checklist action items to other people. These action items will show up in Google Tasks, making it easier for everyone to manage a project’s To Do list. 

We’re also introducing table templates in Docs. Topic-voting tables will allow you to easily gather team feedback while project-tracker tables will help you capture milestones and statuses on the fly. And a new document template for capturing meeting notes will automatically import any relevant information from a Calendar meeting invite, including smart chips for attendees and attached files.

With our new pageless format in Docs, you’ll be able to remove the boundaries of a page to create a surface that expands to whatever device or screen you’re using, making it easier to work with wide tables, large images, or detailed feedback in comments. And if you want to print or convert to PDF, you’ll be able to easily switch back to a paginated view.

Meanwhile, you’ll be able to toggle between new views in Sheets to better manage and interact with your data. Our first launch will be a timeline view that makes tracking tasks easier and faster. This flexible view allows you to organize your data by owner, category, campaign, or whichever attribute fits best. Using a dynamic, interactive timeline strengthens your ability to manage things like marketing campaigns, project milestones, schedules, and cross-team collaborations.

Fostering human connection—wherever people work

With smart canvas and innovations in Google Meet, we’re making it easy to bring the voices and faces of your team directly into the collaboration experience, to help people share ideas and solve problems together from anywhere. As part of that, we’re building tighter integrations between our communication and collaboration tools so you can pull content into conversations and conversations into content. 

Starting today, we’re rolling out the ability to present your content to a Google Meet call on the web directly from the Doc, Sheet, or Slide where you’re already working with your team. Jumping between collaborating in a document and a live conversation without skipping a beat helps the project—and the team—stay focused. And in the fall, we’re bringing Meet directly to Docs, Sheets, and Slides on the web, so people can actually see and hear each other while they’re collaborating.

Live captions and translations in Google Meet will also play a crucial role in keeping people connected as they work together in distributed teams. We currently offer live captions in five languages, with more on the way. And we’re introducing live translations of captions later this year, starting with English-language live captions translated into Spanish, Portuguese, French, or German, with many more languages to follow.

With recent enhancements to Google Meet, we’re also giving people more control and flexibility over the meeting experience, including more space to see people and content, plus the ability to pin and unpin content and video feeds. And to help with meeting fatigue, you can now turn off your self-feed entirely.

Because we know that collaboration is fluid and fast-moving, we’re making it easier for teams to give feedback on the fly and to move seamlessly between conversations and building content together. Teams can now jump from a discussion in Google Chat directly to building content together. Creating and editing Sheets and Docs from Google Chat rooms is already live in our web experience, and we’ll enable it for Slides in the coming weeks. And to gauge the team’s reactions along the way, we’re introducing emoji reactions in Docs in the next few months.

Working smarter and safer

Google Workspace is already infused with powerful intelligence that enables people to make the best use of their time and attention. Whether it’s with the two billion grammar suggestions we surface in Docs every month, or the intelligent file suggestions in Drive’s Priority and Quick Access features that cut file finding time by 50%.

To help everyone work smarter, in the next few months we’re introducing additional assisted writing features in Docs on the web. This includes warnings about offensive words and language, as well as other stylistic suggestions that can speed up editing and help make your writing more impactful. We’re also adding more assisted analysis functionality in our Sheets web experience, with formula suggestions that make it easier for everyone, not just analysts, to derive insights from data. Sheets intelligence helps you build and troubleshoot formulas, making data analysis faster and reducing errors.

As smart canvas evolves, we’re making it easy for businesses to connect the apps and tools they rely on to Google Workspace. This builds on our history of supporting a variety of add-on features that take the friction out of collaboration—from adding e-signatures directly in Google Workspace with DocuSign to the Salesforce connector that integrates with Sheets. To help people work even smarter, we recently announced that AppSheet Automation is generally available, so that you can automate time-consuming tasks—like approving invoices and onboarding new hires—without having to write a single line of code.

Looking ahead, we’re planning to build additional APIs so you can bring the information and actions you need from third-party tools directly into smart canvas elements like smart chips, checklists, and table templates.

And because trust is at the center of all collaboration within Google Workspace, today we’re also launching advanced capabilities that help protect users against security threats and abuse as they work together.

Transforming how people work to deliver real-world innovation

While there’s no one way to collaborate, we know from our customers that transforming how people work results in real-world innovation.

Google Workspace fuels a new way of working together. It lets our teams around the world—whether they’re in the office, at home, or in the grocery store aisle—work more flexibly and translate their ideas into new ways of delighting customers.
—Thibaud Cainne, Global Head of Tech Infra and Digital Workplace, Carrefour

Transformation happens at all levels, and often in every tool. We were able to get 17,000 of our people to make the shift from Excel to Google Sheets in just six months by demonstrating how we could optimize, automate, and connect spreadsheets and their data. That kind of collaboration leads to real-world innovation for our clients.
—Monica Andrea Diaz Pinzon, Chief of Digital Transformation (Special Projects), Banco Davivienda

We built a digital hub on Google Workspace to transform the way we connect with employees and partners across multiple locations and organizations. It allowed us to spin up major research projects in days instead of months, including delivery of major COVID-19 vaccine studies.
—Justin Riordan-Jones, Head of System and Information (Research), Department of Health & Social Care, National Institute for Health Research (UK)

As smart canvas drives the next era of collaboration in Google Workspace, we remain committed to providing a solution that’s flexible, helpful, and that fuels innovation for organizations in every industry. On the frontlines, in corporate offices, and across the countless workspaces in between, Google Workspace will continue to transform how work gets done.