EMIL KINER: Hi.
Welcome to today's session on protecting your web
applications and APIs.
Thank you for joining us.
My name is Emil Kiner, and I'm the product manager
for Cloud Armor, the Google Cloud DDoS mitigation
service and web application firewall,
which is a key component of the WAAP solution.
I'm joined today by Mos Saleh from ATB Financial.
And I'll hand it over to Mos to introduce himself.
MOS SALEH: Hi.
I am Mos Saleh.
I'm the director of cloud architecture for ATB Financial.
And what I do is I help our team to understand
how to best utilize the GCP infrastructure and its security
products to align with the overall security
objectives of our organization.
EMIL KINER: Thanks, Mos.
In today's talk, we will first go
through an overview of Google's web app and API protection
solution.
Next, we'll touch upon the three core components
of our end-to-end WAAP solution consisting
of Cloud Armor, reCAPTCHA Enterprise, and Apigee.
After that, we'll tell you about our latest announcements, which
is a deep integration of Cloud Armor
and reCAPTCHA Enterprise at the edge of Google's network.
And finally, we will do a deep dive on ATB Financial's use
case for and perspective on partnering
with Google to protect their mission-critical applications.
Web App and API Protection, or WAAP for short,
has emerged as a solution space in response
to increasingly complex and diversified application
architectures and delivery pipelines,
as well as to defend against an evolving threat landscape that
is growing increasingly sophisticated with convergence
and attack types and intents at the application level.
Google's WAAP offering provides comprehensive protection
for your applications and APIs from DDoS attacks,
bot-related threats, as well as application security
vulnerabilities, whether they are deployed on Google Cloud,
on your premises, or with another infrastructure
provider.
The development, composition, and deployment location
of web apps have fundamentally changed
in the modern enterprise.
The shift to microservices-based architectures
has helped facilitate this transition
and created more flexibility relative to location,
to ensure resources are hosted wherever
the needs of the application or business dictate.
At the same time, the threat landscape web application space
is more varied and dynamic than ever.
Attackers still seek to exploit traditional application
vulnerabilities through code and availability-based attacks,
while also expanding their methods
to target the connective tissue of modern web applications,
APIs.
Unfortunately, the sprawl of these endpoints
can make it difficult to maintain the proper security
controls.
Misconfigurations or identity controls and limited visibility
can be exploited by attackers to improperly escalate privileges,
access sensitive data, or launch fraudulent account takeover
attacks via insecure APIs.
What we are seeing is customers have taken a siloed approach
to protection by purchasing point solutions
for different types of attacks.
These might also be managed by different teams
and not work well together.
This can lead to gaps in protection
and increased acquisition and operation costs.
Google is uniquely positioned to provide
the same breadth of protection by leveraging three
of our existing products--
Cloud Armor for DDoS and web app defense, reCAPTCHA Enterprise
for bot defense, and Apigee Hybrid for API defense.
Cloud Armor, deployed at the edge of Google's network,
is built using the same infrastructure, both hardware
and software, that we originally developed
to protect Google services like Search, Maps, and Workspace.
We're flexible, providing options
to integrate with our customers' existing security
tooling in Google Cloud, on prem,
and in multicloud infrastructures.
With Google's WAAP solution, customers
are able to have a single vendor that
provides support and protection against modern internet threats
with products that work well together.
Cloud Armor is Google Cloud's data protection service
and web application firewall.
It provides global scale defense against volumetric, protocol,
and application-level attacks, offering the same protection
for hybrid and multicloud workloads
as it does for ones deployed on GCP.
And it's built using the same technology and infrastructure
that we originally developed to protect our own billion user
properties, such as Search, Gmail, and Maps.
Cloud Armor reflects our vision of bringing
to bear Google's global scale to protecting workloads wherever
they are deployed.
All of our edge infrastructure, including Cloud Armor,
load balancing, and CDM, can be deployed
in front of your websites or services,
whether you are running in Google Cloud,
on prem, or with another provider.
With Cloud Armor, customers are able to protect
their applications from DDoS attacks,
filter incoming requests by geography or most L7
parameters, like request headers or cookies.
Moreover, as a web application firewall
Cloud Armor contains pre-configured WAF rules
to prevent against most common attacks
and vulnerability exploit attempts.
Users have access to real-time telemetry
containing Cloud Armor's decisions
on a per-request basis, as well as a monitoring dashboard that
gives granular views of allowed traffic and denied.
reCAPTCHA Enterprise is our fraud and bot protection
product.
Based on technology that has helped defend websites
for over a decade from bots, reCAPTCHA Enterprise
allows you to leverage the insight and intelligence
derived from protecting millions of sites on the web.
reCAPTCHA Enterprise offers unique capabilities
built specifically for the enterprise
to protect from bots and fraud.
Security teams benefit from enhanced detection
such as extra granular scores, reason codes,
for high-risk scores, and the ability
to tune the risk analysis engine to your site's specific needs.
In addition to the puzzles or manual challenges
that you may be familiar with, it also
supports a frictionless experience
that doesn't disturb your end user
through client-side instrumentation
in the form of drop-in JavaScript
libraries or a mobile SDK.
And then the system provides risk scores allowing
for progressive action.
For example, depending on the risk score,
an incoming request can trigger a requirement
for a second factor, be outright blocked or redirected,
or ultimately allowed through.
As with our other solutions, it provides rich telemetry
around interactions, scores, and actions.
Apigee is our API platform that provides
a single point of management for APIs
through the entire lifecycle from both the development
and operations perspective.
The platform inspects API requests
to protect, scale, adapt, control,
and monitor API traffic.
Apigee's out-of-the-box policies enable developers to augment
APIs with features to control traffic, enhance performance,
and enforce security without requiring them to write any
code or modify any backend services.
Building security around an API takes
time and significant expertise.
But Apigee can provide this to any API in minutes.
Security policies let developers control access to APIs
with OAuth, API key validation, and other threat protection
capabilities.
API-- Apigee provides for a positive security model,
understanding the structures of API requests
so it can more accurately determine
valid and invalid requests.
As part of the overall WAAP solution,
we're proud to announce the preview release of Cloud Armor
bot management with a deep integration with reCAPTCHA
Enterprise.
While customers can already use these products together,
we wanted to simplify the deployment process
and provide a more integrated and scalable experience.
reCAPTCHA Enterprise provides a world-class bot detection
mechanism developed and continuously
learning from a globally distributed
multi-million website install base.
With this deep Integration, Cloud Armor users
can now leverage reCAPTCHA to detect and block
bot traffic within their Cloud Armor security policies.
All of this occurs at the edge of Google's network far
upstream of your protected workloads,
allowing us to leverage the global scale of our network
to mitigate bot threats without impacting the performance
of your applications.
Critically, with the integrated solution
Cloud Armor and reCAPTCHA Enterprise
can protect customer applications
without requiring server-side changes on the application
to decipher and enforce bot assessments.
In addition to the reCAPTCHA Integration,
Cloud Armor bot management introduces an enhanced set
of capabilities designed to help you deploy an effective bot
management strategy.
These capabilities include additional rule actions
to redirect traffic, as well as the ability
to insert a custom header into suspicious requests
but otherwise allowing to reach your workload.
Customers use this custom header to tag suspicious traffic
for alternative processing in their workloads,
like sending to a honeypot or not
completing a fraudulent transaction without notifying
the bot that it was detected.
Diving deeper into these potential use
cases of the new integrated solution,
we are introducing two distinct flows.
You can configure Cloud Armor security policies
in several ways to leverage this integration.
First, with the Redirect to reCAPTCHA action,
you can now configure a Cloud Armor security policy
to conditionally serve the reCAPTCHA challenge,
forcing suspicious end users to solve the puzzle
before being allowed through.
Additionally, you can leverage reCAPTCHA v3
for frictionless, headless bot detection
by instrumenting your client-side applications
with the reCAPTCHA library for silent and accurate bot
assessments.
You can then configure a rule within your Cloud Armor policy
to decipher and enforce the reCAPTCHA assessment
all at the edge.
Both of these operating models are deployed and enforced
far upstream of your applications
without requiring server-side changes
to ease deployment and accelerate your ability
to protect yourself.
Finally, both of these use cases can
be combined inline to provide what we call the Redemption
Flow, which gives a suspicious client the opportunity
to redeem themselves before being blocked by Cloud Armor.
In this case, a single Cloud Armor rule
is created that first checks whether the silent reCAPTCHA
assessment has determined that the incoming request is
coming from a malicious bot.
If not, the request is allowed through.
If, however, reCAPTCHA's determination
is that the client is suspicious or of high risk of being a bot,
then the client is given the opportunity at redemption
by being redirected to the reCAPTCHA puzzle.
The end user can solve the manual puzzle
to be permitted through the Cloud Armor security policy
and allowed to reach the protected applications.
This is a highly anticipated use case
that many enterprises have requested
to ensure that human clients aren't unnecessarily
blocked from accessing the application while filtering out
bot traffic.
With that, I'm going to hand it off
to Mos, who will tell us about ATB Financial's philosophy
on protecting their assets, and how they deployed WAAP,
including Cloud Armor bot management,
to meet their security and compliance needs.
MOS SALEH: Thank you, Emil.
I'm going to talk about a brief overview of ATB Financial,
then move on to ATB's cyber security journey in the cloud,
and finally summarize just a few takeaways that
may be useful to you as embarking
on similar activities.
I will start with a brief history of ATB Financial.
the is a financial services institution
who has been in business for over 80 years.
In the time, they have grown and changed
from one small treasury branch to become the largest
Alberta-based financial institutions with assets
of more than $55 billion.
At ATB, technology is unequivocally
a strategic partner and enabler.
It underpins and fuels our client-centric products
and services.
But we also have a broader responsibility and role
to play across Alberta.
We are going to help build the technologies that Alberta
wants and needs for a diverse and future-ready workforce.
As part of our client-centric attitude and mandate
to transform banking, ATB has launched
both transformative initiatives powered
by Google for our purposes that we
exist to make it possible, that is, to support the lives
and livelihoods of our clients.
On the [INAUDIBLE] of this partnership,
Google remains a key player in enabling our future technology
strategy.
Our vision is the cloud is ATB's secure, reliable,
and cost-effective platform for critical, high-value
applications and workloads.
As an example, at ATB all GCP application development
is containerized and running in Google Kubernetes
Engine, and other cloud-native services as well.
ATB's data enablement platform is centralized
around Google BigQuery, augmented
by Google's data services such as Dataflow, clustering,
and composer.
Additionally, ATB leverages GCP to support our migration
from on-premise to the cloud.
Clearly, Google is a key player in enabling
our future technology strategy, which
is anchored in our 10-year strategy
and informed by client and team member journeys.
Our cloud cybersecurity strategy undertakes
to proactively address both current and future cyber
threats and mitigations.
All of our businesses strategies are
focused on shifting our services and service models
to put our client at the center of everything we do,
and to take ownership of delivering
truly remarkable experiences that set us apart.
Specifically within the financial sector,
moving to the Cloud comes with the fundamental question
of how effectively manage security and risk posture,
and eliminate many of the challenges experienced
on premise.
From a security strategy perspective,
there are few core requirements that you
would need to effectively secure and manage risk in the cloud.
As we have looked at security operations
in different environments, we have
recognized there are some things we absolutely need.
As an example, the four big ones that are
essential for our teams are.
As a bank, we are under constant threats from adversaries.
At the same time, we must innovate
to stay ahead in the business.
We must also empower our teams to develop applications
and APIs within a safe and secure environment
and rapidly make safe impactful code changes.
We are required to have enhanced reliability
and security and velocity across all cloud
workloads, and finally, advanced governance and control
alignment via policy as code.
These requirements and needs tend to be opposite.
Either you are secure, or you are dynamic and agile.
And if you have worked with development and security teams,
you know how challenging it could
be to balance or achieve both with no compromises
on either side.
And this was a challenge for us for a while.
For example, we heavily rely on immigration,
which requires ephemeral infrastructure and workload.
And that's because if you don't innovate,
you'll be beaten by other competitors.
As a bank, we are dealing with the most
incredible adversaries, the humans and bots.
We are dealing with the most incredible opponent,
the human being.
They will innovate, they will find a way around,
they have motivation, mass, scale, specialized tools
and approaches.
They have adversaries-- adversarial tactics,
techniques, and common knowledge.
Adversaries are always innovating
to find any weakness in defenses.
And we know the traditional tooling and approaches
can barely keep up.
What we've got to do is we have to actually stop these attacks,
more effectively, sooner, more completely,
with less false positives.
It's all about efficiency.
But efficiency and simplicity of deployment for us is how fast
and easy we can embed defense solutions in our ingress paths
for our web pages and our RESTful APIs.
I'm going to show you how easy it is to uncover and defend
trace targeting of resources using solutions powered
by Google's unique [INAUDIBLE] intelligence
and detect external threats, malicious activities,
and unauthorized behavior targeting your assets.
As I mentioned earlier, we have to actually stop
these attackers in their tracks.
We need a solution that is easy to deploy, frictionless,
and effective.
And it has to scale.
It has to be delivered as a service via infrastructure
as code.
Nobody wants to be managing the security infrastructure
across hundreds of projects.
And it can handle both bots and humans.
OK.
So what we did is we created a defense arsenal
by orchestrated risk score token exchange between Cloud
Armor and reCAPTCHA Enterprise and Apigee
to create a WAAP solution for web pages and API Protection.
Just like the name says, it protects our web pages and APIs
from false posts, account takeovers, credential stuffing,
layer 7 DDoS attacks.
And it provides OWASP Top 10 for web pages and APIs,
such as SQL injection detection and cross-site scripting.
And this solution is backed by complementary intelligence
and AI.
We have tested this solution on our sandbox environment,
and we have seen how simple and effective it is.
To summarize, there are three takeaways.
The WAAP solution is a comprehensive anti-fraud
solution that helps to defend business-to-client services
from bots, fraud, and abuse.
It has no complexities in implementation and operation,
and the deployment can be done fully via infrastructure
as code.
It is easy to embed in ingress paths
and cost effective and simple to deploy.
Thank you for your time today and for allowing
me to share a bit about ATB's cloud cybersecurity journey.
Stay safe.
EMIL KINER: Thanks, Mos.
It's an honor to be able to work with you and ATB Financial
to help you accomplish your application protection
objectives on Google Cloud.
To sum up, the need for application and fraud
prevention is growing more acute in the face
of increasing application complexity and an evolving
threat landscape.
Google Cloud's WAAP solution spans DDoS, WAF, bot,
and fraud, as well as API Protection,
offering a cohesive and integrated experience
leveraging the technology, hardware, and software we
developed to protect Google's own billion user properties,
as well as millions of external websites.
To learn more, please visit the WAAP website linked here,
or tune into the additional breakout sessions
to learn more about network security, Cloud Armor,
as well as Apigee.
Thank you for joining us today.
Don't hesitate to reach out to learn more.