[MUSIC PLAYING]
CASSIE KOZYRKOV: Hello, and welcome to the Security
Zone at Google Next.
We're here with Andy, a leading expert at Google
in security operations and monitoring.
Thanks for joining us, Andy.
ANDY CHANG: Thank you.
It's great to be here.
CASSIE KOZYRKOV: So we've all seen
that security attacks are a big challenge for companies today.
If I'm running a security operations and monitoring team
and I'm responsible for managing these threats,
this is going to be an increasingly difficult job
for me, right?
ANDY CHANG: That's exactly right.
Security and operations monitoring teams
always have new threats to worry about,
so they have to constantly be improving
how these threats are identified and how they're remediated.
So let's take a look at a few of the common scenarios
that a security operations and monitoring
team needs to be able to understand and remediate.
CASSIE KOZYRKOV: Great.
ANDY CHANG: The first scenario we're going to look at
is these threats from your employees.
So let's take a look at an example.
Let's say one of your employees is about to leave the company
and kickstart their new job.
They've decided to share sensitive information
from their corporate account to their personal account.
CASSIE KOZYRKOV: Oh, dear.
And that is a problem.
ANDY CHANG: Absolutely.
This would result in potentially sensitive files
being leaked to the public or to competitors.
CASSIE KOZYRKOV: So how can my team identify and remediate
an attack like this?
ANDY CHANG: Well let's take a look
at a view from our security operations and monitoring team.
Here we see G Suite Security Center
that has seen a huge spike in the external file sharing.
So now your team knows that there is something suspicious
going on, and they need to do some further investigation.
There are hundreds of employees sharing files
all over the company.
One of the first things you need to do
is identify which one is causing the huge spike
in external sharing.
CASSIE KOZYRKOV: So we need to figure out who
is sharing all of this data.
ANDY CHANG: Right.
So if we go back to the G Suite Security Center
and open up that report, here you
can see that one employee, Julie, has by far the most
sharing activity.
The first thing we want to do, then,
is to understand what she's sharing,
and if these shouldn't be shared outside the organization.
And if so, then cut off Julie's access
to these files from her personal account immediately.
So again, back to the Security Center.
We can go open Julie's file sharing details
and see all the files she has enabled access to
from her personal account.
We can switch off all of her access to these files.
CASSIE KOZYRKOV: Wow.
That was fast.
So if Julie is trying to access or download these files right
now, she won't be able to because her access has
been revoked.
ANDY CHANG: Exactly.
The immediate threat now has been stopped,
but we need to go one step further and prevent these leaks
from happening again.
We can choose to prevent individual users, groups
of users, or the whole organization
from sharing sensitive files externally like this again.
CASSIE KOZYRKOV: Got it.
So there may be a subset of users at the company
that we want to stop from leaking files like this.
ANDY CHANG: Yes, that's right.
If we took a look again at G Suite Security
Center and the Security Health screen,
we can see that there's a recommendation
to remove drive external sharing access to employees.
I can easily go in and turn that off.
And now we've remediated the situation
for the whole organization.
CASSIE KOZYRKOV: Wow, so we were able to quickly identify
the threat, remediate it, and then we
adapted security controls to prevent it
from ever happening again.
ANDY CHANG: Right.
So as a security and operations team,
tools like G Suite Security Center
can give you the ability to quickly identify, remediate,
and prevent these types of employee insider attacks.
So that's how your team can protect against employee
insider attacks, but another potential threat
you may need to be concerned about
is possible data access from your cloud provider's
employees.
And to address that concern, Google
has introduced access transparency, which
is unique to Google Cloud Platform
and provides an audit trail of actions taken by Google support
and engineering, where they interact with your data
and the system configurations on Google Cloud.
So let's walk through a scenario that shows off
access transparency.
So say that one of your employees
is having problems accessing some of the files
and needs to call Google support.
Once that employee is speaking to a Google support agent,
the employee walks through the problem,
and to fix the problem, the Google support agent
needs to access some of the customer's system settings.
CASSIE KOZYRKOV: So at this point,
an employee at our cloud provider,
Google, needs access to some of the system data
to diagnose the problem?
ANDY CHANG: Right.
So as a security operations and monitoring team,
you want to be aware of how the cloud provider's
employees access your systems.
So let's take a look at the Google support agent's view.
To diagnose the problem, the support agent
needs to access a particular system,
but before they can get that access,
they must enter a justification for the additional access.
Before they can access any of the systems data,
they need to log this request detailing
why they need the access.
So now the Google support agent is
able to access a limited set of your system settings
in order to diagnose the employee's problem.
The support agent is then able to help your employee solve
the problem.
So on the Google Cloud Platform, let's take a look
at the Security Command Center.
We can see that the support agent's access request
has been logged after they've entered it.
If we open up that record, you team
now has transparency into how the cloud provider's employees,
like the support agent, are accessing your systems.
Here we can see accesses to the systems,
when, what they accessed, and the support agent's
justification for the access requests.
So now your team can monitor this access,
help ensure that your cloud provider's employees are
interacting with your data and systems appropriately.
So that's two examples of insider threats, first
from your own employees and second from the cloud
providers employees.
Another common scenario your team has to worry about
is external threats.
Let's say you have systems with varying levels of data
sensitivity.
In Google Cloud Platform, we enable
you to programmatically classify the data in your system using
our DLP API.
By understanding the level of the sensitive data
within each project, we're able to proactively assess
our attack surface and potential blast radius.
Now let's say an attacker was able to attack your systems
and compromise one of your machines.
CASSIE KOZYRKOV: So this is an external attacker
who has made a targeted attack against one of our systems?
ANDY CHANG: Right.
So now that this machine has been compromised,
your team needs to identify this problem,
and based on the blast radius of the attack,
understand the impact of the incident.
In the Cloud Security Command Center,
you can see how we surface anomalies
that have been detected, and identify the compromised
machine.
Using machine learning, Google Cloud
is able to identify unique patterns across systems
and can trigger detections for your team in the Cloud Security
Command Center.
And you can drill down here and see the details
of the compromised machine.
Now the attacker's access to the compromised system
can be shut off, and the blast radius impact
can be determined by calculating the sensitive data compromised
across the effected machines.
With the Google Cloud Security Command Center,
your team can quickly identify and remediate
these external attacks on your systems
and calculate the impact of the attack.
So that's how your team can protect against insider
threats and external threats.
But another challenge that security teams
have to worry about is how they can
integrate different security tools across the company.
Most security teams are using a lot
of different tools for things like advanced threat
and endpoint security, advanced network security, DDoS
and firewall protection, and configuration security
and compliance.
CASSIE KOZYRKOV: So if our team is managing
a whole group of security tools, we
need to make sure that they're all talking to each other.
ANDY CHANG: Right.
Otherwise your team might miss some security threats
because security threats are being managed
in too many systems and places that don't communicate
with each other.
Google Cloud partners with many of the top security companies
in the world to make it easy to integrate
their solutions in the Cloud Security Command Center.
For example, one partner that Google Cloud partners
with for advanced threat protection and endpoint
security is CrowdStrike.
CrowdStrike provides advanced malware detection
and advanced endpoint protection capabilities
to help your team identify threats fast.
In the Cloud Security Command Center,
CrowdStrike data can be exposed as a new card
so your security team can easily see these threats and actions
on them from one place.
CASSIE KOZYRKOV: So if there's an error detected
in CrowdStrike, our team can see it in the Cloud Security
Command Center?
ANDY CHANG: Right.
And clicking into the card takes you
straight into the Cloud Security Command Center's Findings
Inventory page, pre-filtered for just the CrowdStrike results.
This is where we surface key properties of the findings that
were provided by CrowdStrike.
Your team can then explore the finding
by clicking into its detail page,
and if your team wants to investigate in more depth,
they can click on the link back to the CrowdStrike console.
Google partners closely with top security partners
to make integration between these tools and the Cloud
Security Command Center easy, and enables your team to unify,
index, and search across all your finding sources.
Here we can add new cards to connect with partners like Palo
Alto Networks, like CrowdStrike, like Cloudflare, like RedLock,
to help you have a holistic view of your attack
surface and your security.
CASSIE KOZYRKOV: So now my team can identify and action threats
for all these applications using just Cloud Security Command
Center?
ANDY CHANG: Right.
So your team can now get the most out of all your security
tools, manage them all in one place.
Google Cloud has a growing ecosystem of security partners
that we are working closely with to make sure
that our customers have access to the best tools,
and quickly identify and remediate actions.
CASSIE KOZYRKOV: So with Google Cloud,
I can manage insider threats, cloud provider threats,
external threats, and I can integrate it
into the rest of my security tools, right?
ANDY CHANG: Right.
With Google Cloud and the Security Command Center,
your team can manage these threats
and work to constantly improve security controls
as these attacks get more sophisticated.
CASSIE KOZYRKOV: Andy, thanks so much for walking me
through how to manage a modern security operations
and monitoring team.
ANDY CHANG: I'm happy to do it, and thanks for your time.
[MUSIC PLAYING]