[MUSIC PLAYING]
CHRIS CORDE: Hi, everyone.
Welcome to Next.
I am Chris Corde.
I'm the director of product for security operations
here at Google Cloud.
I'm here to talk to you about transforming your security
operations and incident response portfolio with Google
and Mandiant.
So, obviously, we recently welcomed Mandiant
into the family, and I think it allows us together,
with the Chronicle platform, to really do
some major differentiating things.
And I'm here to give you a little bit
of deep dive in how those things are going to come together.
So the first thing I wanted to talk about
is just set the stage a little bit with really
what we're seeing as the perfect cybersecurity storm
for a lot of our customers.
And a lot of this is exacerbated just
by these three trends that are just continuing to grow.
And the first is just the threat landscape,
the increasing threat actor landscape.
So back 12 years ago, when I worked at RSA Security,
we were subjected to, really, one of the first nation state
attacks of its kind when an attacker attempted
and was successful in getting access to the security
token seeds.
And they did this to get access, really,
to US critical infrastructure.
They were looking to steal a set of IP from the US government
and feeling that they can get access
to the token seeds was a good way of doing that.
So that was an example of a pretty sophisticated nation
state attack.
Unfortunately, these nation state attackers
have only increased their purview
on what they're willing to attack and, in many cases,
have pivoted to not just looking at IP-based threat and attacks
and going after only very sophisticated customers,
like government, but instead have really expanded
into things like e-crime, things like ransomware,
or other activity like that.
And that's just expanded the addressable surface
of organizations that they're willing and able to attack.
So we've seen attacks on areas like health care,
areas like education, and a lot of that's
just financially motivated e-crime-level attacks,
and you've seen a lot of that in the news through things
like ransomware.
So what that really does is it just, unfortunately, makes
every organization potentially susceptible to not
just an attacker but in some cases
a very sophisticated attacker because you're dealing
with nation state attackers who are well funded,
who have a large degree of expertise,
and, quite frankly, just have a lot of experience in what works
in attacking organizations.
So that's just, unfortunately, really exacerbating
what customers have to deal with and have to defend.
But on top of that, you're dealing
with rising complexity in your own IT infrastructure,
just things like movement into Cloud,
things like work from home all create an expansive attack
surface that creates an increasing complexity.
The more that you can control your attack surface
and keep it a relatively hardened, small, narrow set
of things you have to protect, the easier it is.
But unfortunately, that's just not reality
in today's environment.
And it's just going to increasingly get worse.
So when you combine that with the notion
of increased attacker activity and then,
unfortunately, layer in the thing on the bottom, which
is the cybersecurity skill set gap,
things just start to really spiral out of control.
So it would be bad enough if these only top two trends
were the things you had to deal with,
but even when you want to go out and transform your own security
portfolio or your own security team internally,
if you can't get access to the best people--
just because they're not enough of them--
it just creates and makes things even worse.
So you really have to start putting onus and emphasis
on your vendors to help you through this to, number
one, bring a level of expertise to the equation, but also
to help you through things like a skillset gap.
And that's where we think a lot of what Mandiant helps bring
to the table and can really help our customers
through these increasing trends because it just
allows them to deal with things both on the product side
and on the people side.
So we start by just having what we're
layering in together inside of Google
as really the best security operations
platform in the industry.
And it's a combination of these four things.
So we've started with Google Chronicle SIEM, which
we'll talk about some more, but it's really
a cloud-native SIEM that specializes in handling data
at scale and allowing access to searching and managing
that data in, really, at Google speeds.
But then recently, in December of last year,
we acquired Siemplify SOAR, which is Security Orchestration
And Response.
And what that has allowed us to do
is just create and deliver that last mile of security
operations workflow to help our customers do things like case
management and orchestration and response at scale
on top of what we're delivering with Chronicle.
So here at Google Next, we announced the security
operations portfolio.
We've integrated in SIEM and SOAR
into one Chronicle platform.
And we're super excited about how
those things will come together and work in the future.
But then we also layer in, really,
world-class threat intelligence from our internal team, which
is our Google Cloud Threat intel team,
as well as the VirusTotal team.
And in both of those cases, we're
dealing with signal that we can gather
through billions of entries and billions of users
that we protect.
So on the Google side, we have frontline intelligence
that we're gathering through the billions of users
that we manage and maintain and protect on a daily basis.
And with VirusTotal, it's the world's
preeminent malware and URL reputation database,
and it has, I think, over 2.4 billion entries
inside the VT database now.
So you're just dealing with a pretty wide set
of threat intelligence that we can layer into the platform.
And then as we pull Mandiant in, it just
takes all of this to the next level.
So Mandiant has over 800 security and intelligence
analysts that are operating in the trenches
on the front lines of security incidents every single day.
So they're the world's leading incident response provider.
The first person that we called when
we were subjected to the RSA breach years ago was Mandiant.
So just that capability alone helps
expand what we're able to do inside of Google
to the next level.
But then on top of that, Mandiant
helps bring a lot of products into the equation that really
are built off of the expertise that they're
able to deliver through their incident response services.
So take, for example, security validation.
That actually allows customers to go
through a set of testing to validate that their security
controls are working as designed.
And obviously, the more you know about the threat actors
and the more you know about what threat actors are
willing to do, the better off you
are in validating that your controls will protect
against those types of attacks.
So it's really the combination of this world-class incident
response team as well as a set of products
that Mandiant integrates in, combined
with the Google security operations
portfolio with Chronicle.
As these two things come together,
we think it creates a super powerful combination
to really help our customers at all layers in the stack
and, ultimately, even help them in situations where they don't
have the people to operate their environments
in the first place.
So we think it kind of delivers all in these six
major differentiators, and I'll talk about each one of these
in depth.
But the first one is Cloud-scale data,
but it's really Cloud-scale data at your fingertips,
being able to search and manage that data
at sub-second response times.
But then it's layering in frontline intelligence,
but then providing the right automated response,
contextual awareness, and then, in worst-case scenarios,
having access to unparalleled expertise
from our internal threat experts and incident response services
that we can now deliver inside of Google and Mandiant.
So what I'll do is I'll walk through each one of these
in a little bit of depth, just to give you
a little bit of color on each one.
But then, obviously, there'll be other ways
that you can learn more as we go through at the end
of the conversation.
So the first thing is just having
access to Cloud-scale data.
So at the end of the day, security
is now a big data problem.
We're dealing with environments that
sometimes scale up to 20, 30 petabytes a year
for our customers.
And when you're dealing with that large of a data volume,
handling it with traditional tools, like on-premise SIEMs,
is just an untenable exercise.
You just cannot continue to do it anymore.
So I've talked to customers who are, in some cases, managing
hundreds of servers, over 500 servers,
in their own on-prem environments for just
their SIEM.
And when you have to do that, you're
basically using a lot of your precious people,
your precious security people, as just people managing
infrastructure at scale, instead of performing
more advanced sophisticated security workflow,
like incident response and investigation.
So the first thing that we want to be able to do with Chronicle
is just take that equation out and just
allow you to handle data at scale
in a Cloud-native platform and, really,
allow you to do it in a situation
where you don't have to filter any data coming
into the system.
You don't have to make filtering decisions either based on scale
or you don't have to make filtering decisions based
on cost.
Out of the box, we provide 12 months
of hot retention in Chronicle.
And what that means is, basically, you
can search, investigate, run rules,
run detections across 12 months of data
by default inside of Chronicle.
In most of the platforms, they're
not even coming close to 12 months of hot retention.
And a lot of endpoint detection and response platforms
are getting maybe 30 days of hot retention.
So just, obviously, the more information
that you're able to use to create context,
the better off you are in performing
investigation and detection.
So we think that's a major differentiator
in what Chronicle can bring to the table.
But then, in all of this, we do this with disruptive economics.
So because we are a Cloud provider ourselves,
because we have access to large-scale infrastructure
as a Cloud provider, we can just deliver this to you with
economics that really cannot be matched by others
in the industry, mostly because they have to build
their products on top of public Cloud systems that they have
to effectively pay market rate for.
And because of that, that cost gets eventually passed
on to customers.
So when you take all this together,
we actually, right out of the gate,
provide you with just a more scalable security data platform
to deliver and handle your job than any other vendor
in the industry.
But not only that, you want to make use of that data, right?
You can't really make use of information
unless you can actually search through it,
investigate it, and manage it.
So the one thing that Google brings to the table, is really
rooted in our legacy, is the ability
of having sub-second search and sub-second response times.
So we can search across those petabytes of information
very quickly, but then not only search on it,
but we can also provide you that information
with the right layered context and layered intelligence.
So you don't just want raw pieces of information.
You want information that tells you or gives you
some indication that you need to look at this more closely
or that it may potentially be malicious.
So take, for example, VirusTotal.
Every time we have an event in Chronicle
that either is associated with a file hash or a URL,
we layer in VirusTotal enrichment
so that you can actually see what potentially is malicious
or what has high reputation and allows
you to focus your investigations a little bit more closely.
So it's giving you this large-scale data,
but giving it to you at your fingertips
with the right level of enrichment and contextual
visualization that you need.
But then this feeds a little bit into how I actually bring
intelligence to the table.
So if it was just raw data, and just raw data at speed,
you could potentially use just a data lake for that.
You may not need a specific security product
for that problem.
So in this case, we want not just
to give you access to the data but give you access
to the data with embedded intelligence in it.
And like I was mentioning before,
when you combine VirusTotal with what we see with Google Cloud
Threat Intel, but then you layer in the Mandiant threat
intelligence-- which is really the frontline threat
actor-based intelligence--
you're effectively getting, in my opinion,
the most comprehensive set of threat intel inside
of any security product in the world.
And so we package that up, either
in the form of direct IoC feeds so
that you can overlay all of the information in Chronicle
with this threat intelligence, but we also
deliver that in the form of what we
call curated detections, which are basically
built-in detections and analytics so
that something like ransomware, for example, you just
flip a switch inside of Chronicle
and we immediately start doing ransomware detection
on your behalf.
And those detections are managed, maintained,
handled by our backend Google Cloud Threat Intel team,
so it just makes your life a lot easier
when you don't have to build a bunch of this frontline threat
intelligence and frontline detection capability yourself
and instead you can leverage that from us out of the box.
And then you can focus your people
on doing the more sophisticated or more direct
organizationally-focused detections that you
want to layer into the system.
So every time you have a detection,
any time you have a signal that you need to handle,
you need to be able to respond to that in some way, shape,
or form.
And the more signal that you have and the more information
you're trying to process, in many cases, the more
actions your people have to perform,
which, again, is not scalable.
If you're having trouble getting people into the system
and actually being part of your security operations program,
you just can't keep hiring over and over
and over again to handle more data.
So what you really need is you need some way
of automating responses.
You need some way of triaging out noise in the system.
You need some way of scaling your people.
And you can do that through things like ready playbooks.
You can do things like take repeatable use cases.
You can do things like providing automated enrichment
and automated triage.
So all of these things are really
what Siemplify brought to the table.
And actually, Siemplify, now, combined with the Mandiant
automated defense capability, allows
us to build a lot of these response playbooks
directly in from the start.
So when you take something like a ransomware attack
or a phishing attack, what Siemplify
has is a set of playbooks, a set of use cases,
that are associated with that attack.
They're either developed by Siemplify
or actually developed by the community.
And when you combine those things together,
it just allows you to handle a lot more of those events
at scale and, in many cases, get just
a higher degree of efficiency out of your existing people,
and also, quite frankly, be more responsive to threats which are
occurring in your environment.
And both of those things are quite important when
you're trying to deal with the trends
that we talked about before.
And then the fifth thing is around contextual awareness.
And I think this is one of the most overlooked areas
of security operations, which is, like, you're dealing
with a lot of these events and a lot of these signals
and you're looking for threats, and all that's good.
But if you can't put threats in context,
or you can't associate a event with how much risk
it poses to your environment, it's very hard
to make sense out of it.
So the more that you can bring context into the equation,
the better off you are.
So what Mandiant helps us do now is
with two products-- attack surface management
and with security validation.
It just allows us to deliver more contextual awareness
so that you understand what an attacker may actually
get access to.
So attack surface management allows you to really
be able to monitor assets and see things
from an attacker's perspective so that you
know which assets are exposed.
And then security validation allows
you to look at the effectiveness of your security controls
internally.
And the more that you don't have the right
controls in place to protect against the common attack
techniques that Mandiant sees on a day-to-day basis, the more
that we can tell you that you have a potentially risky setup
or risky environment.
And we can do that before you're subjected to an attack, which
is a pretty important data point when you're trying to deal
with an incident in real time.
So when you take the layered data approach
that we have with threat intelligence
and then layer in this contextual awareness,
we think it takes it to a whole other level where
you can actually extend beyond just what traditional SIEMs
would do on a day-to-day basis.
And then the last piece is just helping you
with unparalleled expertise.
So we talked about, in the beginning, an ability
to have the right people in your system.
And the reality is almost every organization
is going to lack the right resources to be able to handle
these types of things at scale.
So what we want to be able to do is give you access
to that expertise.
We want to be able to give you access to that expertise
either in a, I'll call it, a managed prevention
or manage detection scenario or potentially
give you access to that expertise
through Mandiant's world-class incident response services.
So we can do that not only when you're in an incident
but also in a proactive sense.
If you're trying to do things like transform
your own security operations, Mandiant
has a great set of consulting capability to help you do that.
And we've also driven some of this
through the Google Autonomic Security Operations framework.
But with Mandiant, now we can really transform and create
that into a programatized way.
So just a few ways to get started,
if this is interesting to you.
The first is with Mandiant Services, which I talked about.
They don't have to be incident services.
They can be advisory services.
The second could be products inside the Google Cloud
Marketplace, which now all Mandiant
products are listed there, or products like Chronicle.
And then the third is through our Autonomic Security
Operations Assessment, which, again,
is our way of helping you create a transformative security
operations journey.
So I hope this was informative and a good way of giving
additional information about what we're doing with Chronicle
and Mandiant together.
And hopefully a lot of these things
will help you secure your enterprises in the future.
Thank you.
[MUSIC PLAYING]