VARSHA DATTA: Hey, Everyone.
My name is Varsha Datta, and I'm a security and compliance
specialist with Google Cloud.
And today I would like to talk to you
about some of our newest products
at Google reCAPTCHA Enterprise.
Before we go into Google's reCAPTCHA Enterprise product,
let's talk a little bit about what a CAPTCHA is
and what it does.
A CAPTCHA as an acronym for completely automated
public Turing test to tell computers and humans apart.
It's a type of challenge response test used in computing
to determine whether a user is a human or not.
Fairly straightforward, right?
Not really.
There are a lot of nuances that go into identifying
a real user versus a bot, and reCAPTCHA Enterprise
is a complete solution just build to do that
and do this very well.
Let's talk a little bit about some of these evolving threats
that we've seen in the industry.
Users are constantly under attack
from credential stuffing, account takeovers,
and fraud all the time.
And it's really unique compared to protecting our own employees
within the company, because we have
less control over the environment
that our users are in.
But they are as important to our business.
We've seen that, in 2018 alone, there
were about 20 billion attempted logins with stolen credentials,
and 29% of those breaches involved those stolen
credentials.
And an estimated 8% of revenue for many online businesses
is lost to fraud every year.
The problem is in the defense of these systems,
especially when you go all the way to the users' computers,
because it requires a lot of data and ability
to protect at the client level in an environment
that you do not control.
As you can imagine, Google has a lot
of experience in dealing with fraudulent activities
on our platform.
We have over 1 billion users each
across all of these nine different products,
and we only learn how to better protect our users from fraud
over the last few years.
Just for some background, here at Google
we've been protecting our own systems
with two spectacular technologies
over the last decade.
The first is reCAPTCHA, which defends more than 2 million
websites from fraudulent bots.
And the second one is Safe Browsing technology,
which defends over 3 billion devices
from phishing and malware.
Let's take a look at these products in detail.
Some of the more common types of fraudulent attacks
we see are account takeovers, synthetic accounts,
false posts, fraudulent transactions, and money
laundering. reCAPTCHA Enterprise is
built upon the existing reCAPTCHA platform
that most of us are familiar with.
The goal of reCAPTCHA Enterprise is
to defend against these various threats, including,
but not limited to scraping, fraud, and account takeovers.
Now, we want to make it very difficult for those attackers
to gain access to your business to consumer services
and use them for malicious purposes.
Most importantly, reCAPTCHA Enterprise--
with reCAPTCHA enterprise, we can
do this while providing a frictionless experience
to your users and customers.
The product acts as a barrier that
is placed in front of your web applications,
where actions can be taken to stop bots and fraudulent
activities from allow--
and while still allowing your users in.
Now, let's look at the evolution of Google's reCAPTCHA
over the years.
It got started with this squiggly bit of text
that you're trying to read and enter.
And ask bots got better, our defenses had to evolve.
And that's why you see these click boxes and crosswalks
where the challenges have become a little bit more complex.
And a lot of users actually have trouble solving these,
and it's not the best user experience either.
Not only do we face threats from AI,
but we also face threats from farming.
A large number of groups of people
are solving these challenges for fraudsters,
and now it comes down to actually distinguishing
the transactions from fraudulent versus
non-fraudulent transactions, and not just humans to bots.
The latest version of reCAPTCHA Enterprise
is essentially a piece of JavaScript
that interacts with the user and gives you a risk score
to identify whether the transaction or the user
interaction was alleged to make one or not.
So this means no text boxes and no crosswalks,
and just a snippet of JavaScript that
sits within your HTML pages.
And there is no user interaction required for the JavaScript
to start working, which means no friction from having
to actually solve the challenge.
It's also based on the user's behavioral analysis
on your backside, rather than relying on just one form
of signage on your webpage.
So let's take a closer look at what's included
within reCAPTCHA Enterprise.
Now, if you're familiar with reCAPTCHA v3,
the Enterprise version includes a lot of--
all of v3 and a lot more.
So it includes an enhanced risk score
based mechanism which is based on machine learning,
and is also more specific to your web site
than just generating bots.
We also provide risk codes or reason codes
that allow you to better understand
why we are detecting a certain behavior as a bot or not.
Now, as a customer, you also have the ability
to use the annotation API to provide us feedback
whether or not a certain risk score
that we provided was a false positive
versus a false negative.
Now, remember that not all bots are good or bad.
It really comes down to understanding your user
behaviors and understanding what your business needs are.
Now, with reCAPTCHA Enterprise, we also
have mobile support with mobile SDKs for Android and iOS.
We also have a new password leak detection mechanism
that's in early access.
We also have a two-factor authentication
that can be implemented for potential fraudsters
to further assert their identity on your website.
And finally, since we are on the Google Cloud platform,
we provide SLA and SLO, and also the standard GCP terms.
Now, since reCAPTCHA Enterprise actually
looks at the user behavior, and how
they interact with the page and synchronously
in the background, the reCAPTCHA servers
formulate a risk score based on the anomalies
that we have found on the website.
Now, with the Enterprise version,
we are able to provide more granularity in these risk
scores that range between 0 to 1--
0 being a bad actor, and 1 being a good actor.
Now, some bots actually have a bit of a gray area
that we need to provide more details about.
And that's why the enterprise version actually provides you
a 10 point score, which allows our customers to take more
precise decisions on their website
and how they want to apply these protections on their website.
Now, as an example, you almost always
want to have a different level of protection and security
around your high value pages like log
in or check out, rather than a homepage.
Now, let's take a closer look at some of these risk identifiers
or reason codes.
We're working on adding more and more of these reason
codes every day, but here are a few of them.
Now, when a risk score is returned
that matches any behaviors in this list and more,
we are providing additional context
in the form of reason codes that can assist you
in tuning your responses to your users and identifying trends.
Now let's do a high level overview
of how all of these parts work together.
The page or the pages are actually
embedded with the reCAPTCHA Enterprise.
Now you can either have it on one single page
of your website, or it could be across all
of your different pages on the website.
The JavaScript will gather the necessary data required
to process the risk score.
And then that data is passed along as a tokenized element
and encrypted to the end user.
The predicted web application will then receive that token
when the user actually interacts with the website,
and then passes that token along over to the reCAPTCHA
Enterprise server.
And then once the reCAPTCHA Enterprise server
is able to collect all of the parameters,
and analyze it, and provide a risk score,
it actually sends that risk score back
to your infrastructure.
Now, based on the score, you can actually
make a decision whether or not you want
to allow your user to continue.
And the good news for current v3 users
is that the implementation is quite similar across reCAPTCHA
Enterprise and reCAPTCHA v3.
So if you're already a v3 user, the transition
is pretty much just aligned to point to a reCAPTCHA Enterprise
endpoint.
So now that we have a risk score, what kind of action
do we take?
If a high risk score is returned,
it's more likely that it's a real user.
And there's-- you wouldn't want to allow them to continue
their journey on your website.
Now, if it's a low risk score, depending on the recent code,
you might want to take either a few types of actions.
You might want to either reject that user entirely and block
them on your website, or you might
want to provide a further challenge,
like a two-factor authentication,
to allow that user to further assert their identity.
Either way, you would want to log
all of these actions for further analysis.
Now let's look at some success stories
around reCAPTCHA Enterprise.
Spotify was one of our earlier adopters
of reCAPTCHA Enterprise.
We all know Spotify, and we love it.
They were disruptors in the media industry
and transformed how we listen to music.
Some of the challenges that Spotify was facing
included detection of bot traffic
and threats such as credential stuffing,
and abuse on Spotify's website and apps.
With reCAPTCHA Enterprise, they were not
enable to effectively detect bot traffic,
but also protect and defend against threats
coming from these bots.
Another one-- another great example is Empower Illinois.
Empower Illinois is a state-wide scholarship
granting organization that was created in 2017 to serve
children of Illinois through the state's tax credit scholarship
program.
Now, some of the challenges that they were facing
was fraudulent applications of machines and credential
stuffing attacks by bots.
With reCAPTCHA Enterprise, they were
able to accurately detect bots, and also
create a safe passage for legitimate users,
and minimize the user friction on their website.
Now let's take a look at Web Risk API.
Web Risk API is a Google Cloud Service
that allows customer web applications to check URLs
against Google's constantly updated list of unsafe web
resources.
Web Risk API helps defend against phishing
links, malware links, spam links,
amongst other malicious URLs.
It acts as a barrier between fraudsters and customer website
applications, protecting them from malicious URLs being
posted on their website.
Let's take a closer look at Web Risk API.
We all know that URLs contain unsafe elements like phishing,
malware, and unwanted software.
And it's often impossible to find this before our users do.
That's why we have Web Risk API, a new offering from GCP that
enables any company to find unsafe URLs on their website.
Now, Web Risk includes data on more than a million unsafe URLs
and users--
and uses Google's Safe Browsing technology
to defend against malicious URLs.
Now let's take a look at how web risk API actually works.
Assume that attackers are trying to exploit the ACME
reviews by posting unsafe links onto an even submission feature
page.
To defend their users and the site
against these kind of attacks, ACME
decides to use the Web Risk API to filter all incoming calls
for unsafe content.
ACME needs to essentially extract
those URLs from the post and send them
to Web Risk API, where--
and Web Risk API will be able to identify
whether a URL is unsafe or not.
Then depending on the decision that Web Risk API makes,
ACME can then decide to either post or not
post those URLs on their website.
Now let's look into some of these threat categories.
Web Risk API also provides information
on why a certain URL was deemed malicious
based on some of the mentioned threat types on the screen
here.
Now, this allows customers to take a more educated decision
on whether or not to block these malicious URLs.
Now here's a remediation response.
For example, let's take a look at the sample workflow
for Web Risk API.
Once the API returns the result, if the URL is not
a malicious one, our customers can
choose to allow the link to be then utilized on their website.
But if the URL is malicious, their customer then--
the customer can either decide to block the access
to the website entirely by using something like a web proxy,
or flag the post as a malicious pose,
or even block the post entirely from being
submitted on the website.
Either way, logging these activities
is always a good practice to allow scope
for future analysis.
Now that you've heard all the awesomeness
about reCAPTCHA Enterprise and Web Risk API,
it's time to take action.
If you're facing any issues regarding
your fraudulent activities on the website,
we can help you with it.
Please reach out at cloud.google.com
/recaptchaenterprise and cloud.google.com/webrisk.
And get in touch with our sales and technical teams
to help protect your website.
Thank you for tuning in today.