[MUSIC PLAYING]
CASSIE: Hello and welcome.
We're here at the security zone at Next with Christiaan,
an expert in phishing attacks at Google Cloud.
CHRISTIAAN BRAND: Hi Cassie, happy to be here.
CASSIE: So phishing attacks are a difficult problem
for security teams to solve.
And one of the most common ways that phishing attackers get
access to sensitive data is by stealing passwords, right?
CHRISTIAAN BRAND: Yeah.
Phishing attacks are getting more sophisticated every day.
And attackers are finding new ways
to trick employees into accidentally handing over
their login information.
CASSIE: So if I'm a security admin
and I'm trying to protect employees
from having their passwords stolen, where do I even start?
CHRISTIAAN BRAND: Let's walk through an example here.
A phishing attacker starts by setting up a fake website.
And that website will look exactly
like the real login page or the service
that you're trying to log into.
So the attacker would then send a link
to this phishing page to the employee.
And that employee then types their username
and their password into that phishing website.
CASSIE: So the employee has just typed their username
and password into a completely fake phishing site?
CHRISTIAAN BRAND: Exactly.
And-- but then happens is the attacker
opens up the real website and they then
replay this username and password
into that legitimate website.
What's, furthermore, is the legitimate websites then
will send a real two factor authentication prompt or a code
to the user's device.
The user, unknowingly, accepts the prompt or types
their OTP, one time password, code into the attacker's site
and, now, the attacker, not only have
your username and your password, they even
have your 2FA code that will give them access
to all of your systems.
With single sign on being so widespread,
once the attacker has access to one system,
it makes it really trivial for them to gain access
to all other systems with any sensitive data
that the employee then has access to.
CASSIE: So the employee thinks that they just securely logged
into a legitimate site where, in actual fact,
their account just got compromised?
CHRISTIAAN BRAND: Exactly.
Phishing attacks like these are getting
much more sophisticated at tricking users
into giving up their sensitive login information.
This is really a huge problem for companies today.
A recent data breach report by Verizon
estimated that 81% of account compromises
last year were due to vulnerabilities
associated with passwords.
CASSIE: Wow.
That's a lot.
So how can companies protect employees
from falling for these sophisticated stolen
password and 2FA attacks?
CHRISTIAAN BRAND: So companies can
protect employees against these types of attacks
by providing all employees with FIDO security keys
that connect to their devices.
Google just launched its own FIDO certified key
called the Titan Security Key.
It provides a phishing-resistant second factor of authentication
that prevents attackers from gaining access to systems,
even if the attacker has stolen the employee's password.
CASSIE: So how do these security keys work?
CHRISTIAAN BRAND: Well, let's take a look
at our employee again.
So this time, with the Titan Security Key,
when they open up a login page, they
will be prompted to touch the security
key connected to their device.
When they touch the key, not only
is an encrypted code sent to Google servers, which
validate that the user has access to their Titan Security
Key, but it also ensures that the user
is on a legitimate Google login page.
Really neat.
CASSIE: So even if the attacker steals the employee's password
and then tries to relay their login,
they still can't get access because they
have no way of physically authenticating
without the employee's security key.
CHRISTIAAN BRAND: Exactly.
Now, let's try security keys out to show you how they work.
So on the first laptop, let's look
at a user trying to sign in.
So this user is clearly on some phishing website
and let's see how the security key is going
to protect this user, even though they're
in the midst of falling for a phishing attack.
So can I have that security key for a moment?
Thank you so much.
So this user will go ahead insert their security key,
try to enter their password into this phishing website,
and, at this point, when she's trying to log in,
the security key is going to stop her
from signing in because clearly she's on a phishing website.
And even though she didn't realize it,
the security key did and stopped her from signing in.
CASSIE: OK.
So this is actually going to work on the real site
or is it just going to block both of them?
CHRISTIAAN BRAND: So let's take a quick look.
So on this laptop, Cheryl is on the right Google sign in page,
right?
If we investigate that URL up top, everything looks good.
So I'm going to go ahead, I'm--
CASSIE: You're going to need this.
CHRISTIAAN BRAND: Oh, thank you so much.
So, I'm going to go ahead and I'm
going to enter Cheryl's password here,
but before I do, of course, I, first,
need to enter the security key.
I'm going to go ahead, I'm going to click,
and, now, you'll see how simple this really is.
All she has to do is touch the button on the security key
and she will be magically signed in with the security
key protecting her against potential phishing.
CASSIE: Fantastic.
I love how simple that is.
And it's a whole new level of protection
against phishing attacks.
CHRISTIAAN BRAND: Exactly, right?
So, Titan Security Keys work hand-in-hand with Google
and the Chrome browser to provide employees
with end-to-end phishing protection.
In addition, Titan Security Keys include
firmware, developed by Google, to verify the key's integrity.
They're built on open FIDO standards
and that allows these keys to be used
with lots of other services, including Salesforce, Facebook,
and more.
CASSIE: So how can someone get started with security keys?
CHRISTIAAN BRAND: So Titan Security Keys
will soon be available for sale on the Google Store.
And if you're a Google Cloud customer,
you can also get these immediately
through your account executive.
You can also use any compatible FIDO security key
from any other vendor with Google products.
And once you have your keys, you just need to G.co/SecurityKey
for further instructions.
CASSIE: Well, Christiaan, thanks so much for walking us
through how the stolen password attacks work
and how we can protect against them with Google
Cloud and Titan Security Keys.
CHRISTIAAN BRAND: My pleasure.
[MUSIC PLAYING]