[MUSIC PLAYING]
YUFENG GUO: Hi, and welcome.
We're here at the security zone at Next
with Lorena Crowley from the Google Cloud Security team.
Hi, Lorena.
LORENA CROWLEY: Hey, Yufeng.
YUFENG GUO: Lorena, you're an expert
on ransomware attacks, which are a common problem for companies.
Can you tell us more about it?
LORENA CROWLEY: You're right, Yufeng, ransomware attacks
are a common problem for companies far and wide.
A recent report on malware attacks
showed that a company is hit by a ransomware attack every 40
seconds.
And we're helping protect employees and companies
from these attacks.
YUFENG GUO: So if I'm a security admin,
I'm trying to protect my company from ransomware attacks.
How should I approach it?
LORENA CROWLEY: The first thing you need to do
is understand the way ransom attackers work.
One of the most common attack vectors for ransomware
is email.
As you can see, the attacker sends phishing emails
with malicious malware attacks.
They're trying to trick employees
into opening up these emails.
A second common attack vector is website attacks.
Attackers embed malicious malware
into websites that look legitimate.
And employees may be tricked into downloading
the malicious malware, thinking it's something else.
YUFENG GUO: Wow, so whenever employees are opening up
emails or browsing the web, they could
be at risk of accidentally downloading malware.
LORENA CROWLEY: Unfortunately, yes.
And there's even other sophisticated ransomware attack
vectors when attackers when try to create new malware variants.
These new malware variants are designed
to sneak by existing detectors and perimeter defenses
that operating systems have.
So as a security admin trying to protect against these attacks,
the first thing you really need to do
is understand these vectors.
And then you need to understand the business impacts
that successful ransomware attacks can have.
Let's take a look over here at a company
that has a lot of ransomware vulnerabilities.
We're looking at a company here that has
a lot of legacy systems that haven't
been updated in a while.
Because of that, there are several key vulnerabilities
that ransomware attackers could exploit.
The first vulnerability this company
has is a legacy on-premise email server.
These servers that are the gatekeepers for letting emails
into users' inboxes.
When ransomware attackers send malicious emails
into the server, if the malware detection in the email server
hasn't been updated in a while, it's
going to be easier for these emails
to get through to users' inboxes.
YUFENG GUO: So what happens when a user, say, opens
one of these malware files?
LORENA CROWLEY: Well, when an employee opens up
one of these files, their device is encrypted.
And they receive a message on their screen demanding
a cryptocurrency payment before the device is unencrypted.
The employee can't access any of their apps or data, which
makes them unproductive.
And the company may have to pay ransom
to get the device unencrypted.
But that's not it.
Another vulnerability this company has
is that they're using an out-of-date legacy browser.
When ransomware attackers embed malware into websites,
these out-of-date browsers aren't necessarily
able to detect them.
YUFENG GUO: So that means you could just
have more employees getting tricked into downloading
these files on websites.
LORENA CROWLEY: That's right.
The impact of an out-of-date browser
could mean more successful web-based malware
attacks in your organization.
If a company experiences a lot of these different attacks
across their different departments,
the costs and losses in productivity
really start to add up.
One last vulnerability this company has
is that it's running a traditional operating
system that hasn't been updated with the latest patches.
That means this OS may let employees
run an executable file that is risky.
So if an employee accidentally downloads a malware file,
this operating system isn't going
to do anything to stop it.
Ransomware attackers exploit both known and unknown
vulnerabilities in these operating systems
to lock users' systems down.
YUFENG GUO: Wow, so this legacy company isn't doing so well.
LORENA CROWLEY: No.
Right now this company is struggling.
They're suffering with lower productivity,
and they even have ransom payments to deal with.
YUFENG GUO: Yeah, these ransomware attacks
seem to be really able to slow down the whole business.
LORENA CROWLEY: They really can.
YUFENG GUO: And so as a security admin, how can I
help protect employees and the business
from these sorts of attacks?
LORENA CROWLEY: Well, I'm glad you asked that.
Why don't we go take a look at another company that
is prepared to take these ransomware attacks on?
This company is using Google Cloud
to help protect employees and their business
from the impact of ransomware attacks.
They have multiple layers of protection.
The first thing this company is using to protect employees
is Gmail.
Gmail is a cloud-based email service
that protects employees by blocking ransomware emails
before they hit their inbox.
Gmail can automatically detect even sophisticated
ransomware attacks by identifying them within emails
and blocking them before they hit a user's inbox.
So ransomware attacks can be detected and blocked.
Why don't we take a look at the second protection
this company has in place?
It's Chrome browser.
The Safe Browsing technology in a Chrome browser
alerts users who may be trying to visit a risky site.
As a security admin, you can add additional controls.
For example, if you're leveraging auto updates,
employees will have the most up-to-date protection
available, even against new malware variants.
And with additional protections like sandboxing and site
isolation, if a user does visit a risky site,
that malware won't spread between tabs or processes.
YUFENG GUO: That's great.
So if an employee browses to one of these sites,
they're going to get alerted.
LORENA CROWLEY: Right, and they're going to be safe.
The last protection we'll look at
is how this company is using Chrome OS to protect
from ransomware attacks.
Chrome OS it is a cloud-based operating system.
Because it runs in the cloud, it prevents employees
from running executable files, unlike traditional operating
systems.
So even if an employee downloads a malicious malware file,
the operating system blocks it from executing.
Chrome OS offers additional safeguards,
things like auto updates that help keep
employees completely protected.
YUFENG GUO: So as a security admin,
these tools will help businesses avoid
all kinds of these attacks.
LORENA CROWLEY: Exactly.
Between Gmail, Chrome browser, and Chrome OS,
they're all working together to help provide employees
and businesses the security they need to stay productive
and to prevent them from paying money to ransomware attackers.
YUFENG GUO: That is so great.
Thanks so much, Lorena, for explaining how Google Cloud is
protecting companies from ransomware attacks
all over the world.
LORENA CROWLEY: Thanks for having me, Yufeng.