CHLOE CONDON: Looking to help secure sensitive data
and prevent fraud?
With reCAPTCHA Enterprise and Assured Workloads,
customers in regulated industries
can protect their applications that
run on Google Cloud from fraudulent activity and abuse.
Hi, I'm Chloe, and in this video,
I'll be walking you through how public sector agencies can help
protect the privacy and sensitive data
of their constituents using reCAPTCHA Enterprise for fraud
detection and authentication services
while securing the underlying regulated infrastructure using
Assured Workloads.
[MUSIC PLAYING]
Today, many public sector entities
provide services to their constituents.
And in doing so, they frequently need
to create accounts and logins to access
their sensitive, personal information.
Unfortunately, these public sector services
are often the target of bad actors
who use various methods to take over accounts,
running automated attacks, using passwords
exposed in data leaks, or exploiting
security misconfigurations.
Account takeovers are typically followed by the attacker
transferring money, buying gift cards,
making purchases with the compromised user's account,
or accessing more of the user's information
for leverage in a progressive attack.
Knowing when a user is impacted by a data leak
is critical information, as they may
have reused their password on other websites
and made themselves vulnerable to account takeovers.
But how can app owners and users get insight
into these potential risks?
Public sector entities use Assured Workloads
to help protect the sensitive data they store and process
on Google Cloud.
Assured Workloads enforces security controls
and guardrails needed to protect infrastructure
while maintaining compliance standards.
But securing the underlying infrastructure
does not provide complete protections
for constituents' data or accounts, which
is why these entities combine assured workloads
with reCAPTCHA Enterprise.
While many anti-fraud and abuse solutions exist,
they typically only have visibility at the request level
and not the client level.
This allows threats to masquerade as valid clients,
putting users' data at risk.
These solutions are also often focused
on single-use cases, such as credit card fraud,
and won't necessarily help when it
comes to issues such as identifying and stopping
account takeovers or being able to provide insights
into whether constituents were impacted by data leaks.
With Assured Workloads and reCAPTCHA Enterprise,
you can easily identify privacy and security issues
without adding user friction.
This combined solution includes guardrails and security control
monitoring to reduce misconfigurations
and provides fraud and bot protection.
Actions can be taken based on security, risk, and compliance
requirements.
For example, the solution may require constituents
to use two-factor or email authentication
to protect their data when an elevated risk is detected.
Let's quickly show you a demo of how
to set this up for yourself.
When a user logs in with an email and password,
reCAPTCHA Enterprise will return you a score
for that user between 0 and 1.
Here in this example, we see a 0.9.
This means this is a human.
Let's take a look at how this works
alongside Account Defender.
When the user returns, we see a similar score of 0.9
as well as a label, profile match.
This means that the same user has returned.
Now, let's see an example where someone else attempts
to log in on behalf of a user.
When we check the visitor, we can see a new score of 0.6.
An Account Defender has identified
that there is suspicious login activity,
and the recommendation is to request
two-factor identification for this user.
With password leak detection, public sector entities
can audit user accounts against Google's five billion
plus database of compromised credentials
to ensure that users' login information has not
been leaked or breached.
This can guide immediate action to protect
users' data without them even being
aware an incident involving their password has occurred.
As you can see in this example, when leaked credentials are
used, reCAPTCHA performs a check against our database.
It lets us know that the password for this username
has been previously leaked, which
means as developers we can prompt our users to reset
their password and two-factor authenticate them
to ensure it is, in fact, the correct user making a login
attempt.
Our annotations API is also available to use
to let us know how the assessment is gone.
For example, was this a legitimate user
versus suspicious login and more.
This public sector solution is helping
agencies and local governments across the US and world
protect their constituents while maintaining
the highest levels of compliance and security
without compromise.
As we continue this series, we will
see other regulated solutions designed
to increase protection, reduce security misconfigurations,
and empower public sector entities
to provide highly secure online services to the public.
Thanks for tuning in.
For more information, check out our documentation
or take a look at the links provided in the description
below for more info on how you can
use Assured Workloads to protect sensitive data
privacy in your applications.
[MUSIC PLAYING]