Google is also introducing two new security products.<\/p>\n
The first, Confidential Space, is a trusted execution environment<\/a> that uses a container optimized operating system to offer a secure, controlled place for multiple organizations to collaborate on projects and share sensitive data with each other. It builds off previous efforts by Google like Confidential Computing and Confidential Virtual Machines and is meant to support things like joint data analysis, machine learning modeling and projects where organizations wish to collaborate and share data but maintain control of the information and prevent appropriation or misuse. <\/p>\n The use cases Google offered include scenarios like banks and insurance agencies sharing joint customer data to root out fraud, healthcare and medical technology companies sharing information to speed up drug development cycles without exposing patient data and Web3 companies using remote attestation to buy or exchange assets.<\/p>\n The second, called Software Security Shield<\/a>, is a managed security solution that offers managed software development environments via Google Cloud, approved lists of open source software code packages that are regularly vetted for security by Google through scanning, fuzz-testing, analysis and other forms of curation, managed platforms for continuous development\/continuous integration of applications and a policy engine for verifying the integrity of software code throughout the development and production lifecycle.<\/p>\n Sunil Potti, general manager and vice president of cloud security at Google Cloud, said the moves represent an effort to harness the vast resources and scale that Google dedicates to securing its own enterprise and push them out to smaller organizations as a managed service.<\/p>\n \u201cFundamentally we\u2019re in this accelerating cyber situation where nation state actors, for example, are increasingly spending more time not just on governments but on enterprises of all sizes, from big banks to the small credit unions,\u201d said Potti. \u201cUltimately when you take a step back, only companies like Google or maybe an Amazon or Apple who have invested in protecting themselves at scale can maybe thwart that; but if there\u2019s an opportunity for most of these companies of all sizes to inhale the capabilities that Google has built to protect themselves, to protect their own customers, then there\u2019s a real opportunity to structurally solve this problem.\u201d<\/p>\n The announcements also doubled as an opportunity to discuss the $5.4 billion acquisition of Mandiant, which Google finalized in September.<\/p>\n Google chief information security officer Phil Venables said the pairing of Mandiant with Google Cloud \u201ccombines what we\u2019re both good at\u201d: Google\u2019s SIEM and SOAR tech focusing on reactive defensive security tasks like event monitoring, logging analysis and digital forensics, and Mandiant\u2019s offerings providing more \u201cproactive\u201d capabilities, that provide visibility into an organization\u2019s overall attack surface and validate their existing security tools and processes.<\/p>\n \u201cWe\u2019ve already got excellent security information and event management and SOAR capabilities with things like Chronicle and Siemplify. With Mandiant, we can take all of that threat intelligence and incident response capability and align it with that and so it\u2019s a really great natural and complimentary combination,\u201d Venables told reporters.<\/p>\n Google will retain Mandiant\u2019s name and brand, and founder Kevin Mandia said his organization is \u201cstill do[ing] the work we\u2019ve always done.\u201d He predicted the integration of Mandiant into Google Cloud will \u201camplify\u201d the impact of Mandiant intelligence by leveraging Google\u2019s vast ecosystem of software and integration partners to reach a wider audience.<\/p>\n Google\u2019s purchase of Mandiant came a little more than a year after the threat intelligence firm split with FireEye <\/a>(now Trellix) after eight years of partnership. At the time, Mandia spoke about the need to decouple Mandiant\u2019s intelligence from FireEye security controls and products in order to present insights and analysis free from bias.<\/p>\n Now the company will be tied to Google and its products, but Mandia told SC Media that he does not view the two situations as analogous. While part of FireEye, Mandiant\u2019s analysis was restricted to telemetry from FireEye endpoints, firewalls and network security monitoring tools. Google\u2019s portfolio is not reliant on those products or controls, and maintains integration partnerships with other threat intelligence firms like CrowdStrike, Cybereason and Fortinet that will still allow Mandiant to incorporate telemetry from a wide variety of sources.<\/p>\n \u201cAs we respond to breaches and get to a mastery of here\u2019s is what bad looks on a network, this is what unauthorized or unlawful or simply unacceptable behavior looks like and all this different telemetry, Google is best suited to bring that to market,\u201d Mandia said. \u201cSo when I said we needed to be controls agnostic, that\u2019s what I meant. At Mandiant we know what bad looks like, whether you\u2019re using [endpoints from] Sentinel One, CrowdStrike\u2019s, Symanetc, McAfee, Carbon Black\u2026we want to work with Microsoft Defender, we want to work with all of them and impose security automation on top of all these control products that create the telemetry, so it\u2019s still a perfect fit.\u201d<\/p>\n He analogized Mandiant\u2019s role in the Google Cloud security ecosystem to that of a higher intelligence sitting on top of a broader security operation, culling and organizing data from disparate technologies and sources and then using them to inform strategy and decision-making.<\/p>\n \u201cWhen I think about it, I think of a physical world analogy: there\u2019s going to be a thousand companies that make cameras, but there would need a brain for all the cameras to say there\u2019s an intruder coming in the house or there\u2019s something else happening\u2026I see one of the things we can do best at Mandiant combined with Google is be that brain, be the hub for all the spokes,\u201d he said.<\/p>\n The moves announced by Google represent an attempt to stitch together many of the company\u2019s core security offerings \u2013 some developed in-house, others added via acquisition \u2013 into a unified, cohesive managed service that is relevant to customers large and small as it seeks to compete with Amazon and other major cloud security providers.<\/p>\n But experts told SC Media it will take more than throwing cash around to make Google a major player in the security space.<\/p>\n Allie Mellen, an analyst at Forrester, called the news the most significant move for Google\u2019s security analytics portfolio since the merging Google Cloud and Chronicle in 2019. Up until now, she said Chronicle has lacked critical enterprise features, like SOAR, that are often a requirement in a security analytics platform market that is trending towards consolidated toolsets.<\/p>\n The unification of Google\u2019s Chronicle\u2019s SIEM with Siemplify\u2019s SOAR and Mandiant’s threat intelligence helps in \u201cbridging the gap for Google to an enterprise offering.\u201d<\/p>\n \u201cMandiant\u2019s quality security services on top of Chronicle\u2019s storage, querying, and SOAR capabilities are a powerful combination, especially since very few competitors in the Security Analytics Platform market can offer the same with the same level of cohesion and partnership,\u201d \u201cHowever, some of the features need to mature before the product alone will be a robust SIEM offering, such as the analytics capabilities,\u201d said Mellen. <\/p>\n Google\u2019s success may also depend as much on how successfully it leverages the human expertise it has inherited as it does the technology. Mellen cited the addition of a known and trusted security brand in Mandiant as a real difference maker, a question that others raised as well.<\/p>\n Adrian Sanabria, director of research at Savage Security and co-host of the Security Weekly podcast, told SC Media that while Google has thrown a lot of money and resources into its cloud security program and brought in smart people like Mandia, it\u2019s not yet clear how influential they will be in steering the company\u2019s decision-making. For example, lessons gleaned from incident response engagements carried out by Mandiant can offer a \u201cstrong feedback loop\u201d to Google\u2019s product team that will allow them to adjust and keep their technologies relevant for the latest threats.<\/p>\n![](\"https:\/\/cms.scmagazine.com\/wp-content\/uploads\/2022\/10\/Screen-Shot-2022-10-10-at-6.09.29-PM-1024x391.jpg\")
Mandiant: The brains of the operation<\/h2>\n
![](\"https:\/\/cms.scmagazine.com\/wp-content\/uploads\/2022\/10\/GettyImages-1231345183-e1665445458322-1024x614.jpg\")
What’s next? Google needs to get out of its own way<\/h2>\n