{"id":51606,"date":"2023-04-25T04:08:56","date_gmt":"2023-04-25T04:08:56","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/googles-here-to-boost-your-cloud-security-and-the-magic-ingredient-ai-of-course\/"},"modified":"2023-04-25T04:08:56","modified_gmt":"2023-04-25T04:08:56","slug":"googles-here-to-boost-your-cloud-security-and-the-magic-ingredient-ai-of-course","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/googles-here-to-boost-your-cloud-security-and-the-magic-ingredient-ai-of-course\/","title":{"rendered":"Google’s here to boost your cloud security and the magic ingredient? AI, of course"},"content":{"rendered":"

RSA Conference<\/span> Google Cloud used the RSA 2023 conference to talk about how it’s injected artificial intelligence into various corners of its security-related services.<\/p>\n

The web giant’s announcement<\/a> of the resulting new features \u2013 marketed under the Google Cloud Security AI Workbench umbrella brand \u2013 is pretty long winded, so we thought we’d ask its Bard<\/a> chat bot<\/a> to summarize it all. Here’s what the thing told us:<\/p>\n

Um, okay, that kinda makes sense, but we’re still not sure what exactly is new here. Maybe the diagram Google handed out about the workbench will help?<\/p>\n

\"Google-supplied<\/a><\/p>\n

Google’s illustration showing how its AI workbench comes together<\/p>\n<\/div>\n

Fine, we’ll read and summarize the announcement ourselves. Here’s what’s new and worth highlighting from Google Cloud:<\/p>\n

VirusTotal and Sec-PaLM<\/h3>\n

Google said it has created a security-specialized large language model called Sec-PaLM that it’s put to use in VirusTotal, which Google also owns. When you upload malware to VirusTotal to analyze, it will use Sec-PaLM to generate a written report (like this one<\/a>) describing what the file’s code will do if executed and what the intent appears to be.<\/p>\n

So far this Code Insight<\/a> feature works on qualifying PowerShell scripts, and this is expected to be expanded to other file formats.<\/p>\n

Mandiant Breach Analytics for Chronicle<\/h3>\n

Next, Google said its Mandiant Breach Analytics for Chronicle will alert you when it detects an intrusion, and will use Sec-PaLM to describe these security breaches.<\/p>\n

Diving deeper into the announcement<\/a> reveals the LLM can be used to search and analyze security event logs, set up and customize the detection of malicious or suspicious activity on a network, and produce summaries and insights.<\/p>\n

It essentially brings Google-owned Mandiant’s threat intelligence tech into Chronicle, Google’s cloud security suite.<\/p>\n

Assured Open Source Software<\/h3>\n

Google also promised to somehow use LLMs to add more packages to its Assured Open Source Software project, which Google uses<\/a> to avoid supply-chain attacks, and suggests you also make use of it.<\/p>\n

Dependencies in AOSS are expected to be free from tampering, obtained from vetted sources, fuzzed and analyzed for vulnerabilities, and include useful metadata about their contents. The idea being that it’s a place to get software from without worrying if someone’s secretly slipped bad stuff into a library.<\/p>\n

Mandiant Threat Intelligence AI<\/h3>\n

It’s Sec-PaLM again, this time in Mandiant Threat Intelligence AI, which can be used<\/a> to “quickly find, summarize, and act on threats relevant to your organization,” we’re told.<\/p>\n

Security Command Center AI<\/h3>\n

Finally, Security Command Center AI promises<\/a> to make it easier for users to understand how their organizations can be attacked, by summarizing and explaining the situation.<\/p>\n

Crucially, it doesn’t appear to use hypothetical examples, it instead takes a look at your assets and resources, and tells you how someone could take a crack your IT environment specifically. It also recommends mitigations, Google said.<\/p>\n