Security

Review: Discover Risks Before They Worsen with Google Threat Intelligence

Customized analysis makes this cloud-based platform an incredibly powerful asset.

Twitter

John Breeden II is an award-winning reviewer and public speaker with 20 years of experience covering technology.

It’s now a given that malicious actors will target government organizations. The value of citizen data is gold for planning secondary attacks, and cybercriminals know that many local governments are underfunded and understaffed when it comes to IT security, which makes them tempting targets for ransomware.

However, simply adding more security platforms on top of existing defenses may not help if the threats arrayed against government networks are not fully addressed and tracked.

That is where the Google Threat Intelligence platform can provide an invaluable and powerful service. Deployed through the cloud, it tracks billions of threats and threat actors every single day, analyzes them and directs highly specific, actionable intelligence to protect organizations.

Click the banner to better understand cyber resilience’s importance to state and local agencies.

x-cyberresillience3-static-2024-na-desktop

x-cyberresillience3-static-2024-na-mobile

Google Threat Intelligence Offers Much-Needed Insights

At the heart of the platform, Google Threat Intelligence uses four key elements to keep track of global threats. First is the Mandiant Intel Grid, which was recently purchased by Google. That real-time network consists of over 4 million guest instances set in over 100 countries. Those instances are attacked thousands of times every hour. And now, added to that intelligence is attack information gathered from Google’s Gmail and Chrome browsers, plus everything submitted through the VirusTotal website. That makes for what is possibly the biggest threat intelligence capture network in the world.

All of that raw intelligence could easily overwhelm almost any security team. Thankfully, Google Threat Intelligence lets users personalize their feeds and power their dashboards based on location and other factors.

Agencies Can Dive Deeper into Potential Bad Actors

The threat intelligence can be further customized to include all of the public-facing assets of an entire government facility, so that active campaigns can be quickly and easily matched with existing infrastructure and protection. For example, I could see any infrastructure that was targeted by active threat actors in an area, then read how those groups implemented attacks in other places and how to inoculate and monitor systems against any similar attacks.

The security landscape for providers will only become more challenging, but knowing the enemy is half the battle. Google Threat Intelligence will make sure that no government facility is caught unaware or surprised when attacked. Instead, malicious actors will find a well-informed and properly designed defense ready to protect a critical industry.

SPECIFICATIONS

PRODUCT TYPE: Cloud-based threat intelligence platform
DEPLOYMENT: Software as a Service
CAPABILITIES: Personalized threat intelligence, attack surface management, post-breach analysis tools
SOURCES FOR INTEL: Chrome Secure Browser, VirusTotal, Mandiant Threat Intelligence network, Gmail phishing attacks
ADDITIONAL FEATURES: Dark web and website spoofing monitoring

A Powerful Tool for Threat Hunting

Google Threat Intelligence is extremely effective when it comes to preventing attacks, but the platform is also an invaluable resource for threat hunting.

Threat hunting is one of the most difficult tasks in cybersecurity. Security analysts who do this work follow their hunches to uncover evidence of intrusions or threats that may not have triggered any alarms. They must take seemingly unrelated events and piece them together like a detective. It’s hard work, but the reward is stopping potentially devastating attacks before they can strike.

Many times, threat hunters have to act alone. But Google Threat Intelligence, with its rich data sets and interactive dashboards, is a great partner in that endeavor.

In testing, my networked beaconed out to a strange URL once during midday. Using that small data to launch our investigation, I first examined the URL to see if it was malicious. I also checked to see if the site was being used or was owned by any known threat actor group, or if it was previously tied to any malware.

DISCOVER: State and local agencies must prepare for unexpected cyber threats.

Looking at the beaconing behavior itself, I could compare the asset in question and the techniques being employed with known threat actors. I could also discover any similar behaviors happening in the network. Finally, I could even compare that activity with the timelines of active threat campaigns to see if they matched, yet another indication that an attack, or its precursor, was underway.

A talented threat hunter could put together the same picture of that test attack, including most of those key elements, but it would not be easy and would certainly take a lot of time without Google Threat Intelligence. The platform can greatly cut down the time needed to confirm an intrusion and start remediation while also freeing up time to perform more critical cybersecurity investigations.