Next 2022 Improving Browser Security in the New Era of Work

Security. Hi there. Welcome to another special episode of the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and member of the technical staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content, including our special content that we've got brewing for you this week, please do hit that subscribe button. Ordinarily, you can get shows every Monday, but some weeks we have extra bonus content. If you like the show and want to argue with your hosts on Twitter, we're there as well, twitter.com/cloudsecpodcast. Thanks for listening. Anton, this is a fun episode today. We're talking about browser security, and it's another in our long list of episodes where we go, this specialty, isn't that just a variant of larger specialty? And I think that's kind of a fun episode format because I think a lot of people might look at cloud security and say, cloud security, isn't that just a variant of security? And we would say, no, of course not. And our guests also say, no, of course not.

Yes. And I think that In addition to this idea, the other idea was that browser as a security platform as opposed to browser as a threat vector. Because to me, it's interesting how I've met enough people in the industry who kind of assume that browser is how bad guys get in.

Isn't it?

They don't think of browser as a security platform. And this to me is actually kind of a mind-resetting episode in that regard.

Well, I always appreciate episodes where your mind gets reset because I think that's healthy for you. Especially as we all get more experience in industry, shall we say, it's important to have our perspectives reset. So perhaps with that, let's welcome today's guest. We're joined today by Fletcher Oliver, a Chrome browser customer engineer here at Google. Fletcher, this is super exciting to me because browsers to me kind of feel like how I experience the world. I mean, I run my life on a MacBook, but honestly, the thing I have open all day long is Chrome. It's kind of how I see the world, honestly, which is cool. So what is browser security and is it just application security for a particular application?

Well, first I just want to say I'm deeply touched that the browser is your world. So that's nice. And we try to make your world as best as possible. But I mean, to answer your question around what is browser security, is it just application security? And the browser is, at least in my opinion, kind of a different sort of application compared to others. And this is where most of their users spend their time, like you said, working, sharing information, maybe sometimes more than they should, but accessing key applications. And from all the enterprises that we talk to on a regular basis, it's really more business-critical than ever. So the role of the browser has evolved from an access point for the web to a critical security layer. And it's now in a position to surface a lot of security insight as well as apply enterprise security controls. Having security settings either through policies or specialized tools is pretty different from a traditional application that just runs locally on the OS.

So that means that if somebody says, oh, browser security, it's just writing the browser, quote unquote, securely, it's kind of not entirely right because browser is more than just a big complex app that accesses the internet. It's kind of a universe, its own universe, as Tim pointed out.

Correct. Yeah. I mean, users are accessing so many different things, and so many applications are going in the cloud. And having those different security layers can be difficult. But luckily, us on the Enterprise team have some solutions to help with that.

So here's the thing. The other point I wanted to start with is, of course, web browsers existed for not even years, but for decades. But I definitely hear a lot more conversations about browser security today and whether it's Chrome security or other browsers. The topic kind of existed in the security industry for a good number of years, but it seemed to be much, much hotter today. So why is this now? Why are we talking about it a lot more today?

As I mentioned before, workers are really spending the majority of their time working on the web and in the cloud. And information's flowing less locally and more online than ever before. So especially with users doing a fully remote or hybrid work model, which is obviously more of a reality these days, So keeping those endpoints secure, especially with users infrequently connecting to the corporate VPN to receive policy, is becoming increasingly difficult for IT admins and security admins, as well. So a zero-trust approach can help here, not only by eliminating the need for VPN but also ensuring users have access to the apps they need and nothing more. I also can't help but throw some stats out there because there's an increased number of cyberattacks, mostly taking advantage of this attack opportunity of remote workers. And an increased average cost of a data breach. So businesses suffered 50% more cyberattack attempts per week in 2021. 2021 saw the highest average cost of a data breach in 17 years, with the costs rising from $3.86 billion to $4.24 million, which is a lot. And 2021 saw 74% of breaches were more the result of giving too much privileged access to third parties. So we should really be thinking about how a browser approach to security can reduce this. 2022 is only increasing. So yeah, browser security is pretty important.

I'm so curious about— we've got some stats here on the increasing cost of a breach, and I feel like those numbers have been going up my entire career. Do we have measures on the increasing security of the browser?

Do we know if we're getting better at having Chrome Well, in 2020, we launched Enhanced Safe Browsing, which you can turn on in your Chrome security settings— and we definitely recommend that— with the goal of substantially increasing safety on the web. And we've also recently added the ability for IT admins to be able to set this up for their users as well, like through policy. And these improvements are being built on top of the existing security mechanisms that have already been protecting billions of people. devices. So since the initial launch, we've continually worked behind the scenes to improve our real-time URL checks, apply machine learning models to warn on previously unknown attacks. And as a result, the Enhanced Safe Browsing users have successfully been phished 35% less than other users.

That's a good number, actually. Sorry, this is kind of— while phishing has commonly comes up as a big problem, challenge, pain for customers, and leading to other attacks. If we have solid data showing that it decreased by 35%, that's a good item to have, right?

I would agree. Yeah. So, I mean, and also, if you look on the Chrome release blog, you might be seeing more phrases like around exploit for CVE-123456 or whatever appearing more frequently. And it may be concerning to see these, but it's important to know what's happening behind the scenes. More exploits in the wild can be concerning, but the other side of the coin is that if we're gaining more visibility into exploitation by attackers, that this is a good thing. With this information, we can learn more about how attackers operate and then be able to respond quicker with bug fixes.

I just want to remind our audience that when we have the number of vulnerabilities as a metric, In many cases, it's a positive metric, especially if it's vulnerabilities fixed and fixed quickly. And vulnerabilities fixed quickly with internal discovery, that's an even better positive metric. So if a browser reports a lot of vulnerabilities being fixed and the discovery is internal, I want more of that, not less. So in that sense, sometimes in the press, I see people comparing applications naively by who has more vulns. But frankly, who has more vulns fixed quickly for the internal discovery wins, not loses.

And speaking of quickly, we recently moved from a 6-week release cycle to a 4-week release cycle so that way the most secure version of Chrome can be delivered to users quicker than ever. And when you take this and couple it with the enterprise controls and policies that we provide for IT admins, they can really use those to get their users updated quicker, We have tools like relaunch notification to prompt users to relaunch the browser because some people leave Chrome open for like an eternity. So they can prompt users to restart. They can force them to restart, as well as we do have some great version reporting in Chrome Browser Cloud Management, which lives within the Google Admin Console and also has no cost. We're just really committed to support our users and our admins so that way they can make sure to keep Chrome up to date and secure.

Yeah, I know that they can force restart Chrome because I think I've had some forced Chrome restarts over the years.

Yeah, but over the years, right? This is a sign that something which gets to that level of importance is, is not common. No, you didn't say over the recent weeks, you said years, right?

So it's also a testament to the stability of Chrome because I'm thinking back to like my childhood and I feel like Internet Explorer would update itself every day because it would crash every day, unlike Chrome, which I can't think of the last time Chrome as a whole crashed on me.

Ah, let's pour one out for Internet Explorer, right? No, or no?

Yeah, yeah, there's that. Yes, yeah, yeah, yeah, that's a fair point.

Rest in peace, many, many a website I visited for the first time on it. So I do think this is an interesting question. Do we have any data about in-the-wild exploit of Chrome? Do we track that and do we know how we're doing there? Because like Anton said, number of vulnerabilities is not a great metric, but Perhaps understanding the ratio of internally fixed versus externally observed. How do we know how we're doing against the bad guys?

I'm sure that those metrics exist. I mean, a lot of them we can't really expose publicly due to the secure nature of it. But as you kind of highlighted before, the more vulnerabilities that we're able to find, the quicker we're able to patch them. But I don't think there's any kind of dashboard, although we do have our vulnerability rewards program. So that way people that want to go through and look for these vulnerabilities obviously can earn some great stuff by reporting those to Google.

You know, I had a good friend of mine in college who would often take us out to the campus bar based on his Google Vulnerability Rewards payouts.

Oh, that's a good friend to have, I suppose. Yeah.

Yeah. Yeah. I had many a pitcher of beer thanks to finding an issue in Google.

So I wanted to sort of switch it back to a little bit of a serious topic. And we do realize browser is a large and complex application. So browser security is kind of its own domain. So what are the components? Like, what are the big areas within browser security? And of course, feel free to use Chrome as an example. So what would be the subdomains within browser security?

Yeah, I'll start general, and then I'll go back to my inherent bias around Chrome browser. An enterprise-grade browser A browser should proactively find malicious and deceptive content and protect you against it, right? But also while maintaining your privacy. And Chrome, as an example, does do that. Google Safe Browsing and Global Intelligent Engine, which is a name just rolls off the tongue, does protect about 5 billion devices every day, showing warnings to users as they attempt to navigate to dangerous sites or download dangerous files. Obviously, given what Chrome is and our legacy, that there's not really too many other browsers that are able to provide that kind of security on the scale quite like ours. Also, a secure browser should guide users to make safe decisions on the web. So some of these things include password management and protections. And really, on the Chrome team, we just recommend, just please use a password manager. It doesn't matter if it's our password manager, but if you're not providing— from an enterprise standpoint, you're not providing a password manager to your users, it's going to lead to unsafe password practices, like incrementing a number to their password every time they're forced to change it, or writing their password on a Post-it note and sticking it under the laptop.

Post-it notes are kind of hard to hack, though. Like, digital access to Post-it notes is really complicated from what I hear.

I actually agree with that. I think that there's a lot of threat modeling that gets missed thinking about the sticky note under the keyboard. But, but go on, please.

Okay, fair enough. As long as there isn't some sort of reverse osmosis absorbing of passwords.

As long as the webcam doesn't look at that. I'm trying to get my— ooh, yeah, there's a sticky note there.

But kind of tying to the password manager, we do have a really great solution that I'm a big fan of around password protection. It's called Password Alert. And it does provide an additional layer of protection to corporate passwords. So it can warn users if they're entering their passwords into a known phishing site and provide them a visual to please stop doing this before they hit Enter. And the solution can also be configured to prevent users from reusing corporate passwords on non-corporate sites. So as I said, please use a password manager, but many enterprises do turn off password managers, which can result in users reusing passwords, even in shopping and social sites. So if one of those sites gets breached, the user's personal information could be leaked, bought, sold, which usually will include the password for that breached site. And a simple search on, say, a tool like LinkedIn, would-be attacker could find out where that person works, There's sites out there where they could be able to find the naming conventions that large corporations use for firstname.lastname@company.com or whatever, and they already have a password. It could be a pretty good indicator that their corporate password would be the same, so that way they could be able to do a targeted attack. So with this feature on, you can warn the user, pop up a screen saying, hey, digital hand slap, you shouldn't do that, or they can log in in audit mode. And we also have some really great integrations. hopefully we'll be able to talk about later, where you could be able to send those events to tools like CrowdStrike or Splunk or Chronicle. So very, very cool integration that hopefully you'll ask me about later.

That capability sounds a lot like our internal Watchword extension. Is that right?

I think so. I think we do use it internally. I know I've gotten snagged by it a couple of times.

Ripped your password as well.

Yeah.

So what's really cool about this feature is it doesn't save the password to the cloud. So it's not readable by any kind of Google servers or anything like that. It's stored locally on the machine and salt encrypted and all that sort of stuff. We only have just a little bit of the hash in order to be able to make a determination that, yes, this is the password. It works with all sorts of solutions, whether they're Google solutions or if customers use other ones. Yeah, it's a great feature. Everybody should definitely look it up. And then the last component around modern browser security is since the browser is so business-critical, it's important to have a management tool for it.

Hmm. Say more about that.

Yeah. So taking Chrome, an example, we do have a no-cost tool called Chrome Browser Cloud Management, which provides policy management, comprehensive reporting, including browser versions, settings, device details, as well as extension management, which can really be a hot-button issue with security and IT admins because it's increasingly important because Extensions can have the ability to read the sites that users go to and have access to the data of the machines that they're browsing from. And this particular solution provides really great visibility into installed extensions that no other tool can really offer. Again, it doesn't have a cost associated with it. It lives within the Google Admin Console, and I think it's awesome. I don't know for a better word.

No, that's great. So I really love when people feel that their capabilities are awesome. I think Anton has seen me use even less descriptive language when talking about some of the stuff I ship.

But the MTD was awesome. I did say it myself, by the way. So from your stuff, if you're curious, there's some stuff that's just magical and there's some stuff that's just mediocre. I'm trying to see that there's both, right? Like, it's not super shameful in having both. Like, you can't be awesome plus on every regard.

What you're learning here, Fletcher, is that Anton, even after knowing me for multiple years, refers to my stuff as mediocre.

Some of your stuff.

Some of your stuff.

So whatever language he used in preparing for this episode, don't take personally. Listeners, you've been listening to Anton for a while. You understand that he communicates in a, well, a particular way. So I want to, I want to talk about this management tooling and how it fits into the rest of management tooling, because enterprises have, I think, more than one tool in most cases. And it's important for those tools to work together. What's the story for fitting Chrome into your existing enterprise stack?

Yeah. So highlighting what I was talking about in the general awesomeness— technical term— of Chrome Browser Cloud Management is that organizations can easily integrate Chrome with their preferred security solutions for further forensics. So I kind of highlighted it previously, but being able to gain enhanced visibility into security events, including password alert or password reuse, unsafe site visits, malware transfers, logins, password breach. As well as we have some new events coming in around crashes and extension install events that can all be integrated. So some of the third-party tools that we integrate, because we are aware, as you said, that customers might have more than one. So we integrate with Splunk and CrowdStrike. In fact, recently I was at the CrowdStrike conference talking about our tools and definitely seemed to be a lot of interest around this. And then, of course, if you use Google solutions, we integrate with Chronicle, Google Cloud Pub/Sub and BeyondCorp Enterprise. So enterprises can really enjoy this added visibility into what security events are happening as their users are working in the browser, and then have the ability to be able to choose from and integrate with a variety of tools so that way they can send the events to their chosen solution provider, kind of meet them where they're at. And for a lot of companies, this is a new set of data security that they didn't have access to before. It can really empower them to make better-informed decisions on their security journey to that nirvana state where end users are happy, but also secure at the same time. It doesn't happen a lot, but sometimes you can get at least close to the promised land, so to speak.

That's awesome. We certainly know the feeling of getting close to the promised land. We're just about out of time, so I want to ask our traditional closing questions for you. Do you have recommended reading for people to learn more about enterprise browser security? And 2, do you have one weird tip for improving the same?

Yeah, if you want to get in touch to learn more about Chrome browser, check out chromeenterprise.google, and that'll get you where you need to know, learn about all the different policies, integrations, more about Chrome browser cloud management. And then as far as one phrase tip on how to improve your browser security is, we recommend auto-update. Please use auto-update. It will make sure that you get the latest and greatest security fixes and features to your users. So that's definitely what we recommend as a best practice and the best way to keep your users secure.

Isn't everybody saying using auto-update, like Chrome auto-update, is so smooth and polished, and it's been working really well for a decade? So does somebody really disable it? It's so unnatural to not have it. It's like magic, right?

Well, I mean, I think so. Working in the enterprise space for more than a decade, you build something that's just amazing and awesome, and enterprises are like, that's amazing, how do I turn it off, right? But in this case, you shouldn't. Please use auto-update.

Awesome. Well, Fletcher, thank you so much for making the time to join us today. We really appreciate it. We also really appreciated— listeners, you didn't get to hear this, but before we kicked off recording, Fletcher shared some unexpected musical talent with us. And Anton and I learned a lot today. So thank you so much for joining us today.

Sure. Thanks so much for having me.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.