Google Cloud boosts open-source security, simplifies zero-trust rollouts

Google Cloud is rolling out new security services designed to address enterprise challenges including securing open-source software and accelerating the adoption of zero-trust architectures.

At its annual Google Cloud Security Summit, the company said it’s building on its Invisible Security effort, which promises to bake security into tools and services that enterprises and other customers use most.

One example is a new service called Assured Open Source Software (Assured OSS), which is aimed at making it easier for organizations to securely manage their open-source dependencies.

“Today patching security vulnerabilities in open source software often feels like a high-stakes game of whack-a-mole: fix one, and two more pop up,” wrote Sunil Potti, vice president and general manager of Google Cloud Security, in a blog about the new services. “This helps explain research done by Sonatype software that shows that there’s a 650% year-over-year increase in cyberattacks aimed at open source software (OSS) suppliers.”

Through Assured OSS, enterprise users of open-source software will be able to incorporate the same OSS packages that Google uses into their own environments, according to Google.

The packages Google has curated are regularly scanned, analyzed and tested for vulnerabilities, and they’re distributed from an Artifact Registry that’s secured and protected by Google, Potti stated. There are over 500 packages available through GitHub now. 

“The scale of Google’s ongoing effort to find OSS vulnerabilities would be challenging for any organization to construct and operate,” Potti stated. “We continuously fuzz 550 of the most commonly-used open source projects and as of January 2022, that process has found more than 36,000 vulnerabilities.”

The Assured OSS service is expected to be offered as a preview in Q3 2022.

On the zero-trust front, Google is introducing BeyondCorp Enterprise Essentials, which is designed to help enterprise customers begin to deploy zero-trust environments. The new solution brings context-aware access controls for SaaS applications or any other apps connected via Security Assertions Markup Language (SAML), which is an XML-based protocol that supports real-time authentication and authorization across federated Web services environments. It also includes threat and data protection capabilities, such as data loss prevention, malware and phishing protection, and URL filtering, integrated in the Chrome browser, according to Potti.

“It’s a simple and effective way to protect your workforce, particularly an extended workforce or users who leverage a ‘bring your own device’ model,” Potti stated. “Admins can also use Chrome dashboards to get visibility into unsafe user activity across unmanaged devices.”

BeyondCorp Enterprise includes an app and client connector that can simplify connections to apps running on other clouds such as Azure or AWS without the need to open firewalls or set up site-to-site VPN connections, Potti stated. Client connector enables zero-trust access to non-http, thick-client apps hosted on-prem or in other clouds, Potti stated.

The company also delivered some other new security tools and services:

• Security Foundation is designed to help enterprises more easily adopt Google Cloud’s security capabilities, Potti said. It lets customers access Google guidance on setting up data protection, network security, security monitoring and other features.
• New custom detection capabilities for Google’s risk management platform, Security Command Center, let customers add their own detection rules and perform configuration checks based on specific needs.