Google VP: Stop Playing Whac-A-Mole With Hackers | #cybercrime | #infosec

07MeWxNMiJwokm0ws58vEm7-1.fit_lim.size_1200x630.v1774452630.jpg

Whether it’s stealing oceans of personally identifiable information or holding major corporations for ransom, cybercrime is big business, dealing in big money. If you’re a CISO or other security professional, you have to deal with the aftermath of such attacks, but simply responding isn’t nearly enough. Addressing attendees at the RSAC Conference in San Francisco, Google threat intelligence VP Sandra Joyce called on the industry to take the fight upstream to the attackers and ensure they have a very bad day.

“Our adversaries are evolving,” said Joyce. “They have serious resources in play. We see this in a shift toward mass extortion groups, attacking hundreds of targets simultaneously.” She pointed out that in a typical attack, the group that achieves initial access hands off its gains to a secondary group that uses the cyber-loot. Since 2022, the time between that initial access and the handoff has dropped from eight hours to 22 seconds.

Cyber attackers are shifting away from opportunistic data sales to pre-planned partnerships, noted Joyce. And adversaries now rely on AI to further advance speed, scale, and sophistication.

Why Reactive Security Is No Longer Enough

“Intelligence sharing is not sufficient,” said Joyce. “We have to do more. As defenders, we must go upstream to disrupt the attackers. We must move toward a philosophy of active defense.”

Our goal is to shift the development ecosystem, to make cyber attacks expensive and risky.

Joyce noted that she’s not talking about “hacking back” against the attackers. “This is legal and ethical use of intelligence to protect our own platforms,” she said. “Our goal is to shift the development ecosystem, to make cyber-attacks expensive and risky.”

Inside Google’s Playbook to Disrupt Hackers

Joyce explained that Google’s approach to disruption relies on four pillars: civil legal action, public disclosure, technical takedowns, and product hardening. As an example, she pointed out the IPIDEA proxy, noting that it “facilitates botnets, creates consumer risk, and introduces vulnerabilities.” Google turned the tables by obtaining court orders that seized and shut down the command-and-control servers behind IPIDEA. After the takedown, telemetry showed a huge drop in traffic associated with IPIDEA.

Joyce also discussed the GRIDTIDE global backdoor attack. “Our response to GRIDTIDE was to create massive friction,” she said. “We didn’t just block their access to assets like Google Sheets. We dismantled their environment.” Joyce noted that the infrastructure for this attack took many years to build. With it gone, the hacking group is back to square one.

Recommended by Our Editors

Disruption Is the New Defense

Joyce explained that Google’s approach is not to wait around for an AI-powered attack. Rather, the company aims to leverage AI to make the entire ecosystem inherently more secure.

“For disruption to work, we must activate as an industry,” said Joyce. “Every disruption has to feed intelligence back into our defenses.” If the whole community participates, she noted, we can make the ecosystem hostile to future abuse. “Together we can finally break this whac-a-mole cycle,” she concluded.