{"id":89039,"date":"2023-04-22T03:58:52","date_gmt":"2023-04-22T03:58:52","guid":{"rendered":"https:\/\/www.techrepublic.com\/?p=4070806"},"modified":"2023-04-22T03:58:52","modified_gmt":"2023-04-22T03:58:52","slug":"google-moves-to-keep-public-sector-cybersecurity-vulnerabilities-leashed","status":"publish","type":"post","link":"https:\/\/cloudnewshub.com\/?p=89039","title":{"rendered":"Google moves to keep public sector cybersecurity vulnerabilities leashed"},"content":{"rendered":"<div><img decoding=\"async\" src=\"http:\/\/cloudnewshub.com\/wp-content\/uploads\/2023\/04\/google-moves-to-keep-public-sector-cybersecurity-vulnerabilities-leashed.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<div id>\n<p> Google Cloud and The Center for Internet Security, Inc., launched the Google Cloud Alliance this week with the goal of advancing digital security in the public sector.&nbsp; The Center for Internet Security, founded in 2000 to address growing cyber threats and establish a set of cybersecurity protocols and standards like &nbsp;CIS Critical Security Controls and &#8230; <\/p>\n<\/div>\n<div id>\n<p><span>Google Cloud and The Center for Internet Security, Inc., launched the Google Cloud Alliance this week with the goal of advancing digital security in the public sector.&nbsp;<\/span><\/p>\n<p><span>The Center for Internet Security, founded in 2000 to address growing cyber threats and establish a set of cybersecurity protocols and standards like <\/span><a href=\"https:\/\/www.cisecurity.org\/controls\/implementation-groups\/ig1\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span>&nbsp;CIS Critical Security Controls<\/span><\/a><span> and<\/span><a href=\"https:\/\/www.cisecurity.org\/cis-benchmarks\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span> CIS Benchmarks<\/span><\/a><span>, assists state and local governments in cyber threats.&nbsp;<\/span><\/p>\n<p><span>Jump to:<\/span><\/p>\n<p><span>Google Cloud said it will bring members and services from its<\/span><a href=\"https:\/\/cloud.google.com\/security\/gcat\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span> Google Cybersecurity Action Team<\/span><\/a><span>, including insights from its<\/span><a href=\"https:\/\/services.google.com\/fh\/files\/blogs\/gcat_threathorizons_full_jan2023.pdf\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span> Threat Horizons reports<\/span><\/a><span> and Mandiant web intelligence division to weigh in on on \u201csecuring the&nbsp; broader technology ecosystem \u2013 especially as it relates to cloud posture and overall cybersecurity practices,\u201d according to a joint statement.<\/span><\/p>\n<p><span>As reported in <\/span><a href=\"https:\/\/www.techrepublic.com\/article\/google-cloud-offers-aoss-free\/\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span>TechRepublic<\/span><\/a><span>, Google also released this month its Assured Open Source Software (Assured OSS) service for Java and Python ecosystems at no cost. The move came after an increasing trend in politically motivated denial-of-service attacks.<\/span><\/p>\n<p><span>The search engine giant responded by releasing its<\/span><a href=\"https:\/\/www.techrepublic.com\/article\/google-launches-project-shield\/\"><span> Project Shield<\/span><\/a><span> distributed DDoS defense to government sites, news and independent journalists, as well as sites related to voting and human rights.<\/span><\/p>\n<h2 id=\"tribal\">Securing state, local, tribal, territorial government organizations<\/h2>\n<p>Google Cloud, which recently created<a href=\"https:\/\/cloud.google.com\/blog\/topics\/public-sector\/announcing-google-public-sector\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span> Google Public Sector<\/span><\/a><span> to support federal, state, and local governments and educational institutions, had announced in Aug. 2021 a $10 billion commitment to public sector security over five years.&nbsp;<\/span><\/p>\n<p><span>The Center for Internet Security operates the Multi-State and Elections Infrastructure Information Sharing and Analysis Centers, which support the rapidly changing cybersecurity needs of state, local, tribal, and territorial government organizations, including critical infrastructure sub-sectors like K-12 schools and elections offices.&nbsp;<\/span><\/p>\n<p><span>\u201cThis partnership between CIS and Google is particularly exciting because it is bringing together two powerhouse perspectives on cybersecurity and applying them to the highly-targeted and historically cyber underserved community of U.S. State, Local, Tribal, and Territorial government organizations,\u201d said Gina Chapman, executive vice president, sales and business services at CIS, in a statement. \u201cThe cybersecurity needs of the public sector demand best-in-class, cost-effective solutions that include implementation and operational support, and we look forward to how we can work together to support this community.\u201d&nbsp;&nbsp;<\/span><\/p>\n<h2 id=\"ethical\">Protecting ethical hackers, keeping vulnerabilities out of the wild<\/h2>\n<p><span>Google is also a founding member of a separate set of initiatives launched early this month under the aegis of the Center for Cybersecurity Policy and Law:&nbsp;<\/span><\/p>\n<ul>\n<li><span>The Hacking Policy Council, a division of the Center for Cybersecurity Policy and Law (CCPL) that will confront legislation aiming to restrict ethical hacking activities such as pen testing, and requires premature disclosure of vulnerabilities to government agencies or the public.<\/span><\/li>\n<li><span>The Security Research Legal Defense Fund, will help fund legal representation for persons that face legal problems due to good faith security research and vulnerability disclosure in cases that would advance cybersecurity for the public interest.<\/span><\/li>\n<\/ul>\n<p><span>Harley Geiger, counsel at Venable LLP, said the two organizations will address section 1201 of the Digital Millennium Copyright Act.&nbsp;<\/span><\/p>\n<p><span>\u201cTo keep it high level, Section 1201 has a restriction on making available tools that can circumvent tech protection measures to software,\u201d he explained. \u201cBasically, if you are making available tools to get around software security measures there is a legacy restriction on that, and it applies quite broadly but isn\u2019t often enforced.\u201d&nbsp;<\/span><\/p>\n<p><span>Geiger said that reform is needed because the very tools pen testers use to find vulnerabilities in software are, by necessity, designed to circumvent software protection measures.&nbsp;<\/span><\/p>\n<p><span>\u201cThat is just one aspect of policy that should be reformed that affects pen testing,\u201d he said.&nbsp;&nbsp;<\/span><\/p>\n<aside class=\"pinbox right\">\n<h3 class=\"heading\">Must-read security coverage<\/h3>\n<\/aside>\n<h2 id=\"proposals\">Addressing proposals to mandate the release of vulnerabilities<\/h2>\n<p><span>The others include requirements around the identification of vulnerabilities, which he said constitutes a high risk to companies because, in an age of zero trust, sharing vulnerabilities to government entities is functionally the same as sharing it to the wild.&nbsp;<\/span><\/p>\n<p><b>SEE: Vulnerabilities in APIs a <\/b><a href=\"https:\/\/www.techrepublic.com\/article\/api-akamai-acquires-neosec\/\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><b>growing concern<\/b><\/a><b> (TechRepublic)<\/b><\/p>\n<p><span>\u201cVulnerabilities are being discovered on a continuous basis so, of course you want to minimize the attack surface,\u201d he said, \u201cBut it is difficult to conceive stopping the production process every time a new vulnerability has been discovered.\u201d<\/span><\/p>\n<p><span>Which, he explained, would be necessary if vulnerabilities were disclosed early. The specific example is the European Union\u2019s proposed Cyber Resilience Act.&nbsp;<\/span><\/p>\n<p><span>\u201cIf or when it passes, the EU will be as impactful to cybersecurity as the <\/span><a href=\"https:\/\/gdpr.eu\/what-is-gdpr\/\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span>GDPR<\/span><\/a><span> was to privacy,\u201d he said. \u201cThe way it is currently drafted it would require any manufacturer of software to disclose a vulnerability to an EU government agency within 24 hours of determining that vulnerability has been exploited without authorization. The concern with this is that within 24 hours the vulnerability is not likely to be patched or mitigated at that point. What you may have then is a rolling list of software packages with unmitigated vulnerabilities being shared with potentially dozens of EU government agencies,\u201d Geiger added.&nbsp;<\/span><\/p>\n<p><span>In other words, he explained, NISA would share it with the computer security readiness teams of the member states involved as well as the surveillance authorities.&nbsp;<\/span><\/p>\n<p><span>\u201cIf it\u2019s EU wide software, you are looking at more than 50 government agencies that could potentially be involved. The number of reports coming in could be voluminous. This is dangerous and presents risks of that information being exposed to adversaries or used for intelligence purposes,\u201d he said.&nbsp;&nbsp;<\/span><\/p>\n<p><span>According to the CCPL, the Hacking Policy Council will:&nbsp;<\/span><\/p>\n<ul>\n<li><span>Create a more favorable legal environment for vulnerability disclosure and management, bug bounties, independent repair for security, good faith security research&nbsp; and pen testing.<\/span><\/li>\n<li><span>Grow collaboration between the security, <\/span><span>business<\/span><span>&nbsp;and policymaking communities.<\/span><\/li>\n<li><span>Prevent new legal restrictions on security research, pen testing or vulnerability disclosure and management.<\/span><\/li>\n<li><span>Strengthen organizations\u2019 resilience through effective adoption of vulnerability disclosure policies and security researcher engagement.<\/span><\/li>\n<\/ul>\n<p><span>Other founding members of the council include Bugcrowd, HackerOne, Intel, Intigriti, and LutaSecurity.&nbsp;<\/span><\/p>\n<p><span>Also See:&nbsp;<\/span><\/p>\n<p><a href=\"https:\/\/www.techrepublic.com\/article\/cheat-sheet-how-to-become-a-cybersecurity-pro\/\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span>How to become a cybersecurity pro: A cheat sheet <\/span><\/a><span>(TechRepublic)<\/span><\/p>\n<p><a href=\"https:\/\/www.techrepublic.com\/article\/best-antivirus-software\/\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span>The 10 best antivirus products you should consider for your business <\/span><\/a><span>(TechRepublic)<\/span><\/p>\n<p><a href=\"https:\/\/www.techrepublic.com\/resource-library\/downloads\/hiring-kit-security-analyst\/\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span>How to recruit and hire a Security Analyst <\/span><\/a><span>(TechRepublic Premium)<\/span><\/p>\n<p><a href=\"https:\/\/flipboard.com\/@techrepublic\/cybersecurity-and-cyberwar-r36o4ug0z\" target=\"_blank\" rel=\"noopener \u201dnofollow noreferrer\"><span>Cybersecurity and cyberwar: More must-read coverage <\/span><\/a><span>(TechRepublic on Flipboard)<\/span><\/p>\n<p> <!-- default newsletter at the end --> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>Google Cloud and The Center for Internet Security, Inc., launched the Google Cloud Alliance this week with the goal of advancing digital security in the public sector.&nbsp; The Center for Internet Security, founded in 2000 to address growing cyber threats and establish a set of cybersecurity protocols and standards like &nbsp;CIS Critical Security Controls and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":89040,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[40,783,154,696,27],"tags":[],"class_list":["post-89039","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud","category-cloudsync","category-google","category-malware","category-software"],"_links":{"self":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/89039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=89039"}],"version-history":[{"count":0,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/posts\/89039\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=\/wp\/v2\/media\/89040"}],"wp:attachment":[{"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=89039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=89039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cloudnewshub.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=89039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}