Chronicle CyberShield: Google Cloud’s approach to strengthen nation-wide cyber defence

One of the primary functions of any government is to protect its citizens, institutions, infrastructure, and way of life. With the rise of the global Internet, the world is more connected and traditional borders do not exist, meaning those same citizens, institutions, infrastructure, and way of life are at greater risk of malicious activity online.

The threat profile of many governments has evolved, and it is more important than ever to protect and defend critical online services.

Benefits of digital transformation

Of the intrusions investigated by Mandiant in 2022, response efforts for government-related organisations captured 25% of all investigations, compared to 9% in 2021. This primarily reflects the extensive work Mandiant has conducted in support of customers affected by the Russian invasion of Ukraine.

To help governments around the world continue to realise the benefits of digital transformation while mitigating the risk of cyber threats, we’ve developed Chronicle CyberShield to provide government agencies with a solution that integrates threat intelligence, detection, and response. Chronicle CyberShield is unique in that it enables multiple government entities to proactively and rapidly share threat information, accelerate investigations and initiate a united response.

Situational threat awareness at a national level

Large attack surface across a government makes visibility and situational grasp of threat landscape

Governments need to invest in improving their cybersecurity capabilities and cultivate a collaborative culture of enhanced information-sharing and threat awareness at scale. They need to reduce the impact and severity of cyber attacks on critical national infrastructure and develop capabilities to secure the networks that support them. Further, as governments adopt the cloud to accelerate innovation and drive repeatable outcomes, they need to ensure that it’s secure and reliable. Lastly, and most importantly, government entities need to be empowered with advanced skills and capabilities to defend against an ever-evolving threat landscape.

The large attack surface across a government makes visibility and situational awareness of the threat landscape paramount. Even governments with mature cybersecurity postures are at risk of the most advanced persistent threat actors who constantly evolve their techniques. As a result, rapid aggregation of security events and real-time sharing of actionable cyber threat intelligence widely across the government sector is necessary to prevent widespread cyber incidents.

Chronicle CyberShield

Chronicle CyberShield enables governments to build an enhanced cyber threat intelligence capability; protect web-facing infrastructure from cyber attacks; monitor and detect indicators of compromise, malware, and intrusions; and rapidly respond to cyber attacks to limit widespread impacts.

In addition, it enables governments to raise threat and situational awareness, build cybersecurity skills and capabilities, and facilitate knowledge sharing and collaboration to raise the bar for security at a national level.

Threat awareness with a modern security operations centre

Chronicle CyberShield, governments can leverage cyber threat intelligence from Google and Mandiant

In the digital world, operating a sophisticated and streamlined Security Operations Centre (SOC) is at the core of maintaining digital integrity and security. A primary component of Chronicle CyberShield is establishing a modern government SOC, comprising a network of interconnected SOCs to scale and aggregate security threats. This empowers governments to operate a cyber defence centre for enhanced detection, protection against major threats, and automated response and incident management across multiple entities.

As part of Chronicle CyberShield, governments can leverage cyber threat intelligence from Google and Mandiant, now part of Google Cloud, to build a scalable and centralised threat intelligence and analysis capability. This is integrated operationally into the government SOC to identify suspicious indicators and enrich the context for known vulnerabilities.

Chronicle CyberShield

In addition, Chronicle CyberShield allows governments to build a coordinated monitoring capability with Chronicle SIEM to simplify threat detection, investigation, and hunting with the intelligence, speed, and scale of Google. By implementing Chronicle across a network of SOCs, attack patterns and correlated threat activity across multiple entities is available for investigation and analysis. With Chronicle’s cloud-focused scalable architecture and innovative pricing model, governments can analyse large volumes of security telemetry within seconds without sacrificing visibility, performance, or costs.

Once threats are identified in Chronicle SIEM, automated playbooks can be developed in Chronicle SOAR to address root causes and reduce the impact of threats and cyber-attacks. Integration with third-party solutions enables Chronicle SOAR to enrich data with threat intelligence and additional context to get faster insights. Analysts in the government SOC can focus on resolving cases faster and reducing dwell time by uncovering threats faster and containing them more rapidly.

Incident management and response support

Staying ahead of attackers requires constant proof to support detection and response abilities

When major cyber attacks take place, time is of the essence to clearly understand the scope and magnitude of impact. Governments need additional support to augment their in-house capabilities to respond to the full lifecycle of any major security incident. With Chronicle CyberShield, governments can agree on pre-established terms and conditions for incident management and response support from Mandiant, saving precious time when it matters the most.  

Lastly, staying ahead of attackers requires continuous validation to strengthen detection and response capabilities. Governments need to continuously test security controls by launching real-world attacks against critical assets to identify vulnerabilities and harden systems. Chronicle CyberShield includes continuous red teaming and penetration testing services delivered by Mandiant to test security controls and protect critical assets by identifying and mitigating security gaps and vulnerabilities. By continuously assessing security controls and capabilities, governments can rapidly identify and respond to threats. This results in heightened situational awareness and prepares teams to mobilise quickly in response to major threats.

Protect web applications from cyberattacks

In addition to monitoring and responding to threats, Chronicle CyberShield provides governments with the capability to protect web applications from large-scale cyber attacks. With the Digital Security component of Chronicle CyberShield, governments can integrate with existing solutions and build anti-DDoS, anti-bot, web application firewall (WAF), and API protection to protect against new and existing threats.

Cloud Armour protects applications from DDoS attacks and mitigates against OWASP Top 10 risks. Integration with reCAPTCHA Enterprise identifies fraudulent activity, spam, and abuse like scraping, credential stuffing, automated account creation, and exploits from automated bots. Lastly, applications and APIs are secured using Apigee API management.

Defend against tomorrow’s attacks today

CyberShield includes consulting services from Google Cloud and Mandiant to further assist governments. By leveraging Google Cloud’s professional services and Mandiant’s government consulting solutions and expertise, governments can develop core capabilities to improve security governance, upskill talent in government, enhance knowledge sharing and collaboration, and drive effective security operations.

CyberShield includes consulting from Google Cloud and Mandiant to further assist governments

Governments can benchmark their capabilities against the National Cybersecurity Capability Framework and establish an Advanced Skills Academy with instructor-led and web-based training on cybersecurity topics including cloud security fundamentals, threat modelling, and secure architecture design. With support from Google Cloud and Mandiant, governments can run cyber-attack simulations and tabletop exercises to test existing controls and be well-prepared for future cyber attacks.

Summary

In summary, with Chronicle CyberShield governments will be able to enhance situational threat awareness across a network of interconnected SOCs powered by the speed, scale and performance of Chronicle sec ops suite.

In addition, governments get advanced protection for web apps, services, and APIs against DDoS, L7 and bot attacks at a Google scale. Lastly, Chronicle CyberShield empowers governments with the resources to improve security governance, build skills and make strategic decisions to protect the nation.