Google Cloud’s BeyondCorp Enterprise security platform is now generally available, the company announced in a blog post. The new zero trust identity security platform is aimed at Google’s enterprise clients and built on the company’s own implementation of BeyondCorp. Google uses this technology suite internally to protect their own applications, data, and users without relying on a VPN.

The new platform replaces the BeyondCorp Remote Access, which was introduced in 2020 and was a cloud-based solution that made access to internal applications easier and more secure for enterprises and their employees. With the new enterprise security platform, Google Cloud will provide real-time and end-to-end protection for its business clients. This will include non-disruptive and agentless support built into the Chrome enterprise browser.

It will also provide continuous and real-time end-to-end protection such as the addition of “embedded data and threat protection” to the Chrome enterprise browser. Google says this will help “prevent malicious or unintentional data loss and exfiltration and malware infections from the network to the browser.”

Other features in the end-to-end protection include “strong phishing-resistant authentication”, which will ensure users are who they say they are. It will also ensure”continuous authorisation for every interaction between a user and a BeyondCorp-protected resource.” Further, the platform will ensure end-to-end security from user to app and app to app.

Google says the platform will also give enterprises access to its scalable Distributed Denial of Service (DDoS) protection service. Protection against DDOS attacks is crucial for enterprises, which are more reliant on cloud and digital services in today’s times given the COVID-19 pandemic.

Google’s network across the globe includes 144 edge locations in over 200 countries. This allows users to work with BeyondCorp’s security capabilities from anywhere, and protect data and applications across their devices and clouds. Google has also boosted its BeyondCorp Alliance by allowing customers to integrate zero-trust protection and endpoint security tools with their existing network. This Alliance includes other companies like Palo Alto Networks, Symantec, Check Point, Citrix, CrowdStrike, Jamf, Lookout, Tanium, and VMware.

Google Cloud Tuesday unveiled BeyondCorp Enterprise, its new zero trust identity and security platform with agentless support delivered through Google’s Chrome browser that’s used by more than 2 billion users globally.

Now generally available, BeyondCorp Enterprise is designed to provide continuous and real-time end-to-end protection, scalable DDoS protection and built-in, verifiable platform security. It includes embedded data and threat protection built into Chrome—which has been quietly updated already— to prevent malicious or unintentional data loss and exfiltration and malware infections from the network to the browser; phishing-resistant authentication; and continuous authorization for all interactions between a user and BeyondCorp-protected resources.

Many of the zero trust options from other providers focus on the connection from the user to the app or the user to the network, according to Rick Caccia, Google Cloud security’s marketing head. BeyondCorp Enterprise is the only system where every single interaction—from user to app, app to app to other infrastructure components all the way through—is reauthorized, Caccia said.

“The years of security we’ve built into the system enables the trust that cloud users need,” Caccia said.

The turnkey product offering encompasses a series of functionalities that leverage what Sunil Potti, general manager and vice president of cloud security for Google Cloud, calls “significant amplifiers that only Google can provide.”

“Essentially, all of our PoPs [points of presence] now are lighted up with the same functionality that powers Google employees,” Potti said. “[They’re] now available to essentially both protect, but also transit, the Google network from wherever users are to wherever their apps are in the form of BeyondCorp Enterprise.”
The offering extends to connections to Google’s 144 global network edge locations.

The Chrome browser now has built-in capabilities that use Google’s Cloud Data Loss Prevention and Safe Browsing APIs, a Google service that lets client applications check URLs against Google’s constantly updated lists of unsafe web resources.

“We worked with Chrome to build all those into BeyondCorp Enterprise and turn it on,” Caccia said. “It also uses things like two-factor keys so that we can prevent against phishing and credential theft. In the network itself, we have cloud-based micro-segmentation, so that every piece of the network implements authorizations, sort of from component to component. And we have our own global certificate management system built in that customers can use to make sure that they’ve got updated certs anywhere that encryption has to happen.”

As evidenced by the SolarWinds breach, being able to verify a platform from chips to apps and having features such as binary authorization to make sure that apps haven’t had their source code tampered with are important, Caccia noted.

“All of those are in the network,” he said. “It means that customers can trust this as a platform to run on.”

Google Cloud’s BeyondCorp Approach

Zero trust is a security concept based on the premise that there is no inherent trust in a network, and that all access to a network must be secured, authorized and granted based on knowledge of identities and devices.

BeyondCorp refers to the zero trust access approach that Google Cloud started pursuing in 2011. It’s the technology suite that it uses internally to protect Google’s applications, data and users, allowing its own employees to work from untrusted networks on a variety of devices without using a client-side VPN.

“Given the new work-from-home environment, but also the recent attacks, ultimately someone has to come in and say, ‘Look, unlike a mobile world, where a new OS really had built-in security, we still live in a world of heterogenous OSes, whether it be public clouds, private clouds and so forth,” Potti said. “So unless we make a seismic change in terms of offering a zero trust OS of some sort as a layer that sits on top of this hybrid environment, I don’t think we’ll ever make a sea change in terms of trust and risk management. That’s really the genesis behind how we’re thinking about BeyondCorp Enterprise as a truly comprehensive view towards zero trust.”

BeyondCorp Enterprise extends and replaces BeyondCorp Remote Access, Google’s cloud offering introduced last April that allows organizations’ employees and extended workforces to access internal web applications—customer service systems, call center applications, software bug trackers, project management dashboards, employee portals—from almost any device, without a traditional remote-access VPN, while protecting their data.

“Post-COVID, we were able to give what I call a ‘downpayment’ on the uber zero trust offering that we’ve been working on for a few years in terms of packaging BeyondCorp in its entirety, not just in a piecemeal solution, so that customers anywhere could consume the same capabilities that we currently use to protect our employees and our applications and so forth,” Potti said.

The challenge in developing BeyondCorp Enterprise was enabling disruptive security innovation with a cost-effective offering that requires minimal disruption to existing deployments and business processes, according to Potti.

BeyondCorp Enterprise Partner Ecosystem

Google Cloud designed BeyondCorp Enterprise as an open and extensible offering that can support a variety of complementary security offerings from its BeyondCorp Alliance partners. It intentionally built a forward-looking ability to seamlessly plug in services and value-adds, both in terms of new capabilities on the endpoint or inside the network close to the app, and exchange data and signals, so the overall “IQ” of the system is improving with a partner ecosystem, according to Potti.

That ecosystem includes Citrix Systems, CrowdStrike, VMware and Tanium, a Kirkland, Wash.-based endpoint management and security provider, among others.

“For most devices, there’s more to them than the browser, and that’s where a partner like Tanium [comes in with] their ability to manage the endpoint, make sure there are patches and also to detect and block threats on there,” Caccia said. “Working together, we have APIs that the two products use so that we can understand the endpoint. Chrome browser drives that, and Tanium can drive that.”

Tanium’s customers include 70 Fortune 100 companies and the U.S. Department of Defense, which have been struggling with need to move toward zero trust.

“What the industry historically has presented to them was a very fractured model for this, so that, in essence, they had to cobble together potentially 10 different vendors to get a contiguous zero trust experience,” said Orion Hindawi, Tanium’s co-founder and CEO. “Just keeping that working was something that was beyond the vast majority of companies.”

Managing the endpoint state is required to implement zero trust, and Tanium had been waiting for a provider to come out with a fabric that would allow a contiguous solution, according to Hindawi.

“It’s incredibly convenient that it’s Google, because I think Google, if you look internally, is by far the leading implementer of zero trust in industry in production,” he said. “What we’ve been able to do with them has been really novel in the sense that we’ve been able to spend a lot of time customizing the interfaces that we’re supplying data into. Being able to change state and have that state reflect access and ability to use the environment in real time is incredibly critical.

“We’ve actually seen Google implement on the back end, at the kind of fabric layer, the ability to respond to those inputs incredibly quickly. If something isn’t patched correctly, or users are exhibiting behavior that you don’t expect, or potentially we see applications that are misbehaving, in real time, you need to be able to condition is identity granted, are you able to use applications,” Hindawi said.

From Tanium’s perspective, endpoint management is critical, according to Hindawi.

“Coupled with a really powerful zero trust element, we really think it can fundamentally transform the way that our customers perceive their responsibility for security,” he said. “And I think this is the first time actually in our industry where we’ve seen an end-to-end approach that looks like it’s absorbable by customers and that can actually give them the value that zero trust has been purported to provide for a long time, but that they’ve really been searching for a way to implement.”

Deloitte Consulting

Google Cloud will continue collaborating with Deloitte Consulting’s cyber practice to deliver end-to-end architecture, design and deployment services to customers.

“Google has built a reputation and a pedigree of sharing and bringing to market the champagne that they drink in-house,” said Arun Perinkolam, a Deloitte Consulting principal who serves as its Google Cloud cyber practice leader.

Organizations today are faced with the rapid dissolution of traditional network parameters as a result of the continued shift to the cloud and hybrid IT, according to Perinkolam.

“The challenges that organizations now have with traditional perimeter-centric security approaches and technologies have elevated the need for continuous verification of trust—across an organization’s device base, user base and application base,” Perinkolam said. “At Deloitte, we recognize the move to a zero trust model and mindset as the sustainable path forward for organizations who are looking to circumvent some of these challenges while creating a cybersecurity program that is truly next generation—one that can also help address the need for scale across hybrid IT environments and offer a simplified secure user experience. When we look at Google’s BeyondCorp technology offering, it’s able to address just that.”

Forescout Technologies has expanded its partnerships and integrations with Splunk, CrowdStrike and CyberArk to enable joint customers to bridge security gaps and strengthen the cyber-physical risk posture across the entire network, while maintaining operational integrity of critical systems.

“Organisations with complicated networks struggle with outdated methods of managing industrial control system (ICS) and OT assets across their infrastructure. Forescout’s integrations with industry-leading technologies from Splunk, CrowdStrike and CyberArk deliver cohesive and contextual insights of all assets, improve operational integrity and manage associated security threats down to the device level,” says Forescout chief product and strategy officer Pedro Abreu.

Splunk

Security operations teams can leverage a new Forescout and Splunk integration to defend an organisation across all device types and network tiers.

The new Forescout OT Network Security Monitoring for Splunk App integrates Forescout eyeInspect with Splunk Enterprise and Splunk Enterprise Security.

The app consolidates contextual device data and alerts into pre-built dashboards and prioritises security and operational alerts to defend OT and ICS networks against operational failures and cyberattacks, such as Ripple20, EKANS, WannaCry, NotPetya and TRITON.

The full Forescout and Splunk integration enables organisations to streamline enterprise security across the entire threat lifecycle.

This app will also support the new OT Security Add-on for Splunk, which accelerates time to insight with structured data models that make it easy to correlate OT data from various sources.

CrowdStrike

Forescout’s expanded partnership with CrowdStrike now includes the eyeInspect OT solution for joint threat hunting in internet of things (IoT) and ICS/OT infrastructure.

Delivered through the Forescout eyeExtend module, enhanced integration with the CrowdStrike Falcon platform ensures customers receive threat intelligence data across enterprise networks and critical infrastructure.

CrowdStrike’s Falcon platform correlates 4 trillion endpoint-related events per week in real time from across the globe, fuelling one of the world’s most advanced data platforms for security.

CyberArk

The Forescout platform now integrates Forescout eyeInspect device intelligence with the CyberArk Privileged Access Security Solution to centrally discover, manage and secure privileged accounts across a broader range of devices, common to IoT, OT and ICS environments.

Forescout’s privileged account discovery capabilities now include Mac and Linux endpoints.

The integration also empowers organisations to automatically segment and enforce credential and user compliance. This is critical for organisations that need to preserve the continuity and accountability of the systems.

The integration includes IoT/OT/ICS orchestrated workflows between CyberArk and Forescout to reduce manual workloads and rapidly respond to threats without operational disruption.