natali_mis - stock.adobe.com

News

Google bets on AI-backed cyber controls for Workspace users

Zero-trust and digital sovereignty controls are the focus of a series of enhancements being made for Google Workspace users

Alex Scroxton
By
Published: 24 Aug 2023 15:00

Google has moved to address some of the more pressing needs faced by users of its Workspace service, adding artificial intelligence (AI)-backed features to cover zero-trust, digital sovereignty and threat defence controls as part of a series of enhancements to the platform.

Yulie Kwon Kim, vice-president of product management, and Andy Wen, director of product management at Google Workspace, explained that security, confidentiality and compliance continue to be top of mind for users as attack volumes, and costs, continue to grow.

“The sheer scale of modern attacks and the sophistication of motivated adversaries are something that legacy productivity solutions can’t keep pace with,” they said.

“There is a better way – a cloud-native architecture rooted in zero-trust principles and augmented with AI-powered threat defences. This is how we architected Google Workspace, resulting in real-world benefits for our customers.”

Google claims Workspace already faces 41% fewer security incidents on average than other comparable offerings, as well as far fewer vulnerabilities in general, but is now bringing AI to bear to further improve this situation. “In security, the job is never done,” said Kim and Wen.

The new zero-trust controls include:

  • AI classification for Google Drive, enabling admins to use customisable, confidentiality-preserving AI models to classify and label their files. This feature is already available in preview;
  • Enhanced data loss prevention (DLP) controls for Gmail, allowing admins to set conditions that must be met for someone to be able to share files through Drive. This feature will be previewed later in 2023;
  • Context-aware DLP controls in Drive to allow security teams to better control the sharing of sensitive information around and outside the organisation. This feature will also be previewed later in the year.

Zero-trust capabilities

Pharma giant Roche has already been road-testing the zero-trust capabilities. Tim Ehrhart, domain lead for information security at the Basel, Switzerland-based firm, said: “Our organisation has been striving to break away from VPN and office network connections for years.

“Context-Aware Access [CAA] has helped us manage our risks by not making access a binary choice, but allowing for more flexibility in access policies and allowing them to be applied to the right people, applications and data,” he added.

“Since using CAA, we’ve been able to allow our users to use more of Google Workspace for a broader set of scenarios with more confidence in the safety of that work.”

Read more about cyber at Google

The digital sovereignty controls, meanwhile, are designed to improve the experience for organisations that understand the importance of data sovereignty but may have settled for data residency without fully appreciating the limitations of doing so. These features will supposedly “provide a step change in attestable digital sovereignty”, combining secure-by-default infrastructure, technical data access controls and industry certifications in a single cloud instance.

More specifically, the enhancements cover:

  • Client-side encryption (CSE) enhancements, including support of mobile apps in Google Calendar, Gmail and Meet, the ability to set CSE as default for select business units, guest access support in Meet, and more besides. Some of these features are already up and running for customers to preview, others will come later in the year;
  • Regional data residency and compliance controls, allowing organisations to choose if their covered data is processed in the European Union (EU) or US, as well as introducing the option to store a copy of their Workspace data in a country of their choice. This will be previewed later in 2023.

Shaun Bookham, UK operations and technology director of PwC UK, who piloted the new controls, said: “I observed first hand that Google understands the importance of technical data boundaries, not only for PwC and our requirements, but for that of our clients.

“Through influencing the development of these CSE and Access Management capabilities, I have confidence that Google will continue to adapt to rapidly evolving regulatory requirements, enabling us to transform the way we work whilst remaining at the forefront of sovereignty and compliance,” he said.

Finally, Google is also previewing two new threat defence controls, one of which will extend its AI-powered defences to provide additional sensitive actions – like email filtering or forwarding – in Gmail, and the other to mandate multi-factor authentication for admin accounts across all of Google’s channel partners, and its largest enterprise customers.

Attendees at Google Cloud Next, which begins next week, will be able to attend sessions on the new features and sign-up for early access to try them out.

Read more on Web application security