Google continues working to improve the security of its users, the last measure introduced by the company it the ‘Advanced Protection’ feature.
The Advanced Protection feature was designed to improve the security of users, who are at high risk of targeted attacks.
“We took this unusual step because there is an overlooked minority of our users that are at particularly high risk of targeted online attacks. For example, these might be campaign staffers preparing for an upcoming election, journalists who need to protect the confidentiality of their sources, or people in abusive relationships seeking safety.” reads the blog post published by Google.
“Sometimes even the most careful and security-minded users are successfully attacked through phishing scams, especially if those phishing scams were individually targeted at the user in question.”
Even if the threat actor obtains the victim’s credentials via spear phishing messages, advanced or using a malware he will not be able to access the Google account.
Users that want to enable the Google’s Advanced Protection feature need two physical security keys that work with FIDO Universal 2nd Factor (U2F).
U2F is an open authentication standard that allows users to securely access many online services, with one single device with no drivers, or client software needed.
This hardware-based two-factor authentication does not require secret codes via SMS, apps or emails.
According to Google, the new feature implements the best protection against:
- Phishing.
- Accidental sharing.
- Fraudulent account access.
“They [security devices] use public-key cryptography and digital signatures to prove to Google that it’s really you,” the post reads. “An attacker who does not have your Security Key is automatically blocked, even if they have your password.” continues Google.Advanced Protection offer three features to keep your account safe:
The Google Advanced Protection program implements the following features:
- Physical Security Key: The access to the account is allowed only if the user is in possession of a U2F security key.
- Limit data access and sharing: Enabling this feature only Google apps to get access to your account, for now, other trusted apps will be added in the future.
- Blocking fraudulent account access: If the user loses the U2F security key, the account recovery process will involve additional steps, “including additional reviews and requests for more details about why you’ve lost access to your account” to prevent fraudulent account access.
Advanced Protection feature is not designed for everyone, but only for people, like journalists, government officials and activists, who are at a higher risk of being targeted by government or sophisticated hackers and ready to sacrifice some convenience for substantially increased e-mail protection.
Currently, Google users can enroll in the Advanced Protection Program using Google Chrome that already supports the U2F standard for Security Keys, other browsers are expected to support the same technology.
Users that want to use the Advanced Protection have to sign up at the following address:
https://landing.google.com/advancedprotection/
Google also announced the partnership with security firm ESET for malware detection in the Chrome browser through the Chrome Cleanup feature.
Chrome Cleanup now leverages the malware detection engine from ESET.
“Under the hood, we upgraded the technology we use in Chrome Cleanup to detect and remove unwanted software. We worked with IT security company ESET to combine their detection engine with Chrome’s sandbox technology.” Google announced in a blog post. “We can now detect and remove more unwanted software than ever before, meaning more people can benefit from Chrome Cleanup. Note this new sandboxed engine is not a general-purpose antivirus—it only removes software that doesn’t comply with our unwanted software policy.”
Source:https://securityaffairs.co/wordpress/64481/security/google-advanced-protection.html
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
