Bye-Bye DIY: Frictionless Security Operations with Google

Bye-Bye DIY: Frictionless Security Operations with Google

Speakers: Product Marketing Lead, Google Cloud for Multi-Cloud Security

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=XBMih2yaPMI

Overview

This talk, presented at RSAC 2024, addresses a critical challenge facing modern security operations centers (SOCs): the pervasive and often ineffective "do-it-yourself" (DIY) approach to security. The speaker, a product marketing lead for Google Cloud's multi-cloud security offerings, argues that current SecOps models, characterized by manual integration of disparate tools, custom detection engineering, and slow threat intelligence processing, are failing to keep pace with evolving threats. This inefficiency is starkly illustrated by the fact that over half of organizations impacted by breaches in 2023 were notified by external parties, rather than detecting the intrusions themselves.

The core message of the presentation is a call to move beyond these antiquated DIY methods towards a more integrated, automated, and AI-driven security operations framework. Google proposes a frictionless approach leveraging its cloud-native security platforms, comprehensive threat intelligence, and advanced AI capabilities, particularly its Gemini models. The aim is to empower security teams to focus on high-value activities by offloading much of the laborious, repetitive, and often duplicated work, thereby improving detection efficacy, accelerating response times, and ultimately making security operations more effective and less prone to human error.

The talk highlights Google's strategic investments in security, drawing upon the vast insights from Mandiant's frontline incident response, the extensive community contributions of VirusTotal, and Google's own global infrastructure intelligence. By integrating these powerful components with generative AI, Google aims to provide a security ecosystem where data ingestion is limitless, detection engineering is augmented, threat intelligence is actionable and fast, and even complex malware analysis can be performed with unprecedented speed and accuracy, fundamentally transforming the SecOps landscape.

Background

▶ Watch: Introduction: The 'Bye-Bye DIY' security operations challenge (0:00)

The genesis of the "Bye-Bye DIY" philosophy stems from a stark reality: traditional security operations are struggling. The speaker vividly illustrates this with data from Mandiant's 2023 incident response engagements, revealing that a staggering 56% of breached organizations were first notified of the compromise by an external party. This statistic underscores a fundamental flaw in many existing SecOps programs: a significant inability to detect sophisticated threats internally and in a timely manner.

The problem, as articulated, lies in the prevalent "DIY" mindset, where organizations are effectively handed a collection of "building blocks"—akin to IKEA furniture—and expected to assemble a fully functional security program. This often involves independently managing a security data lake, curating myriad detection rules, integrating multiple threat feeds, and developing bespoke response playbooks. This fragmented approach leads to immense toil, complexity, and a constant struggle to keep up with the rapidly evolving threat landscape. The speaker draws a personal analogy to a failed attempt at fixing a car pedal, emphasizing that some tasks are best left to experts, allowing organizations to focus on their core mission rather than becoming amateur security system builders.

Even as organizations transition from on-premises infrastructure to cloud environments for their security data lakes, many merely "lift and shift" existing capabilities without fully leveraging the inherent scalability and speed of cloud-native architectures. This often leads to persistent challenges, such as agonizing over the cost of ingesting specific data sources or the optimal duration for data retention. Google's assertion is clear: if an organization is forced to make such compromises on data, they are fundamentally on the wrong platform and still stuck in a DIY paradigm.

Furthermore, detection engineering, the "lifeblood of SecOps," is identified as one of the most labor-intensive and DIY aspects. Despite the constant evolution of threats, Google's research on its platform reveals a significant overlap: approximately 90% of detections created by customers are, in fact, common across many environments and could be provided out-of-the-box. This highlights a massive inefficiency where security teams are repeatedly solving the same problems, rather than focusing on unique, environment-specific challenges. Similarly, threat intelligence, while recognized as essential, often requires dedicated teams to perform extensive research, deduplication, and operationalization, leading to delays of days, weeks, or even months in addressing new threats. This background paints a clear picture of a security industry ripe for transformation, moving from reactive, manual, and fragmented operations to proactive, automated, and integrated solutions.

Key Findings

▶ Watch: The 'DIY Guy' problem in security operations (2:00)

The talk presents several pivotal findings and assertions that underpin Google's strategy for frictionless security operations:

• Alarming Breach Notification Statistics: Mandiant's 2023 incident response data reveals that 56% of organizations were informed of their breaches by external parties. This highlights a critical failure in internal detection capabilities and emphasizes the urgent need for more effective SecOps programs.
• High Detection Engineering Overlap: Google's internal analysis indicates that roughly 90% of custom detection rules created by customers are common and could be standardized or provided as out-of-the-box solutions. This suggests significant wasted effort in manual detection engineering across the industry.
• AI for Rapid Detection Creation: Generative AI, specifically Gemini AI within Google Security Operations, can translate natural language requests into functional detection rules, drastically reducing the time and specialized knowledge required for detection engineering. This provides a valuable starting point, minimizing toil.
• Integrated, Actionable Threat Intelligence: The newly announced Google Threat Intelligence (GTI) offering consolidates insights from Mandiant's frontline incident response, Google Threat Research, and the vast VirusTotal community. This provides a comprehensive, deep, and broad view of the threat landscape, delivered in an actionable and timely manner (hours/days, not weeks/months).
• AI-Powered Threat Intel Analysis: Gemini AI can rapidly summarize complex threat information from diverse sources (Mandiant, VirusTotal, Google Threat Research) in response to natural language queries (e.g., "What's Hangman V2?"), and intelligently answer follow-up questions, greatly enhancing analyst efficiency.
• Proactive Threat Mitigation: Google Security Operations proactively matches 12 months of "hot telemetry" against GTI, enriching identified Indicators of Compromise (IOCs) with Tactics, Techniques, and Procedures (TTPs). This enables the rapid deployment of curated detections, often before public disclosure of vulnerabilities or exploits, as demonstrated by the scenario where Mandiant blog posts included one-click deployment for Google Security Operations customers.
• Groundbreaking AI Malware Analysis: Gemini 1.5 Pro, with its exceptionally large context window, demonstrated the ability to analyze the entire codebase of complex malware like WannaCry in just 34 seconds. It accurately identified the malware as ransomware, provided detailed analysis, and even pinpointed the C2 kill switch URL/domain. Crucially, this capability was also proven effective against zero-day malware, a significant advancement in automated threat analysis.

Technical Deep Dive

▶ Watch: Cloud data lake challenges: Data ingestion and retention decisions (4:20)

The technical foundation of Google's frictionless SecOps vision rests on a cloud-native architecture that addresses the limitations of traditional DIY approaches, heavily leveraging AI and integrated threat intelligence.

At the core is the concept of a security data lake that transcends the limitations of traditional deployments. Unlike "lift and shift" cloud migrations that retain on-premises inefficiencies, Google emphasizes a truly cloud-native design that offers inherent scalability and speed. The platform aims to eliminate the need for customers to make difficult decisions about data ingestion costs or storage duration. The assertion is that if an organization must choose what data to store or how long to keep it due to economic or effort constraints, they are on the wrong platform. The goal is to enable the ingestion of all security-relevant data without compromise, forming the bedrock for effective detection and response.

Detection Engineering, traditionally a highly labor-intensive and bespoke process, is significantly augmented through AI. Google's research highlights that approximately 90% of customer-created detections exhibit common patterns. This insight drives the provision of a vast library of curated, out-of-the-box detections, allowing security teams to focus their efforts on the remaining 10% that are truly unique to their environment. A notable example cited is the "Big Yellow Taxi" detection rule, developed by the State Department to identify an exploit in their email system. Google's approach for Workspace and Gmail, which are "born in the cloud" with powerful built-in security, is to proactively develop and provide such sophisticated detections, eliminating the need for customers to write them from scratch.

For the remaining custom detection engineering, Google introduces AI-powered assistance using Gemini AI within the Google Security Operations platform. Security analysts can use natural language prompts to describe a desired detection. Gemini AI then generates the corresponding detection rule, which can be further refined and modified using a rule editor. This capability dramatically reduces the reliance on specialized language expertise and provides a strong starting point, saving significant time and reducing analyst toil.

Threat Intelligence (TI) is another critical domain transformed by Google's integrated approach. The newly launched Google Threat Intelligence (GTI) is a comprehensive offering built on two key pillars:

1. Depth: This includes frontline, curated intelligence derived from Mandiant's extensive incident response engagements (over a thousand annually), where experts investigate and determine the root cause of breaches. It also incorporates dedicated threat intelligence research.
2. Breadth: This leverages the vast crowd-sourced intelligence from the VirusTotal community, a widely used platform for malware analysis. Additionally, Google's unique vantage point from operating numerous popular internet properties provides unparalleled insight into global attack trends and the threat landscape.

GTI is designed to be both actionable and fast, delivering intelligence in hours or days, rather than weeks or months. Gemini AI further enhances GTI by allowing analysts to query complex threat information using natural language. For instance, an analyst can ask, "What's Hangman V2?" and Gemini AI will rapidly synthesize information from dozens, if not hundreds, of articles, combining insights from Mandiant, VirusTotal, and Google Threat Research into a concise summary. The system also supports follow-up questions, such as "How does it persist?", providing deeper technical details on demand. This capability significantly reduces the manual research burden on threat analysts.

The application of threat intelligence within Google Security Operations is proactive and deeply integrated. The platform continuously matches 12 months of "hot telemetry" (recent security event data) against the entire GTI corpus. This process not only identifies raw IOCs but also enriches them with associated Tactics, Techniques, and Procedures (TTPs), allowing analysts to understand the broader attack context. Alerts are prioritized, incorporating "active breach intelligence" directly from Mandiant's ongoing incident response engagements. This integration culminates in the ability to rapidly deploy curated detections to mitigate newly discovered threats. A powerful example is where Mandiant blog posts detailing new exploits allowed Google Security Operations customers to deploy protective detections with a single click, often before the public was fully aware of the threat.

Looking ahead, Google is pushing the boundaries with Gemini 1.5 Pro for advanced malware analysis. Traditional large language models (LLMs) struggled with malware analysis due to limited context windows, requiring code to be chunked, which obscured the "big picture" and led to vague results. Gemini 1.5 Pro's significantly expanded context window overcomes this limitation, enabling it to analyze entire malware codebases. In a groundbreaking demonstration, the model analyzed the full WannaCry ransomware code in just 34 seconds, accurately identifying it as malicious ransomware and even pinpointing the C2 kill switch URL and domain. Critically, this capability was also validated against zero-day malware, with results fact-checked by VirusTotal malware analysts. This indicates a future where AI can provide rapid, highly accurate, and detailed malware analysis, further reducing manual effort and accelerating response to novel threats.

Demo / Proof of Concept

▶ Watch: Detection engineering: The most labor-intensive DIY SecOps task (5:15)

The talk illustrated its technical claims with several compelling demonstrations and proof-of-concept scenarios, highlighting the practical application of AI in security operations.

1. AI-Powered Detection Engineering: A video demonstration showcased the process of creating a detection rule using Gemini AI within the Google Security Operations platform. The analyst would input a natural language request, describing the specific threat or behavior they wanted to detect. Gemini AI then processed this request and automatically generated a corresponding detection rule. Following its generation, the rule was displayed in a rule editor, allowing the analyst to review, modify, and fine-tune it to their specific environmental needs. This demo effectively illustrated how AI can provide a rapid starting point for detection engineering, significantly reducing the manual effort and specialized language knowledge typically required, thereby saving considerable time and reducing toil.

1. AI for Threat Intelligence Query and Analysis: Another demonstration focused on how Gemini AI accelerates threat intelligence research. The speaker showed an analyst posing a natural language question, "What's Hangman V2?" to Gemini AI. The system rapidly processed this query, pulling information from dozens, if not hundreds, of articles and synthesizing insights from Mandiant, VirusTotal, and Google Threat Research. The result was a comprehensive, summarized answer presented directly in the interface. The demo further extended to a follow-up question, "How does it actually persist?", to which Gemini AI again provided a detailed and accurate response. This illustrated AI's capability to quickly provide deep, contextual threat intelligence, removing the need for analysts to manually sift through vast amounts of data.

1. Gemini 1.5 Pro for Advanced Malware Analysis (Proof of Concept): While not a live UI demo, the speaker presented a powerful proof-of-concept conducted by Bonada, the founder of VirusTotal and a talented malware analyst. This PoC centered on the analysis of the WannaCry ransomware using Gemini 1.5 Pro. Previous attempts with other large language models struggled due to limited context windows, necessitating the code to be analyzed in chunks, which led to vague and non-specific outcomes. However, with Gemini 1.5 Pro's vastly expanded context window, Bonada was able to feed the entire WannaCry codebase to the model. The result was astonishing: in just 34 seconds, Gemini 1.5 Pro accurately identified WannaCry as malicious ransomware, provided detailed analysis, and crucially, identified the URL and domain used for its C2 (command and control), which was the kill switch for the malware. This PoC also extended to zero-day malware, demonstrating Gemini 1.5 Pro's ability to analyze novel threats effectively, with its findings validated by an actual VirusTotal malware analyst. This demonstrated a significant leap in automated, intelligent malware analysis, pointing towards a future where AI can rapidly dissect and understand complex threats.

These demonstrations collectively underscored the talk's central theme: that AI, when integrated into security operations platforms, can dramatically reduce manual effort, accelerate analysis, and provide more comprehensive and timely insights, moving organizations away from the inefficiencies of DIY security.

Defensive Implications

▶ Watch: Over 90% of detections are common, don't DIY (6:00)

The insights and capabilities presented in this talk carry profound implications for security defenders, urging a strategic shift away from traditional, labor-intensive practices.

First and foremost, organizations must critically re-evaluate their security data strategy. The speaker's point that deciding what data to store or how long to keep it due to cost or effort constraints indicates a fundamental platform inadequacy. Defenders should seek cloud-native security platforms that offer frictionless data ingestion and retention, ensuring that all relevant telemetry can be collected and stored for comprehensive analysis without compromise. This foundation is essential for effective threat hunting, investigation, and compliance.

Secondly, the talk highlights the inefficiency of DIY detection engineering. Defenders should prioritize platforms that provide a robust library of curated, out-of-the-box detections covering a wide range of common threats. By offloading this approximately 90% of generic detection work, internal security teams can redeploy their expertise to focus on the unique, environment-specific threats and custom detection logic that truly differentiates their defense. Furthermore, the integration of AI-powered detection creation (like Gemini AI) should be embraced to accelerate the development of custom rules, enabling analysts to rapidly translate threat intelligence or observed behaviors into actionable detections using natural language, significantly reducing time-to-detection.

Third, the importance of comprehensive and actionable threat intelligence cannot be overstated. Defenders should move away from manually integrating disparate threat feeds and instead adopt integrated threat intelligence offerings that combine diverse, high-fidelity sources. Solutions like Google Threat Intelligence, which merge Mandiant's frontline incident response insights, VirusTotal's community data, and Google's global threat visibility, provide a holistic view. Crucially, this intelligence must be directly integrated into security operations workflows, automatically enriching alerts with TTPs and enabling rapid prioritization. The ability to deploy curated detections proactively based on this intelligence, even before public disclosure of exploits, represents a significant defensive advantage.

Fourth, AI augmentation for threat analysts is a game-changer. Defenders should explore and implement AI tools that can rapidly summarize complex threat information, answer specific queries about malware or threat actor groups, and provide contextual details on demand. This reduces analyst burnout, frees up valuable time for deeper analysis, and accelerates the investigation process, moving from days/weeks of research to minutes/hours.

Finally, the groundbreaking work with Gemini 1.5 Pro for malware analysis signals a future where rapid, automated analysis of novel and zero-day malware is possible. While this technology is still evolving, defenders should begin to consider how advanced AI capabilities can be integrated into their malware analysis pipelines to significantly reduce the time required to understand and respond to new threats, moving beyond traditional sandbox environments.

In essence, the defensive implication is a mandate to embrace platformization and AI-driven automation to transform SecOps from a reactive, manual, and often overwhelmed function into a proactive, efficient, and intelligent defense mechanism, allowing security teams to focus on strategic security initiatives rather than repetitive toil.

Key Takeaways

• Current SecOps is Ineffective: A significant 56% of organizations are notified of breaches by external parties, indicating a widespread failure in internal detection capabilities and highlighting the urgent need for a more robust approach.
• The "DIY" Model is Unsustainable: Building security operations from disparate "building blocks" (data lakes, custom detections, manual threat intel integration) leads to immense toil, inefficiency, and an inability to keep pace with evolving threats.
• AI Transforms Detection Engineering: Generative AI, specifically Gemini AI, can drastically reduce the effort and time required for detection engineering by translating natural language requests into functional detection rules, providing a crucial starting point for analysts.
• Integrated Threat Intelligence is Paramount: Comprehensive threat intelligence, like Google Threat Intelligence (GTI), combines frontline incident response (Mandiant), crowd-sourced data (VirusTotal), and global threat research (Google) to deliver actionable insights rapidly, enabling proactive defense.
• AI Accelerates Threat Analysis: Gemini AI empowers analysts to quickly research complex threats and answer specific questions by summarizing vast amounts of intelligence from multiple sources, significantly reducing manual research time and analyst toil.
• Advanced AI for Malware Analysis is Here: Gemini 1.5 Pro demonstrates groundbreaking capabilities in analyzing entire malware codebases (e.g., WannaCry in 34 seconds) and even zero-day malware, providing accurate verdicts and detailed insights, including C2 kill switches.
• Move to Frictionless Security Operations: The overarching message is to shift from manual, fragmented "DIY" security to an integrated, AI-augmented, and cloud-native platform approach that reduces toil, speeds up response, and enhances overall security posture.

About the Speaker(s)

The talk was delivered by a Product Marketing Lead for Google Cloud for Multi-Cloud Security. While the speaker's specific name was not provided in the introduction or the metadata, their role indicates a deep understanding of Google's security offerings across various cloud environments and their strategic positioning in the market. The individual's expertise lies in articulating how Google's security products address critical industry challenges and enable organizations to enhance their security posture.