3 ms·
I'm not sure if Google even has an internal red team that performs breaches, last time I talked with someone there at a conference they didn't (that was 2016).
by kerng 9y ago
I'm not sure if Google even has an internal red team that performs breaches, last time I talked with someone there at a conference they didn't (that was 2016). So I am not sure Google has metrics on how easy it is to gain access by an adversary.
- mehrdadn 9y ago> I'm not sure if Google even has an internal red team, last time I talked with someone there they didn't (was 18 months ago though). 2012: Google staffs up ‘Red Team’ And this was literally just a Google away: https://nakedsecurity.sophos.com/2012/08/24/google-red-team-privacy/ https://nakedsecurity.sophos.com/2012/08/24/google-red-team-...
- kerng 9y agoRed team is an overloaded term: "Analyze software and services from a privacy perspective, ensuring they are in line with Google's stated privacy policies, practices, and the expectations of our users." Doesn't sound like adversary simulation to me.
- kyrra 9y agohttps://careers.google.com/jobs#!t=jo&jid=/google/security-engineering-manager-detection-google-building-c-747-6th-st-s-kirkland-3537510028 https://careers.google.com/jobs#!t=jo&jid=/google/security-e... The job even lists insider threat as part of their responsibility.
- kerng 9y agoYeah, still not the same as actually performing breaches themselves to see how long it takes to compromise, and if they get detected and how long it takes to remediate and evict the adversary. I should have been a bit clearer with what I meant initially.
- sulam 9y agoHow do you know there isn’t a team at Google doing this? It’s standard practice at companies of even middling size and Google is so large your friend might just be unaware of it.
- kerng 9y agoA Google security manager told me at a conference when chatting about this in 2016. They were thinking of staffing a breach team, but did not have one then.
- mehrdadn 9y agoI thought Project Zero tries to find vulnerabilities in Google stuff too?
- kerng 9y agoProject Zero is different compared to performing end to end breaches. A breach team might use 0-days of Project Zero to actually compromise Google's internal assets to see if their defenders can detect an adversary. FB has such a team and they gave public presentations (one was at RuxCon 2016) how they compromise for instance their domain controllers and stuff.
- deleted 9y ago[deleted]
- debatem1 9y agoGoogle has a gaggle of security teams, almost all of which occasionally red team and some of which exclusively do. I'm not sure who told you otherwise but they were certainly mistaken. Source: I TL'd a security team there several years ago.
- kerng 9y agoThanks for pointing this out. I heard it from a security manager at Google at a conference in 2016. Good to hear that they do breach simulations now, besides regular pen testing and stuff.
- srj 9y agoI'm not sure if there was miscommunication or what, but Google has had teams that do this for a while now. I typically hear them referred to as orange teams.
- mrb 9y agoI worked in 2014-2015 at Google on one of the (many) teams that did exactly that.