Google acquires 'sandbox' technology for secure browsing
453625
Dips toe into security market Google is acquiring GreenBorder, a Silicon Valley startup that helps protect web users against malware.â¦
566947
InfoWorld - Google&#160;has improved the security and search features of its Mini search device, a hardware box with Google software aimed at small and medium-size companies and at departments within large organizations.
281146
(InfoWorld) - Google Inc.'s acquisition of security company GreenBorder Technologies Inc. is a sign the search giant wants to bolster confidence in its browser-delivered applications amid growing threats from malicious software on the Internet. The acquisition,Â made earlier this month but revealed this week, gives the company a security product to offer with browser-delivered applications such as Docs and Spreadsheets, its productivity suite. Microsoft Corp.'s Internet Explorer (IE) and Mozilla's Firefox are the most commonly used browsers, but have experienced serious security vulnerabilities. For Google, which doesn't have a browser product itself, that's bad news and could put off IT managers from using browser-based applications. With the GreenBorder buy, Google is trying to instill confidence in enterprises and users. "Our belief is not that they wanted to get in the security business, but they want to make the browsing experience safe," said Jay Heiser, a research vice president with Gartner Inc. Google hasn't detailed how it will offer GreenBorder, designed to block "untrusted" programs, including malware, from affecting the underlying system. The program works with Internet Explorer, Firefox and Microsoft's Outlook as well as other browsers and e-mail programs. GreenBorder offered a free consumer version and sold enterprise versions of its program. If a user gets infected by visiting a malicious Web site or downloads a worm from an e-mail attachment, the bad program will only run in an isolated environment, or a "separate logical domain," according to a February 2005 evaluation from KeyLabs, a security testing company now owned by AppLabs Technologies Pvt. Ltd. When users notice their systems are slowing, the malware can simply be flushed out by resetting GreenBorder, and there are no traces left on the system. It's not easy technology to build: "Desktop security suites have not utilized an approach similar to GreenBorder's due to the extremely high degree of complexity," KeyLabs' report said. And it's also not a replacement for antivirus software. Most desktop AV suites receive regular updates, called signatures, that allow the programs to identify and remove malware. GreenBorder doesn't use signatures or sweep a machine clean of malware. GreenBorder also won't stop bad software that's already on the machine, the KeyLabs report said. Still, GreenBorder has received good reviews from some users. Christian Mohn, a system administrator for the Norwegian shipping company, Seatrans AS, wrote on his blog that GreenBorder was easy-to-use and didn't slow down Internet Explorer. "All in all, I'm impressed," Mohn wrote on his blog . Whatever limitations GreenBorder may have, increased confidence in software-as-a-service applications could be a worrisome issue for companies such as Microsoft, which has competing desktop products and is trying to figure out how to turn them into online services, said Christian A. Christiansen, program vice president, security products and services, at analysis company IDC. Â ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
125828
Blog: Buying the virtual browser company just one of many steps Google is taking toward providing online security.
624470
If you use shared or public computers, you have a new privacy risk to consider: Google Desktop Search.
56051
Search giant launches Google Gears, open-source software that brings offline access and local storage to the Web browser.
653425
Internet search company Google Inc.  has acquired Keyhole Corp., a supplier of online satellite maps that allow users to zoom down to street level to specific locations, Google said on Wednesday.
730654
(InfoWorld) - Google believes that its consumer-grade Web applications represent the future of enterprise IT. But while Google is quick to trumpet its products' innovative features, the search giant hasn't said much about their security. Until recently, that is. On Monday,Â Google announcedÂ it would spend $625 million to buy messaging security vendor Postini, a move that will give it access to 35,000 business customers, and provide it with the first security products for its Google Apps portfolio. The Postini acquisition represents the most significant investment into security technology yet made by Google. In recent months, Google has started its own security blog along withÂ acquiring another security-related startup, Green Border Technologies. Google Apps customers will be able to use Postini services for tasks like scanning and encrypting e-mail, and archiving messages for compliance and legal purposes, said Dave Girouard, vice president and general manager for Google's enterprise business, during a Monday conference call. Around 1,000 small businesses are signing up for Google Apps each day, according to Google. But the company admitted that big businesses have been reluctant to use hosted services because of concerns about security and corporate compliance issues. It hopes that buying Postini will help relieve those concerns. But now that Google has finally decided to become a security vendor, how far will it go? Rival Microsoft has started buying security companies itself, and recently introduced its own line of antivirus software. And Google's recent Green Border purchase has caused some to speculate that the search giant may soon offer a secure Web browser, locked down with Green Border's safe browsing technology. Google has so far refused to say what it plans to do with Green Border's products, but observers see other opportunities ahead. For example, the company could mine its vast database of Web sites to compete with Web filtering companies like Websense or AE6 Technologies. "There's a lot of money to be made by establishing a blacklist of Web sites," said Forrester Research Principal Analyst Chenxi Wang. "I would not be surprised if once they used their massive crawling infrastructure to turn that into a proprietary list and sell that with their enterprise product line." Google recently gave Web developers a way to access this data for free, but the company could build paid services for enterprise users on top of the free product, much in the same way it has developed Google Apps, observers said. "If they add real-time intelligence and put that in an enterprise product, they can definitely make money," Wang said. Wang predicted that Google may also look to acquire information leak prevention companies such as Vontu or Vericept. One of Google's harshest critics on the security front said that things might become even more interesting should Google decide to expand its foothold on the desktop. "If they want to build their own operating system and they want to basically start making Firefox the [default] browser...they're going to need to start bumping up the controls and security and the devices to protect that environment," said Robert Hansen, CEO of Web security consultancy SecTheory. How much the Postini and Green Border acquisitions will go to secure existing Google products is unclear. Google said Monday that it will enhance Gmail with Postini's technology, but Hansen thinks that it will take time before Google builds security into its products from the ground up. In the company's rush to deliver cool and compelling features to its users has come at the expense of security, he believes. And until there is some sort of widespread security problem -- such as the worm and virus outbreaks that shut down Windows users five years ago -- Google has little incentive to make security a priority within its existing products. "It comes down to the business case," Hansen said. "If I want to fix Blogspot I have to convince some product manager somewhere that it's worth doing the investment... and in the end users are going to hate it." James Niccolai in Paris contributed to this report. Â
355170
Search enabler Google Inc. said Wednesday it acquired digital mapping company Keyhole Corp. for an undisclosed sum. Keyhole maintains a multiterabyte database of digital images of geographic locations, culled from satellite and aerial snapshots.
519344
Internet search company Google Inc. has acquired Keyhole Corp., a supplier of online satellite maps that allow users to zoom down to street level to specific locations, Google said Wednesday.
125170
New software will let users securely access enterprise networks and data from handheld devices with two-factor authentication.
280141
Google gets into the Web registration business.
83106
Google has released a tool that lets people search documents, e-mails or spreadsheets stored on a PC.
749480
Far from being a major player in IT security today, Google has ambitious designs on becoming a big name in the burgeoning hosted security market, begging the question, Will your organization ever be ready to let the world's largest information retrieval company safeguard your crown jewels?To hear Google talk of its plans for a multifaceted filtering system geared toward locking down data, you might have to answer this question sooner than you think.[ Talkback: What security tools would Google have to offer to make a serious play at securing your data? ]At the center of Google's security push are talent and technology brought on board in this year's acquisitions of message filtering specialist Postini and browser-based security software maker GreenBorder Technologies. According to Google officials, the company is confident that these pieces lay the necessary foundation on which to build significant IT security and compliance automation capabilities.In fact, Google claims it is now as committed to creating tools to help end-users defend their data as it is to helping them search for information online, according to company officials.But providing consumer-grade protection is one thing. Whether Google can successfully navigate the sophisticated security issues businesses face online is another. And the stakes could be significant, as a more security-minded Google Apps hosted productivity suite could give Microsoft a run for its Office desktop app money.[ For in-depth analysis of the Google-Microsoft app rivalry, see: Thin vs. Fat: Google's plan to kill Microsoft Office ]Postini as security platform Shrugging off doubts about Google's ability to rise to the business-worthy security challenge, Scott Petry, founder and CTO of Postini, which Google acquired in July, said the search giant's security footprint has only just begun to take shape."When Google bought Postini, and in fact when Postini built its underlying architecture, it was not all about keeping spam from reaching peoples' in-boxes," Petry said. "They didn't buy bits on a server; what they bought, and what we built, was a platform for creating a range of different services around protecting content and monitoring usage patterns."As evidence, Petry pointed to Google's recent integration of Postini's e-mail content policy management system into Google Apps Premier Edition, the first of a slew of online services Google plans to launch to help businesses and consumers safeguard their data.Added to the release were data analysis tools for identifying credit card and Social Security numbers in e-mail messages, as well as policy enforcement options such as encryption. Google also added protection against so-called zero-day attacks and expanded message archiving features.Additional security and compliance services already under development at Google will build on those capabilities, Petry said."We feel that we can build a broader umbrella by recognizing spam and malware before it reaches the network on one end, and by helping people monitor the outward flow of information on the other," Petry said. "We want to provide a stronger level of control for security over all types of content."Should IT professionals assume consumers and small businesses will be the only beneficiaries of Google's security push, Petry points out that many of the e-mail and content management features added in the latest revision were designed specifically for large businesses.Hooking the enterprise on hosted security Chief among the obstacles Google faces in making a security services push deep into the enterprise is the fact that many larger organizations are reluctant to buy into the hosted security model. Petry, however, remains undeterred, citing Circuit City, Merrill Lynch, Mitsubishi Motors, and the National Hockey League as examples of existing Postini customers. And with major security vendors such as Symantec making SaaS plays, the security services model shows signs of catching on.From building additional compliance policy enforcement and DLP (data leakage prevention) services to creating new malware detection and e-discovery tools, Google is examining a wide range of opportunities to leverage its place in the IT stack into a more comprehensive security offering, Petry said."We'll start with some of the simpler things and move into some of the more complex areas," Petry said. "We feel that security has to be an anchor tenant of the entire Google applications infrastructure; what Google has today is a framework for creating a lot of new tools down the road."Blending security tools into Google Apps is another priority for the search giant, as providing self-defense capabilities in those services will be essential to convincing larger businesses that the hosted applications model is industrial-strength, said Rajen Sheth, senior product manager at Google."Security remains one of the biggest issues for getting people more confident about putting more of their data outside the firewall," Sheth said. "Having policy-based services in place for protecting all different types of data -- as with the engine that came to Google from Postini -- will be critical to the success of Google Apps."Deep pockets, worthwhile possibilities Industry watchers agree that Google has the potential to successfully spin its existing security holdings into worthwhile security services.Enterprise Strategy Group analyst Brian Babineau underscored the strength of technology brought on board in the Postini and GreenBorder acquisitions as key to Google's security push.Marrying message filtering and archiving to Enterprise Gmail, along with the introduction of DLP tools, indicate the direction Google is likely to take, Babineau said.Here, the vast financial and development resources at Google's disposal will prove advantageous, the analyst added."It's hard to ignore the resources that they have to use on any technology investment. Postini had a good customer base, and by adding that delivery mechanism, you can certainly envision some interesting things they can do around Enterprise Gmail and Google Apps," Babineau said."Something like archiving for compliance or governance purposes makes a lot of sense, especially in the messaging arena," Babineau said. "There will be some financial services and health care companies looking for service providers who can handle a lot of this work, and those that would consider using services like this will probably find it attractive to have a one-stop shop when they can find one."Rethinking security Smaller organizations will likely be the first to adopt such services, but larger companies do seem increasingly open to the hosted applications delivery model, Babineau said."Google has the ability to move in a lot of different directions, but they will need to move cautiously and ensure that they hit the right price points that customers want for services like archiving, DLP, and data discovery," Babineau added.Of course, as other experts are quick to point out, many enterprises remain skeptical of the SaaS (software as a service) model, especially when it comes to employing services aimed at ensuring the security of business and customer data.Those same market watchers, however, concede that Google's security proposition is significant."It's still unclear how much market movement we will see with adoption of security software as a service; how enterprises in particular are viewing use of the tools in the future remains uncertain," said Andrew Braunberg, an analyst at Current Analysis. "Google certainly has the infrastructure in place now to create some interesting choke points for data and, of course, can bring a lot of processing power to the table."What may also help ensure Google's success in the hosted security market is an evolving outlook toward security already under way at many organizations, the analyst said."People are rethinking where security should live, especially in the context of the dissolving perimeter," Braunberg added. "If Google can push clean pipes in the cloud or take a data-centric approach on the desktop, you could see how some customers might be interested."Additional articles Thin vs. Fat: Google's plan to kill Microsoft Office Mounting scrutiny for Google security Security SaaS maturing fast
134325
With four in the last week, is Google the next security buffoon? Analysis Google's desktop search application is vulnerable to an exploit that allows a determined attacker to remotely run most programs installed on a victim's machine. The flaw is one of at least four security holes to visit Google this past week, demonstrating that the search king, despite the god-like aura it enjoys for its pleasing software designs, remains a mere mortal in the security cosmos.â¦
668417
Web-services security company releases appliance designed to authenticate access into business networks.
734719
(InfoWorld) - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack. In a report, researchers at application security software maker Watchfire, based in Waltham, Mass., detailed an existing attack designed to exploit the Google Desktop flaw. Watchfire said the cross-site scripting threat -- which it described as a parasitic virus -- could allow attackers to steal information from affected PCs and track end users' Web browsing habits. Cross-site scripting (XSS) threats typically take advantage of security vulnerabilities in legitimate Web pages to inject malicious content into the browsers of people visiting the URLs or to redirect them to fraudulent sites used in phishing attacks. Like many other XSS threats, the attack currently leveled at Google Desktop uses JavaScript code to deliver its payload. Watchfire experts said the Google Desktop XSS problem was very dangerous for a number of reasons. Among the more serious characteristics is the malicious program's ability to affect clusters of computers connected by Google Desktop's information sharing capabilities. This could allow attackers to spread the attack to new machines or simply steal data from multiple PCs linked by the application. Most enterprises have invested significant amounts of time and money installing security applications to protect against the loss of sensitive data over the last several years, but a Google Desktop attack would circumvent many of those systems, leaving information on corporate desktops running the program open for potential theft. "This attack is almost undetectable, it won't get picked up by any anti-virus system or firewall, and it can be used in a lot of different ways to harm end users," said the director of security research at Watchfire, Danny Allen. "It allows someone using the attack to control all the applications on a computer or access the network to which an affected machine is attached, and it is almost impossible to get rid of." As part of a demonstration of the exploit, Allen showed off how the program could be used to change the version number in the Google Desktop application itself. Doing so could allow attackers to fool users of the desktop search program into believing they have a version of the software that has been fixed for security reasons, when in fact they are still potentially vulnerable. "Some IT security people have dismissed the impact of [cross-site scripting] attacks to a certain extent, but we wanted to highlight the potential damage that something like this could deliver," Allen said. Media representatives at Google said that after Watchfire informed the company of the attack, engineers at the search giant created a patch for the issue that was automatically distributed to Google Desktop users. Google said it has also added a new set of security features to the latest iteration of the product to prevent similar attacks in the future. On Feb. 9, Google launched its newest version of the desktop search program, labeled Desktop 3 Beta. Company representatives said that they have not received any reports of the vulnerability being exploited on end-users' machines. Watchfire researchers said the new security patch appears to fix the flaw and prevent XSS attacks on users of Google Desktop whose systems have been updated. Security analysts considering the problem said it highlighted the need for businesses to look carefully at programs such as Google Desktop that straddle the line between personal and professional PC usage. Although the application may be very useful, and most often gets pulled into the corporate environment by people who use it at home, Google is not a maker of business-grade software and doesn't follow the same security processes as large manufacturers of such products, said John Pescatore, analyst at Gartner. Unlike Microsoft, Oracle, or Sun Microsystems, Google does not publish regular security bulletins or even offer specific details of issues it has already fixed, Pescatore said. This reason, along with the data security issues that can be introduced when Google Desktop isn't configured to bar users from inadvertently sharing search information with outsiders, poses serious questions for corporate IT administrators who must decide whether to allow people to use it in the office, according to the analyst. "The major concern is that while Google isn't an enterprise software vendor, programs it makes, including Google Desktop, are ending up on a lot of enterprise desktops," Pescatore said. "Google doesn't expose how it does patches like Microsoft, so how does an enterprise even know if their users are working with the version that has been fixed?" As malware writers and phishing scheme operators continue to hone their attacks to steal smaller amounts of valuable data from pools of targeted users, and move further away from the massive worm viruses of years past, the IT world will see more XSS threats. "There will be more funded cyber-crime attacks aimed at specific companies and groups of users, and the size of the threats is such, by design, that they won't land on the six o'clock news," Pescatore said. "The perpetrators will continue to increase the volume of these types of threats, and cross-site scripting and targeted phishing will likely be among their favorite formats for doing so." The bug, which was made public Wednesday by Watchfire, has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt. Google was first notified of the problem on Jan. 4 and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday. In addition to its bug fix, Google has added, "another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future," Schnitt said. "We have received no reports that this vulnerability was exploited.â Robert McMillan of IDG News Service contributed to this report.