The past six months have seen some of the most widespread and alarming cyber attacks against our digital infrastructure in history — against public utilities, private sector companies, government entities and people living in democracies around the world. Attacks by nation-states and criminals are increasingly brazen and effective, penetrating even widely used products and services that are supposed to keep you safe.
We are deeply concerned by these trends. Security is the cornerstone of our product strategy, and we’ve spent the last decade building infrastructure and designing products that implement security at scale: every day Gmail blocks more than 100 million phishing attempts that never reach you. Google Play Protect scans over 100 billion apps for malware and other issues. We strive to deliver the most trusted cloudin the industry. And we have dedicated teams like Project Zero who focus on finding and fixing vulnerabilities across the web to make the internet safer for all of us.
Our security-first approach builds on awareness of an evolving threat environment, industry-wide information sharing, and the leadership of the international security community. We welcome growing efforts by governments around the world to address cybersecurity challenges. The recent cyber attacks create an opportunity to improve international cooperation and collaboration on areas of common concern.
In the United States, we are committed to supporting the most recent White House Cybersecurity Executive Order, which makes critical strides to improve America’s cyber defenses in three key areas:
Modernization and security innovation
One of the most promising aspects of the U.S. government’s approach is to set agencies and departments on a path to modernize security practices and strengthen cyber defenses across the federal government. We strongly support modernizing computing systems, making security simple and scalable by default, and adopting best practices like zero trust frameworks. As we saw with SolarWinds and the Microsoft Exchange attacks, proprietary systems and restrictions on interoperability and data portability can amplify a network’s vulnerability, helping attackers scale up their efforts. Being tied to a single legacy system also keeps public sector agencies and businesses from taking advantage of the latest cloud-based security solutions.
Modern systems create the ability to make frequent security updates and changes safely, a critical part of cyber-defense for both the government and private sector. If we are going to solve big security problems, we need to move beyond security band-aids to eliminating entire classes of vulnerabilities, like the risk of clicking on bad links.
Secure software development
The U.S. government’s call to action to secure software development practices could bring about the most significant progress on cybersecurity in a decade and will likely have a significant long-term impact on government risk postures.
At Google, we’ve emphasized securing the software supply chain and we’ve long built technologies and advocated for standards that enhance the integrity and security of software. We continue to work with the U.S. Commerce Department on these issues and support their effort to develop and share best practices.
Public-private partnerships
In the last few weeks, ransomware attacks have targeted our schools, hospitals, oil pipelines and food supply. Meaningful improvement in cybersecurity will require the public and private sectors to work together in areas like sharing information on cyber threats; developing a comprehensive, defensive security posture to protect against ransomware; and coordinating how they identify and invest in next-generation security tools.
We are committed to advancing our collective cybersecurity. We have had to block many attacks, including some from nation-states. Those experiences have given us insights into what works in practice, so our government and private-sector customers don’t have to tackle these issues on their own or depend on the same enterprise technology that created the issues in the first place. Governments need industry-wide support and we are ready and willing to do our part.
We look forward to expanding our work with the United States and other governments, as well as with private sector partners, to develop security technologies and standards that make us all safer.
