{"id":10638,"date":"2022-02-07T17:28:06","date_gmt":"2022-02-07T17:28:06","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/07\/google-cloud-protects-vms-against-cryptojacking-with-agentless-threat-detection-service\/"},"modified":"2022-02-07T17:28:06","modified_gmt":"2022-02-07T17:28:06","slug":"google-cloud-protects-vms-against-cryptojacking-with-agentless-threat-detection-service","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/02\/07\/google-cloud-protects-vms-against-cryptojacking-with-agentless-threat-detection-service\/","title":{"rendered":"Google Cloud protects VMs against cryptojacking with agentless threat detection service"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Google Cloud is expanding its Security Command Center<\/a> service with the availability of Virtual Machine Threat Detection in public preview starting today.<\/p>\n

VMTD works by scanning virtual machine instances in Google Compute Engine to detect a wide range of security threats, including things like cryptomining malware, which hijack virtual machines and redirect their computing power to mine cryptocurrencies. One of the best things about VMTD is that it collects signals that can identify such threats without running additional software, meaning there\u2019s no performance impact from running it.<\/p>\n

The Security Command Center gives customers an overview of their Google Cloud environments, helping customers gain visibility into their cloud assets and discover vulnerabilities and threats that may be targeting them. It also helps customers to maintain compliance based on industry standards and benchmarks.<\/p>\n

VMTD adds to those capabilities, using agentless memory scanning to detect threats inside VM-based architectures running in Google Cloud. Whereas traditional security software relies on deploying software agents inside a guest VM to gather signals and telemetry that may indicate the presence of a threat, doing so comes at a cost of reduced performance.<\/p>\n

\u201cFor Compute Engine, we wanted to see if we could collect signals to aid in threat detection without requiring our customers to run additional software,\u201d Google Cloud Product Manager Timothy Peacock wrote in a blog post. \u201cNot running an agent inside of their instance means less performance impact, lowered operational burden for agent deployment and management, and exposing less attack surface to potential adversaries.\u201d<\/p>\n

Instead, with VMTD, Google instruments the hypervisor, which is the software that runs underneath and orchestrates multiple VMs, to detect security threats.<\/p>\n

Google said the threat of cryptomining malware, also known as cryptojacking, is something enterprises should be concerned about. The latest Google Cybersecurity Action Team Threat Horizons Report found<\/a> that 86% of compromised cloud instances were being used to mine cryptocurrencies such as bitcoin. Other threats include ransomware and data exfiltration.<\/p>\n

The preview of VMTD can only detect cryptomining attacks for now, but in the future, Peacock said, Google is planning to add additional detective capabilities and perhaps also integration with other areas of Google Cloud.<\/p>\n

The VMTD service is available now for Security Command Center Premium customers only, accessible within the Settings page. Peacock said the service will not be enabled by default \u2013 meaning customers have to opt in \u2013 to safeguard user trust.<\/p>\n

Image: rawpixel.com\/Freepik<\/a><\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n