Google has unveiled a plan that will deprive hackers of their usual tools.
Google announced the launch of a new unit designed to make life difficult for hacker groups, but the company emphasizes that it's not about retaliatory cyberattacks. Instead, it's focusing on a more subtle tactic: depriving attackers of tools and infrastructure before an attack can cause damage.
The presentation took place at the RSAC conference in San Francisco. Sandra Joyce, vice president of Threat Intelligence Group, explained that the team will focus on actively influencing adversaries' behavior. The approach is built not on hacking into other people's systems, but on disrupting the chains of command and control that hackers use to gain entry.
Google is counting on its scale and control over popular services. Attackers often use these platforms to launch attacks, manage malicious infrastructure, and coordinate operations. The company has already conducted operations to shut down such resources and is now formalizing such actions as a separate effort.
The key idea is to operate within the law. The team will seek court orders to block malicious websites and servers, uncover the activities of groups, and simultaneously strengthen product security to patch vulnerabilities before they are exploited. This approach, according to the management, should become the norm for the entire industry.
The launch coincided with the US government's move toward a more proactive cyber policy. While the Donald Trump administration promotes proactive defense, the White House has emphasized that private companies should not conduct offensive operations on behalf of the state.
Google is taking a similar approach. Mandiant CTO Charles Carmakal noted that the goal isn't limited to the company's ecosystem. It's about broader collaboration with partners to disrupt attackers' resources at various levels and make attacks less effective.
Chief threat analyst John Hultquist added that the industry is tired of reacting after the fact. The new approach involves disabling the adversary's capabilities before the attack even begins—effectively leaving them without the tools to penetrate.
Google announced the launch of a new unit designed to make life difficult for hacker groups, but the company emphasizes that it's not about retaliatory cyberattacks. Instead, it's focusing on a more subtle tactic: depriving attackers of tools and infrastructure before an attack can cause damage.
The presentation took place at the RSAC conference in San Francisco. Sandra Joyce, vice president of Threat Intelligence Group, explained that the team will focus on actively influencing adversaries' behavior. The approach is built not on hacking into other people's systems, but on disrupting the chains of command and control that hackers use to gain entry.
Google is counting on its scale and control over popular services. Attackers often use these platforms to launch attacks, manage malicious infrastructure, and coordinate operations. The company has already conducted operations to shut down such resources and is now formalizing such actions as a separate effort.
The key idea is to operate within the law. The team will seek court orders to block malicious websites and servers, uncover the activities of groups, and simultaneously strengthen product security to patch vulnerabilities before they are exploited. This approach, according to the management, should become the norm for the entire industry.
The launch coincided with the US government's move toward a more proactive cyber policy. While the Donald Trump administration promotes proactive defense, the White House has emphasized that private companies should not conduct offensive operations on behalf of the state.
Google is taking a similar approach. Mandiant CTO Charles Carmakal noted that the goal isn't limited to the company's ecosystem. It's about broader collaboration with partners to disrupt attackers' resources at various levels and make attacks less effective.
Chief threat analyst John Hultquist added that the industry is tired of reacting after the fact. The new approach involves disabling the adversary's capabilities before the attack even begins—effectively leaving them without the tools to penetrate.
