Detect and Defend: Google Cloud’s New Cryptomining Protection Program

Google Cloud has announced the launch of its Cryptomining Protection Program, an innovative initiative aimed at providing enhanced security against cryptomining attacks. The program, offered exclusively to Security Command Center (SCC) Premium customers, includes financial protection of up to $1 million to cover unauthorized compute expenses associated with undetected attacks.

In the past, threat actors have frequently exploited weak and default passwords to gain access to Google Cloud accounts, with cryptomining being the preferred method of attack in 65% of cases, as revealed by the Google Cybersecurity Action Team (GCAT) September 2022 Threat Horizons Report.

“Security Command Center has rapidly become one of the most widely utilized tools for safeguarding Google Cloud environments,” stated Jess Leroy, senior director of product management at Google Cloud. “Fortune 10 companies, as well as SMB organizations worldwide, rely on Security Command Center Premium to protect their Google Cloud environments.”

The Cryptomining Protection Program is exclusively available to SCC Premium customers due to the comprehensive threat detection capabilities integrated into the Google Cloud infrastructure. This includes advanced cryptomining attack detection, which forms the foundation of the financial protection program.

To identify and mitigate such attacks, SCC Premium employs state-of-the-art techniques, such as scanning virtual machine memory for malware. This approach enables Google Cloud to detect threats that may go unnoticed by external security tools relying solely on cloud logs and API data analysis. By integrating the detection capabilities into the cloud infrastructure itself, Google Cloud can proactively identify and counter potential threats before they cause significant harm.

Moreover, SCC Premium offers additional features, including the detection of compromised identities, which are often the entry point for attackers. By identifying excessive failed attempts, unusual impersonation chains, dormant service account activity, and other anomalous behavior, SCC Premium enhances overall security posture.

Customers enrolled in the SCC Premium program automatically qualify for the Cryptomining Protection Program, provided they adhere to the program’s terms and conditions, including the implementation of Cryptomining Detection Best Practices. In the event that Google or Security Command Center Premium fails to detect and notify a customer of a cryptomining attack within their compute engine VM environment, resulting in unauthorized compute engine costs, the customer can request cloud credits within 30 days from the start of the attack to cover the incurred expenses.

Upon raising such an issue, Google’s dedicated support team collaborates closely with the customer to determine the precise compute engine costs arising from the cryptomining attack. Under the program, customers are eligible to receive cloud credits, with a maximum limit of up to US$1 million within any 12-month period.

With the introduction of the Cryptomining Protection Program, Google Cloud continues to prioritize the security and protection of its users’ digital assets, offering peace of mind and a robust defense against emerging threats in the cryptocurrency landscape.