Alphabet’s Chronicle banks on big data with new threat analysis platform

Chronicle is banking on Google’s access to immense amounts of data storage to help security professionals in a crowded threat-intelligence market.

Chronicle, the cybersecurity firm stood up last year by Google parent company Alphabet, entered the threat analysis business Monday when it announced a cloud-based platform that compares reams of network data with malicious cyber activity.

In doing so, Chronicle is betting that Google’s access to immense amounts of stored data will help security professionals make better sense of information in what is already a crowded threat-intelligence market.

The tool, called Backstory, allows companies to upload their internal security data and then analyze it, offering a repository stretching back years. It constantly compares that historical corporate ledger with new threat data to inform companies of any “historical access” to malicious domains or files, according to Chronicle. Hackers can linger on organizations’ networks for months, if not longer, and Backstory aims to use Google’s search capabilities to find breaches that slipped through the cracks.

“Backstory was designed for a world where companies generate massive amounts of security telemetry and struggle to hire enough trained analysts to make sense of it,” Chronicle said in a blog post.

The company’s engineers built a network layer over Google’s infrastructure to allow companies to upload large caches of data; things like DNS traffic and proxy logs. That information is kept private and isn’t scannable by other parties, the company said.

The project was born in the aftermath of a breach of Google by suspected Chinese hackers in 2009. After that incident, Google’s Threat Analysis Group developed security tools that Chronicle says laid the groundwork for the Backstory platform.

“Massive telemetry that enterprises either could not afford to log or simply didn’t, we actually turned into extremely valuable signals,” Mike Wiacek, Chronicle chief security officer and co-founder, declared at a press event Monday at the RSA Conference in San Francisco. The more data fed into the Backstory’s cloud, the more detailed a picture it paints, he said.

Chronicle representatives did not disclose details on how much it costs a company to use Backstory, only saying that pricing depends on the number of employees at an organization.

Chronicle executives say the platform allows analysts to dive deeper into malicious indicators by building on the company’s popular VirusTotal search engine. As an example, they pointed to the hacking documented in an indictment of 12 Russian military officers unsealed by the Justice Department in July 2018.

The indictment mentions a malicious domain used by the hackers to communicate with the Linux-based malware. With that domain called out by U.S. authorities as potentially infectious, security officers at companies around the world would want to know if devices on their networks had communicated with the domain. VirusTotal would return much of the information on that domain, but the idea behind Backstory is to give a fuller picture of a company’s network to see if there were any compromises.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure