Cloud

2024 11 19

AWS – Amazon EKS enhances Kubernetes control plane monitoring

Amazon EKS enhances visibility into the Kubernetes control plane by offering new intuitive dashboards in EKS console and providing a broader set of Kubernetes control plane metrics. This enables cluster administrators to quickly detect, troubleshoot, and remediate issues. All EKS clusters on Kubernetes version 1.28 and above will now automatically display a curated set of dashboards visualizing key control plane metrics within the EKS console, making it easy to observe the health and performance of the control plane. Additionally, a broader set of control plane metrics are made available in Amazon CloudWatch and in a Prometheus endpoint, providing customers with the flexibility to utilize their preferred monitoring solution — be it Amazon CloudWatch, Amazon Managed Service for Prometheus, or third-party monitoring tools.

Newly introduced pre-configured dashboards in the EKS console provide cluster administrators with visual representations of key control plane metrics, enabling rapid assessment of control plane health and performance. Additionally, the EKS console dashboards now integrate with Amazon CloudWatch Log Insights queries, surfacing critical insights from control plane logs directly within the console. Finally, customers now get access to Kubernetes control plane metrics from kube-scheduler and kube-controller-manager, in addition to the existing API server metrics.

The new set of dashboards and metrics are available at no additional charge in all AWS commercial regions and AWS GovCloud (US) Regions. To learn more, visit the launch blog post or EKS user guide.

Read More for the details.

2024 11 19

AWS – Amazon OpenSearch Service now scales to 1000 data nodes on a single cluster

AWS, Cloud AWS

Amazon OpenSearch Service now enables you to scale a single cluster to 1000 data nodes (1000 hot nodes and/or 750 warm nodes) and enables you to manage 25 petabytes of data (10 Petabytes in hot nodes and further 15 Petabytes in warm nodes). You no longer need to setup multiple clusters for workloads that require more than 200 data nodes or more than 3 Petabytes of data.

Today, for workloads of more than 3 to 4 petabytes of data, you need to create multiple clusters in OpenSearch Service. This may have required you to refactor your applications or business logic to work with your workload split across multiple clusters. In addition, every cluster requires its own configuration, management, and monitoring, adding to the operational overhead. With this launch, you can scale a single cluster up to 1000 nodes, or 25 petabytes of data, removing the operational overhead that comes with managing multiple clusters.

To scale a cluster beyond 200 nodes, you have to request an increase through Service Quota, after which you can modify your cluster configuration using the AWS Console, AWS CLI, or the AWS SDK. Depending on the size of the cluster, OpenSearch Service will recommend configuration pre-requisites across data nodes, cluster manager nodes, and coordinator nodes. For more information, refer to the documentation.

The new limits are available to all OpenSearch Service clusters running OpenSearch 2.17 and above in all AWS regions where Amazon OpenSearch Service is available. Please refer to the AWS Region Table for more information about Amazon OpenSearch Service availability.

Read More for the details.

2024 11 19

AWS – AWS Amplify launches the full-stack AI kit for Amazon Bedrock

AWS, Cloud AWS

Today, AWS announces the general availability of the AWS Amplify AI kit for Amazon Bedrock, the quickest way for fullstack developers to build web apps with AI capabilities such as chat, conversational search, and summarization. The Amplify AI kit allows developers to easily leverage their data to get customized responses from Amazon Bedrock AI models. The Amplify AI kit allows anyone with knowledge of JavaScript or TypeScript, and web frameworks like React or Next.js, to add AI experiences to their apps, without any prior machine learning expertise.

The AI kit offers the following capabilities:

A pre-built, fully customizable <AIConversation> React UI component that offers a real-time, streaming chat experience along with features like UI responses instead of plain-text, chat history, and resumable conversations.
A type-safe client that provides secure server-side access to Amazon Bedrock.
Secure, built-in capabilities to share user context (e.g. data the user can access) with Amazon Bedrock models.
Define tools with additional context that can be invoked by the models.
A fullstack TypeScript developer experience layered on Amplify Gen 2 and AWS AppSync.

To get started with the AI kit, see our launch blog.

Read More for the details.

2024 11 19

AWS – Amazon ECS now allows you to configure software version consistency

AWS, Cloud AWS

Amazon Elastic Container Service (Amazon ECS) now allows you to configure software version consistency for specific containers within your Amazon ECS services.

By default, Amazon ECS resolves container image tags to the image digest (SHA256 hash of the image manifest) when you create a new Amazon ECS service or deploy an update to the service. This enforces that all tasks in the service are identical and launched with this image digest(s). However, for certain containers within the task (e.g. telemetry sidecars provided by a 3rd party) customers may prefer to not enforce consistency and intead use a mutable container image tag (e.g. LATEST). Now, you can disable software version consistency for one or more containers in your ECS service by configuring the new versionConsistency attribute in the container definition. ECS applies changes to version consistency when you redeploy your ECS service with the task definition revision.

You can disable software version consistency for your Amazon ECS services running on AWS Fargate platform version 1.4.0 or higher and/or version v1.70.0 or higher of the Amazon ECS Agent in all commercial and the AWS GovCloud (US) Regions. To learn more, please visit our documentation.

Read More for the details.

2024 11 19

GCP – Google Cloud NetApp Volumes now available for OpenShift on Google Cloud

Cloud, Google Cloud gcp

As a result of new joint efforts across NetApp, Red Hat and Google Cloud, we are announcing support for Google Cloud NetApp Volumes in OpenShift on Google Cloud through NetApp Trident Version 24.10. This enables joint customers to take advantage of Google Cloud infrastructure that’s optimized for OpenShift, reduce operational toil, and streamline migration of complex workloads.

The power of OpenShift-optimized infrastructure

Red Hat and Google Cloud have a long history of collaborating on and contributing to Kubernetes as well as other Cloud Native Compute Foundation (CNCF) projects including Istio, Knative and Tekton. Together, these projects make up the basis for OpenShift, Red Hat’s platform that helps developers build, deploy, and manage applications. In fact, Google and Red Hat have been collaborating since before Kubernetes was even conceived, including co-developing Cgroups, a precursor to Linux containers. When Google open-sourced Kubernetes, Red Hat was one of the first to jump on board, betting the Red Hat OpenShift platform on the new open-source standard. Today, Google and Red Hat hold prominent leadership roles in Kubernetes governance, and are #1 and #2 largest contributors to Kubernetes, respectively.

Google Cloud infrastructure is highly optimized for OpenShift. Custom machine shapes let you optimize OpenShift Pods:Nodes bin-packing, reducing how much compute capacity you need to provision for a typical OpenShift workload. Hyperdisk Storage Pools enables thin-provisioning for OpenShift PersistentVolumes, reducing the amount of storage that needs to be provisioned. Additionally, support for live migration in a wide array of Compute Engine families lets you provide higher uptime guarantees for stateful OpenShift workloads, which are common in enterprise application portfolios.

And when you deploy OpenShift workloads on Google Cloud, you can count on access to a deep bench of L3/ L4 engineers who are experts in the OpenShift runtime core components (in Kubernetes) given Google’s staff strong participation as core maintainers and technical leads in Kubernetes, providing you with enterprise-grade support and coverage for mission-critical workloads.

aside_block: <ListValue: [StructValue([(‘title’, ‘Try Google Cloud for free’), (‘body’, <wagtail.rich_text.RichText object at 0x3e1aad975880>), (‘btn_text’, ‘Get started for free’), (‘href’, ‘https://console.cloud.google.com/freetrial?redirectPath=/welcome’), (‘image’, None)])]>

NetApp Volumes storage comes to OpenShift on Google Cloud

When you deploy OpenShift workloads on Google Cloud, there’s a wide array of options for modernizing your operations, with OpenShift-native integrations into managed infrastructure services across compute, networking, storage, monitoring/logging, secrets/encryption, serverless, CI/CD, etc.

These managed infrastructure services give you the ability to “carry much fewer pagers” than you typically would with an on-prem OpenShift deployment. However, sometimes you are migrating applications that have requirements or dependencies on specific solutions for infrastructure pillars (such as storage). The typical approach is to rely on self-managing the architecture — and going back to carrying pagers…

With support for Google Cloud NetApp Volumes in OpenShift, you benefit from the best of both worlds for your file storage needs: the modernization, toil-reduction, and efficiency benefits of a managed service, with enterprise-ready features, compatibility, and familiarity of NetApp on-premises storage.

You can maximize data performance and reliability for your Red Hat OpenShift workloads on Google Cloud by leveraging high-performance file storage on Google Cloud infrastructure while using NetApp Volumes features like automated snapshots, and Red Hat OpenShift-native persistent storage integration helps ensure high availability and fault tolerance across your workloads.

Streamlined deployment for a variety of workloads

Collaboration between Google Cloud, NetApp and Red Hat makes it easier to quickly configure and deploy Red Hat OpenShift clusters and workloads in Google Cloud with NetApp Volumes for file storage, with streamlined access to Google Cloud IAM, service account management, and the Certificate Authority Service, among others. NetApp Volumes provides as small as 1 GiB volumes, read-write many (RWX) PVs, low-latency performance and up to 12.5 GiB/sec throughput with large volumes, all while protecting your applications and data with customer managed encryption keys (CMEK).

“Google Cloud is heavily invested in our partner community with the common goal of providing a world-class experience for our customers. Building on our long-standing technical collaborations with industry-leading partners like Red Hat and NetApp, we are deeply aligned on the core principles of both openness and reliability to help enterprise customers get what they need done. Our customers are increasingly turning to us to help them transform their business and together, and through a joint partnership with NetApp and Red Hat, we can help customers with a new way to cloud, while leveraging familiarity and consistency that brings together innovations across their business.” – Stephen Orban, Google Cloud VP of Migrations, ISVs, and Marketplace

De-risk cloud adoption while accelerating time to value

We are partnering with one of our trusted resellers, Converge Technology Solutions, to bridge on-premises, multi-cloud, and Google Cloud, and provide unified management and operational experience for your Red Hat OpenShift and NetApp workloads. Converge’s expertise in Red Hat OpenShift and NetApp technologies helps ensure solutions are architected for peak performance, scalability, and reliability. You can take advantage of their deep understanding of hybrid cloud and Kubernetes/Red Hat OpenShift to provide a smooth transition to Google Cloud, minimizing disruption and maximizing uptime. At the same time, Converge’s best-practice-aligned methodologies help streamline Google Cloud deployments while integrating Red Hat OpenShift and NetApp Volumes, so you can run persistent containerized workloads on an enterprise-class hybrid cloud environment.

“Converge is thrilled to partner with Google Cloud, Red Hat, and NetApp to deliver this powerful new solution for OpenShift on Google Cloud. Our deep expertise in hybrid cloud and Kubernetes, coupled with our proven methodologies, ensures a seamless transition and rapid time-to-value for clients adopting this innovative offering. This collaboration empowers enterprises to modernize their operations, optimize their infrastructure, and unlock the full potential of containerized workloads in a secure and reliable hybrid cloud environment.” – David Luftig, Executive Vice President Strategy and Solutions, Converge Technology Solutions

Connect with us to learn more

Are you ready to get more value from the cloud? Learn more about Red Hat solutions on Google Cloud Marketplace, and Google Cloud NetApp Volumes. You can also contact your Red Hat, NetApp, or Google sales representatives, or reach out to Converge Technology specialists to discuss your specific use cases.

About NetApp
NetApp is the intelligent data infrastructure company, combining unified data storage, integrated data services, and CloudOps solutions to turn a world of disruption into opportunity for every customer. NetApp creates silo-free infrastructure, harnessing observability and AI to enable the industry’s best data management. As the only enterprise-grade storage service natively embedded in the world’s biggest clouds, our data storage delivers seamless flexibility. In addition, our data services create a data advantage through superior cyber resilience, governance, and application agility. Our CloudOps solutions provide continuous optimization of performance and efficiency through observability and AI. No matter the data type, workload, or environment, with NetApp you can transform your data infrastructure to realize your business possibilities.

About Red Hat, Inc.
Red Hat is the world’s leading provider of enterprise open source software solutions, using a community-powered approach to deliver reliable and high-performing Linux, hybrid cloud, container, and Kubernetes technologies. Red Hat helps customers integrate new and existing IT applications, develop cloud-native applications, standardize on our industry-leading operating system, and automate, secure, and manage complex environments. Award-winning support, training, and consulting services make Red Hat a trusted adviser to the Fortune 500. As a strategic partner to cloud providers, system integrators, application vendors, customers, and open source communities, Red Hat can help organizations prepare for the digital future.

About Converge
Converge Technology Solutions Corp. is a services-led, software-enabled, IT & Cloud Solutions provider focused on delivering industry-leading solutions. Converge’s global approach delivers advanced analytics, artificial intelligence (AI), application modernization, cloud platforms, cybersecurity, digital infrastructure, and digital workplace offerings to clients across various industries. The Company supports these solutions with advisory, implementation, and managed services expertise across all major IT vendors in the marketplace. This multi-faceted approach enables Converge to address the unique business and technology requirements for all clients in the public and private sectors. For more information, visit convergetp.com.

Read More for the details.

2024 11 19

GCP – Realizing AI’s Full Potential where Workforce, Security, & Collaboration Matter

Cloud, Google Cloud gcp

AI is rapidly reshaping the public sector, ushering in a new era of intelligent and AI-powered service delivery and mission impact. Chief AI Officers (CAIOs) and other agency leaders play a critical role as AI becomes more pervasive. At Google, we’ve long believed that AI is a foundational and transformational technology, with the potential to benefit people and society. Realizing its full potential to improve government services, enhance decision-making, and ultimately create a more efficient and effective public sector requires leadership and a clear commitment.

Google recently commissioned IDC to conduct a study that surveyed 161 federal CAIOs, government AI leaders and other decision makers to understand how agency leaders are leading in this new AI era – and the value they are already bringing when it comes to AI governance, collaboration, and building public trust and citizen engagement¹. I recently sat down with Ruthbea Yesner, Vice-President of IDC Government Insights to explore the key findings of this research and what it means for the public sector – see excerpts of our discussion and key insights below.

Key Finding #1: 62% of those surveyed say strengthening cybersecurity is a top motivator for AI investments

Agencies are embracing AI to enhance cybersecurity and protect critical infrastructure – with 60% of respondents indicating that internal cybersecurity protection is their top AI/ML use case. Over 40% of federal agencies surveyed state that protecting critical infrastructure is a key driver for their AI investments going forward. Additionally, respondents believe that applying AI to strengthen cybersecurity and protect critical infrastructure will deliver positive outcomes in just 9 months; the second fastest time to value of any expected outcome of AI.

CAIOs and other agency leaders play a crucial role in driving AI adoption and ensuring that agencies are able to leverage this powerful technology. While 50% of federal agencies have already appointed a CAIO, the rest are expected to follow soon. As adoption accelerates and AI maturity grows, CAIOs need to prioritize robust cybersecurity measures and risk mitigation strategies in all AI initiatives, ensuring the protection of sensitive data and systems.

Key Finding #2: Higher AI maturity increases likelihood to explore other Gen AI use cases by 4x

IDC created a 5-phase approach to assessing AI maturity and the findings are remarkable – 50% of agencies surveyed reported high levels of AI maturity which corresponds to mature behaviors like piloting and implementing generative AI use cases to drive innovation and mission impact. Mature AI agencies are embracing an innovation culture and are focused on AI use cases and projects with high potential for impact.

We’re seeing some agencies solving for one specific problem or use case and creating quick wins and the appetite to do more, and in other cases, they are tackling big, complex challenges head-on. By adopting an AI-first mindset, incorporating AI into their workflows and scaling their use of AI, they are creating the groundswell to do more. This has a compounding effect as AI becomes more pervasive across the agency, and individuals increasingly feel part of its positive cultural change and impact.

This has a catalyst effect, it just takes one person doing something amazing with AI to motivate others to learn and apply AI

Ruthbea Yesner

Vice-President of IDC Government Insights

Generative AI is the future – attracting 42% of AI investments. Agencies are eager to explore its potential – and innovation will be a key motivator for continued AI investment going forward. As organizations prioritize AI, the CAIO role becomes even more multifaceted, demanding not just technical expertise but also visionary leadership to drive organizational culture change and develop a truly AI-enabled workforce.

We believe that a robust AI maturity model, as outlined in IDC’s The Chief Artificial Intelligence Officer (CAIO) Playbook: A Practical Guide for Advancing AI Innovation in Government, is key to guiding agencies in their adoption of AI and fostering organizational readiness. By providing a clear framework for progress, agencies can strategically navigate the complexities of AI implementation and unlock its full potential.

Key Finding #3: An AI-ready workforce is the key to unlocking AI’s potential

The rapid pace of AI adoption has highlighted a significant challenge: a shortage of AI expertise. 39% percent of survey respondents report that their biggest challenge is a lack of in-house AI skills and expertise, and 68% are focused on training and retaining their workforce.

Google is tackling this skills challenge head-on. We recently announced our Google Cloud Launchpad for Veterans – a no-cost training and certification journey to equip veterans in all roles and at all levels with the cloud knowledge and skills needed to drive innovation, and contribute to their employer’s digital transformation strategy. And we also announced a new AI training initiative through Google.org’s AI Opportunity Fund – with $15 million for AI skills training for US government workers for the Partnership for Public Service and InnovateUS. This also includes a grant to the Partnership for Public Service to establish the new Center for Federal AI to provide AI skills and literacy to federal leaders and workers, including 2,000 senior government officials.

One thing is clear – AI requires leadership, and the CAIO is an important new C-suite role signaling the government’s commitment to harness AI and reach its full potential. CAIOs and other agency leaders are critical to charting this new AI era and providing the expertise and leadership necessary to leverage AI for the public good.

To learn more about how CAIOs are leading in this new AI era, download The Chief Artificial Intelligence Officer (CAIO) Playbook: A Practical Guide for Advancing AI Innovation in Government. By embracing its recommendations, agencies can create their own roadmap to drive AI adoption to accelerate mission outcomes and impact. To hear the full interview with Ruthbea Yesner, Vice-President of IDC Government Insights, please register to join the Google Public Sector Summit On-Demand on December 3rd.

_{¹ IDC Signature White Paper, The Chief Artificial Intelligence Officer (CAIO) Playbook: A Practical Guide for Advancing AI Innovation in Government, sponsored by Google Public Sector, Doc# US52616824, October 2024.}

Read More for the details.

2024 11 19

AWS – Amazon OpenSearch Serverless now supports Binary Vector and FP16 cost savings features

AWS, Cloud AWS

We are excited to announce that Amazon OpenSearch Serverless now is supporting Binary Vector and FP16 compression helping reduce costs by lowering the memory requirements. It also lowers the latency, improve performance with acceptable accuracy tradeoff. OpenSearch Serverless is a serverless deployment option for Amazon OpenSearch Service that makes it simple to run search and analytics workloads without the complexities of infrastructure management. OpenSearch Serverless’ compute capacity used for data ingestion, search, and query is measured in OpenSearch Compute Units (OCUs).

The support for OpenSearch Serverless is now available in 17 regions globally: US East (Ohio), US East (N. Virginia), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Europe (Frankfurt), Europe (Ireland), Europe West (Paris), Europe West (London), Asia Pacific South (Mumbai), South America (Sao Paulo), Canada Central (Montreal), Asia Pacific (Seoul). Europe (Zurich), AWS GovCloud (US-West), and AWS GovCloud (US-East). Please refer to the AWS Regional Services List for more information about Amazon OpenSearch Service availability. To learn more about OpenSearch Serverless, see the documentation.

Read More for the details.

2024 11 19

GCP – The overwhelmed person’s guide to Google Cloud: week of November 14

Cloud, Google Cloud gcp

The content in this blog post was originally published last week as a members-only email to the Google Cloud Innovators community. To get this content directly in your inbox (not to mention lots of other benefits), sign up to be an Innovator today.

New and shiny

Three new things to know this week

Ground Gemini’s answers with Google Search in Vertex AI and Google AI Studio. There’s brand new support in Google AI Studio for connecting the Gemini model’s output to verifiable sources of data through Google Search. This functionality is already part of Vertex AI, but both platforms now support dynamic retrieval. This means that grounding only happens if we predict that the query needs it. See how it works in Vertex AI, and learn how to get started in Google AI Studio.
Use Google’s own Arm-based CPUs. The Axion CPU is now ready for you! Get some excellent price performance and better energy efficiency by deploying C4A VMs powered by our first Arm-based processors.
Business process automation service gets AI upgrade, increased sophistication. It’s likely flying below your radar, but take a look at Google Cloud Application Integration. You can model out workflows for connecting systems in all sorts of ways. There’s now Gemini Code Assist functionality to help you build integrations, model out data transformations, create test cases, and even apply complex retry strategies.
Build and Deploy Gen AI Applications on Google Cloud with Genkit and Go. Join us on November 19th for a hands-on workshop to build and deploy a generative AI app on Google Cloud! Use Genkit, Vertex AI, and Go to create and automate a reusable app deployment pipeline—perfect for beginners and pros alike.

Watch this

Learn advanced RAG techniques. Watch this excellent video series to get up to speed on LLM fundamentals. This edition looks at retrieval augmented generation and enhancing quality of responses.

Community cuts

Every week I round up some of my favorite links from builders around the Google Cloud-iverse. Want to see your blog or video in the next issue? Drop Richard a line!

“Perfect” is a strong word, but yeah, we’re pretty good. Simon at SADA makes the case that you should be looking at Google Cloud for your AI work because of our models, security posture, tools, and expertise. Who am I to disagree?
Build an ETL pipeline locally and then transition to the cloud. Thomas looks at the exercise of taking a working data pipeline and using our data and compute services to get it running successfully in Google Cloud.
What exactly is Firebase? It’s been part of Google for a while and is used by mobile devs around the world. Now it’s appealing to new audiences, and this post from Hermant explains what it offers to modern developers.

Learn and grow

Three ways to build your cloud muscles this week

In-person Workshop! AI In Action – AlloyDB and Vertex AI Agent Builder. Level up your AI skills with a hands-on journey in building knowledge-driven chat applications! Dive into AlloyDB and Vertex AI Agent Builder to create intelligent, interactive customer solutions. Sign up now! New York – 11/20, Toronto – 11/22, Bay Area – 12/3, Seattle – 12/5.
Let’s modernize our old apps. Here’s a great code lab that walks you through, step-by-step, the process to modernize an old PHP app. Learn what it takes to containerize the app, automate the path to production, add generative AI features, and introduce modern operations.
Running Apache Airflow? You have choices. If you’re orchestrating data, there’s a good chance you’ve come across Apache Airflow. This post points out that you can run it yourself on VMs, use a more managed GKE environment, or embrace a fully managed service with Cloud Composer.
Cloud Workstations is ready for devs in government. You deserve nice things, wherever you may work. Those in restricted environments sometimes have to settle for less. But now, Cloud Workstations is FedRAMP High Authorized. Curious about Cloud Workstations? Stanal has a good new overview post.
Standard storage format, and all the BigQuery goodness. We just shipped a preview of BigQuery tables for Apache Iceberg. Use this open format to store data, but get all the lakehouse goodness that BigQuery offers.

One more thing

Gemini is used across Google to create helpful AI experiences. Jeff highlights Sundar’s message about the billions of Google users with access to Gemini.

Become an Innovator to stay up-to-date on the latest news, product updates, events, and learning opportunities with Google Cloud.

Read More for the details.

2024 11 19

GCP – New ways to protect your sensitive data with Chrome Enterprise

Cloud, Google Cloud gcp

Protecting sensitive company data is no longer just a best practice—it’s business critical. In today’s world, data breaches can have serious consequences, from financial losses and reputational damage to legal repercussions and operational disruptions. That’s why Chrome Enterprise Premium, our advanced secure enterprise browser offering, includes a growing suite of Data Loss Prevention (DLP) capabilities to help organizations safeguard their sensitive information and maintain compliance.

We recently launched a number of enhancements to our DLP capabilities, giving you even more granular control over your company’s data. This blog post will explore how these new capabilities support your organization’s comprehensive DLP journey—from discovering potential risks and user behavior, to controlling data flow with robust security measures, to investigating potential incidents with detailed reporting and analysis, and finally, to expanding protection beyond desktops.

Discover and understand user behavior

Understanding how your users interact with data is the first step in preventing data leaks. Chrome Enterprise provides powerful tools to gain visibility into user activity and to identify potential risks:

1. Chrome Security Insights

Chrome Security Insights empowers Chrome Enterprise customers to proactively identify potential threats with simplified security monitoring. This feature monitors key security configurations, security event logging, and 50 common DLP detectors with just a few clicks. Administrators gain valuable insights into high-risk activities through detailed reports on users, domains, and sensitive data transfers, enabling swift identification and remediation of security concerns. Start your 30-day Chrome Enterprise Premium trial and enable Chrome Security Insights here.

2. URL Filtering Audit Mode [Currently in Public Preview (beta), general availability coming soon]

Chrome Enterprise Premium’s URL Filtering Audit Mode offers a valuable tool for organizations seeking to refine their web access policies. It allows administrators to selectively activate monitoring of employee browsing activity without enforcing restrictions, providing insights into users behavior and potential security risks. By analyzing this data, IT and security teams can make informed decisions regarding URL filtering rules, striking an effective balance between security and user productivity. See here to learn how to configure URL Filtering Audit Mode.

Enforce DLP controls

Once you understand your users’ behavior, it’s time to put the right controls in place to prevent data leaks. Chrome Enterprise offers a robust set of in-browser protections.

1. Copy and paste protections

Controlling how users interact with sensitive data is crucial. Chrome Enterprise Premium’s copy and paste protections allow you to restrict or block users from copying sensitive information from web pages or pasting it into unauthorized applications or websites. This granular control helps prevent data exfiltration and ensures that sensitive information stays within designated boundaries, reducing the risk of data breaches and helping with compliance with data protection regulations. The copy and paste protections include:

Preventing data leakage to Incognito mode: Concerned about sensitive data being copied into incognito mode, where it can potentially bypass security measures? Chrome Enterprise Premium now allows you to block or warn users when they attempt to copy data between regular browsing sessions and incognito windows.
Controlling data sharing between applications: For organizations looking to prevent data leakage to external applications, Chrome Enterprise Premium now allows you to block or warn users when they attempt to copy data from your web applications into external programs like Notepad, Microsoft Word, or other apps.
Isolating data between Chrome profiles: Shared devices or users with multiple Chrome profiles can introduce risks of data cross-contamination. Chrome Enterprise Premium’s new copy-paste controls now allow you to block or warn users when they attempt to move data between different profiles.
Securing sensitive emails: Emails often contain highly confidential information requiring stringent protection. With Chrome Enterprise Premium, you can implement specific rules, such as blocking any copying from Gmail unless it’s being pasted back into Gmail.

See more details about setting up copy and paste protections here.

2. Watermarking

Watermarking acts as a deterrent to unauthorized data sharing. Chrome Enterprise Premium allows you to apply visible watermarks to sensitive company documents viewed in the browser, displaying information like the user’s email address, date, or a custom message. This helps discourage data exfiltration and makes it easier to trace the source of any leaked information. See here on how to set up watermarking with Chrome Enterprise Premium

3. Screenshot protections

Screenshots can be a convenient way to capture information, but they also pose a data leak risk. Chrome Enterprise Premium’s screenshot protection allows you to prevent users from taking screenshots of sensitive content within the browser. This adds another layer of protection to your DLP strategy, limiting the potential for unauthorized data capture. Learn how to set up screenshot protection rules here.

These controls work together to create a comprehensive security strategy, limiting the ways in which data can be exfiltrated from your organization.

Investigate potential data leaks

Even with the best preventative measures in place, it’s crucial to be prepared to investigate potential security incidents. Chrome Enterprise provides tools to help you quickly identify and address threats:

1. Evidence Locker [Currently in Private Preview, general availability coming soon]

The evidence locker provides a secure repository for storing files and data that require further investigation by security teams. For instance, if an employee attempts to download a non-public financial report, Chrome Enterprise Premium can block the action and retain a copy of the file in the evidence locker. This triggers a detailed report for IT and security teams, enabling them to take appropriate investigation and remediation steps. Stay tuned for more information on the upcoming release of Evidence Locker.

2. Chrome Extension Telemetry in Google Security Operations

Chrome Enterprise Core integrates with Google Security Operations, our cloud-native security analytics platform, to provide deeper visibility into browser activity. Previously, detection and response teams were limited to analyzing static extension attributes. Now, you can set dynamic rules that continuously monitor extension behavior in your production environment, enabling proactive identification and remediation of risks before they escalate into threats. For example, you can monitor if extensions are unexpectedly contacting remote hosts or accessing cookies. This enhanced visibility empowers your security team to detect and mitigate data theft and infrastructure attacks in near real-time, significantly reducing your organization’s vulnerability to malicious extensions. See how to set this up here.

Expand protection to other platforms

Chrome Enterprise is committed to extending its threat protection capabilities beyond the desktop.

1. Mobile threat protections

With the growing use of mobile devices for work, securing the browser on these devices is essential. Chrome Enterprise Core is extending its threat protection capabilities to Android devices with download blocking. This feature will allow organizations to set policies to prevent users from downloading malicious files flagged by Google Safe Browsing from the web onto their mobile devices, bringing threat protections beyond desktops. Organizations can also choose to block all downloads on Android on managed Chrome. Get started with Chrome Enterprise Core today at no additional costs.

Chrome Enterprise Premium: Your partner in DLP

These features are just a glimpse into the comprehensive DLP capabilities offered by Chrome Enterprise. We are consistently enhancing our security capabilities to help organizations like yours take a proactive approach to data loss prevention, safeguarding sensitive information at the critical browser layer and ensuring compliance in today’s increasingly complex digital landscape.

Start using Chrome Enterprise Core today at no additional cost to gain foundational security capabilities. Or, experience Chrome Enterprise Premium’s advanced security and DLP features with a free 60-day trial and enable Chrome Security Insights here.

Read More for the details.

2024 11 19

GCP – Empowering Gemini for Malware Analysis with Code Interpreter and Google Threat Intelligence

Cloud, Google Cloud gcp

One of Google Cloud’s major missions is to arm security professionals with modern tools to help them defend against the latest threats. Part of that mission involves moving closer to a more autonomous, adaptive approach in threat intelligence automation.

In our latest advancements in malware analysis, we’re equipping Gemini with new capabilities to address obfuscation techniques and obtain real-time insights on indicators of compromise (IOCs). By integrating the Code Interpreter extension, Gemini can now dynamically create and execute code to help deobfuscate specific strings or code sections, while Google Threat Intelligence (GTI) function calling enables it to query GTI for additional context on URLs, IPs, and domains found within malware samples. These tools are a step toward transforming Gemini into a more adaptive agent for malware analysis, enhancing its ability to interpret obfuscated elements and gather contextual information based on the unique characteristics of each sample.

Building on this foundation, we previously explored critical preparatory steps with Gemini 1.5 Pro, leveraging its expansive 2-million-token input window to process substantial sections of decompiled code in a single pass. To further enhance scalability, we introduced Gemini 1.5 Flash, incorporating automated binary unpacking through Mandiant Backscatter before the decompilation phase to tackle certain obfuscation techniques. Yet, as any seasoned malware analyst knows, the true challenge often begins once the code is exposed. Malware developers frequently employ obfuscation tactics to conceal critical IOCs and underlying logic. Malware may also download additional malicious code, making it challenging to fully understand the behavior of a given sample.

For large language models (LLMs), obfuscation techniques and additional payloads create unique challenges. When dealing with obfuscated strings such as URLs, IPs, domains, or file names, LLMs often “hallucinate” without explicit decoding methods. Additionally, LLMs cannot access, for example, URLs that host additional payloads, often resulting in speculative interpretations about the sample’s behavior.

To help with these challenges, Code Interpreter and GTI function calling tools provide targeted solutions. Code Interpreter enables Gemini to autonomously create and execute custom scripts, as needed, using its own judgment to decode obfuscated elements within a sample, such as strings encoded with XOR-based algorithms. This capability minimizes interpretation errors and enhances Gemini’s ability to reveal hidden logic without requiring manual intervention.

Meanwhile, GTI function calling expands Gemini’s reach by retrieving contextualized information from Google Threat Intelligence on suspicious external resources such as URLs, IPs, or domains, providing verified insights without speculative guesses. Together, these tools equip Gemini to better handle obfuscated or externally hosted data, bringing it closer to the goal of functioning as an autonomous agent for malware analysis.

To illustrate how these enhancements boost Gemini’s capabilities, let’s look at a practical example. In this case, we’re analyzing a PowerShell script that contains an obfuscated URL that hosts a second-stage payload. This particular sample was previously analyzed with some of the most advanced publicly available LLM models, which incorporate code generation and execution as part of their reasoning process. Despite these capabilities, each model “hallucinated,” generating completely fabricated URLs instead of accurately revealing the correct one.

Obfuscated PowerShell code sample to be analyzed by Gemini

Utilizing Code Interpreter and GTI function calling as part of its reasoning process, Gemini autonomously generated the following report without any human intervention. When deemed necessary, it applies these tools to process and extract additional information from the sample.

Final Report: PowerShell Malware with URL Deobfuscation

This report analyzes a PowerShell script designed to download and execute a file from an obfuscated URL. The script employs a custom obfuscation routine resembling the RC4 stream cipher to conceal the malicious URL.

Functionality:

Obfuscation Routine: The script defines a function F that performs byte-level XOR encryption using a key derived from the string “tox2”. This function is used to deobfuscate the malicious URL.
URL Decryption: The obfuscated URL, stored as a byte array, is decrypted using the F function with “tox2” as the key.
File Download: The script downloads a file from the decrypted URL (hxxps://filedn[.]eu/lODWTgN8sswHA6Pn8HXWe1J/tox2/Scan_docs%2398097960[.]msi) and saves it to the system’s temporary directory under a randomly generated filename.
Execution: Finally, the script executes the downloaded file.

Indicators of Compromise (IOCs):

URL: hxxps://filedn[.]eu/lODWTgN8sswHA6Pn8HXWe1J/tox2/Scan_docs%2398097960[.]msi

Deobfuscation Code:

def deobfuscate(x, y):
    s = list(range(256))
    j = 0
    k = [ord(c) for c in y]
    for i in range(256):
        j = (j + s[i] + k[i % len(k)]) % 256
        s[i], s[j] = s[j], s[i]
    i = 0
    j = 0
    output = []
    for m in range(len(x)):
        i = (i + 1) % 256
        j = (j + s[i]) % 256
        s[i], s[j] = s[j], s[i]
        output.append(x[m] ^ s[(s[i] + s[j]) % 256])
    return output

a = [0x25, 0x7B, 0x5A, 0xD8, 0x9C, 0xFF, 0xC3, 0xA4, 0x95, 0xB7, 
0x9D, 0x6E, 0x5F, 0x4D, 0x49, 0xFB, 0x78, 0x32, 0xB8, 0x17, 0x72, 
0x01, 0x31, 0xFB, 0xC0, 0x58, 0x45, 0xCB, 0x5C, 0x3C, 0xDD, 0x00, 
0x60, 0x87, 0x25, 0xB2, 0x44, 0xA6, 0xC5, 0xEA, 0x71, 0xAA, 0x9D, 
0xA1, 0x05, 0x5F, 0xBD, 0x41, 0x28, 0x70, 0x30, 0x6B, 0x96, 0x24, 
0x92, 0xA0, 0x9D, 0x92, 0x23, 0x79, 0x69, 0x2C, 0x1B, 0x1E, 0xEB, 
0x69, 0x8F, 0x04, 0x10, 0x74, 0xBC]
b = "tox2"
c = deobfuscate(a, b)
decoded_url = "".join(chr(i) for i in c)
print(decoded_url)

Google Threat Intelligence (GTI) Lookup:

The GTI lookup provides valuable context regarding the identified IOC:

Threat Actor: UNC5687, known for using MESHAGENT in phishing campaigns impersonating the Security Service of Ukraine.
Campaign: This specific URL is linked to a campaign spreading MESHAGENT via phishing emails with malicious links. The campaign involved a captcha page leading to the download of either a malicious MSI or EXE file.
Malware: The campaign delivers MESHAGENT, an open-source remote access framework, configured to communicate with C2 domains linked to a service called “AnonVNC.”

Conclusion:

The analyzed PowerShell script is confirmed to be malicious, associated with a phishing campaign by UNC5687 distributing the MESHAGENT remote access tool.

Gemini identified that the script employs an XOR-based obfuscation algorithm that resembles RC4 to conceal the download URL. Recognizing this pattern, Gemini autonomously generates and executes a Python deobfuscation script within the Code Interpreter sandbox, successfully revealing the external resource.

With the URL in hand, Gemini then utilizes GTI function calling to query Google Threat Intelligence for further context. This analysis links the URL to UNC5687, a threat cluster known for using a remote access tool in phishing campaigns impersonating the Security Service of Ukraine.

As we’ve seen, the integration of these tools has strengthened Gemini’s ability to function as a malware analyst capable of adapting its approach to address obfuscation and gathering vital context on IOCs. By incorporating the Code Interpreter and GTI function calling, Gemini is better equipped to navigate complex samples by autonomously interpreting hidden elements and contextualizing external references.

While these are significant advancements, many challenges remain, especially given the vast diversity of malware and scenarios that exist in the threat landscape. We’re committed to making steady progress, and future updates will continue to enhance Gemini’s capabilities, moving us closer to a more autonomous, adaptive approach in threat intelligence automation.

Read More for the details.

2024 11 18

AWS – Amazon EC2 X2iezn instances are now available in additional AWS region

AWS, Cloud AWS

Starting today, memory optimized Amazon EC2 X2iezn instances are available in Middle East (UAE). Amazon EC2 X2iezn instances are powered by 2nd generation Intel Xeon Scalable processors with an all core turbo frequency of up to 4.5 GHz, the fastest in the cloud. These instances are a great fit for electronic design automation (EDA) workloads as well as relational databases that benefit from high single-threaded processor performance and a large memory footprint. The combination of high single-threaded compute performance and a 32:1 ratio of memory to vCPU make X2iezn instances an ideal fit for EDA workloads including physical verification, static timing analysis, power sign-off, and full chip gate level simulation, and database workloads that are license bounded. These instances are built on the AWS Nitro System, which is a rich collection of building blocks that offloads many of the traditional virtualization functions to dedicated hardware, delivering high performance, high availability, and highly-secure cloud instances.

With this additional region, the X2iezn instances are now available in the AWS US West (Oregon), US East (Northern Virginia), Europe (Ireland), Asia Pacific (Tokyo), and Middle East (UAE) regions. X2iezn instances will be available for purchase with Savings Plans, Reserved Instances, Convertible Reserved, On-Demand, and Spot instances, or as Dedicated instances or Dedicated hosts.

To get started with X2iezn instances, visit the AWS Management Console, AWS Command Line Interface (CLI), and AWS SDKs. To learn more, visit the EC2 X2iezn instances Page, visit the AWS forum for EC2 or connect with your usual AWS Support contacts.

Read More for the details.

2024 11 18

AWS – AWS IoT SiteWise announces new generative AI-powered industrial assistant

AWS, Cloud AWS

AWS IoT SiteWise is a managed service that simplifies the collection, organization, and monitoring of industrial equipment data at scale. Today, we are excited to announce the general availability of AWS IoT SiteWise Assistant, a generative AI-powered assistant in AWS IoT SiteWise that allows industrial users to gain insights, solve problems, and take actions from their operational data and other data sources intuitively using natural language queries.

With the AWS IoT SiteWise Assistant, you can easily interact with your operational data by clicking on alarms in the SiteWise Monitor dashboard to get summaries or by asking questions like “What assets have active alarms?” or “How do I fix the wind turbine’s low RPM issue?”. The assistant understands the context of your industrial data in AWS IoT SiteWise from sources like sensors, machines, and related processes, and then contextualizes the data with your centralized knowledge base using Amazon Kendra to provide useful insights, empowering faster decision making to reduce downtime, optimize processes, and improve productivity.

AWS IoT SiteWise Assistant introduces new APIs that allow industrial solutions to access these insights on-demand. Developers can integrate capabilities of the Assistant into their industrial applications using updated IoT AppKit widgets like Chatbots, Line Charts, and KPI Gauges. Additionally, a Preview of the new Assistant-aware AWS IoT SiteWise Monitor portal offers a no-code experience for visualizing key data-driven insights.

AWS IoT SiteWise Assistant is now available in US East (N. Virginia), US West (Oregon), Asia Pacific (Sydney), and Europe (Ireland). Check out the user guide, API reference, and launch blog to learn more.

Read More for the details.

2024 11 18

AWS – Amazon EKS simplifies providing IAM permissions to EKS add-ons

AWS, Cloud AWS

Amazon Elastic Kubernetes Service (EKS) now offers a direct integration between EKS add-ons and EKS Pod Identity, streamlining the lifecycle management process for critical cluster operational software that needs to interact with AWS services outside the cluster.

EKS add-ons that enable integration with underlying AWS resources need IAM permissions to interact with AWS services. EKS Pod Identities simplify how Kubernetes applications obtain AWS IAM permissions. With today’s launch, you can directly manage EKS Pod Identities using EKS add-ons operations through the EKS console, CLI, API, eksctl, and IAC tools like AWS CloudFormation, simplifying usage of Pod Identities for EKS add-ons. This integration expands the selection of Pod Identity compatible EKS add-ons from AWS and AWS Marketplace available for installation through the EKS console during cluster creation.

EKS add-ons integration with Pod Identities is generally available in all commercial AWS regions. To get started, see the EKS user guide.

Read More for the details.

2024 11 18

AWS – Amazon Aurora MySQL 3.08 (compatible with MySQL 8.0.39) is generally available

AWS, Cloud AWS

Starting today, Amazon Aurora MySQL-Compatible Edition 3 (with MySQL 8.0 compatibility) will support MySQL 8.0.39. In addition to several security enhancements and bug fixes, MySQL 8.0.39 contains enhancements that improve database availability when handling large number of tables and reduce InnoDB issues related to redo logging, and index handling.

Aurora MySQL 3.08 also includes multiple availability improvements to reduce database restarts, memory management telemetry improvements with new CloudWatch metrics, major version upgrade optimizations for Aurora MySQL 2 to 3 upgrades, and general improvements around memory management and observability. For more details, refer to the Aurora MySQL 3.08 and MySQL 8.0.39 release notes.

To upgrade to Aurora MySQL 3.08, you can initiate a minor version upgrade manually by modifying your DB cluster, or you can enable the “Auto minor version upgrade” option when creating or modifying a DB cluster. This release is available in all AWS regions where Aurora MySQL is available.

Amazon Aurora is designed for unparalleled high performance and availability at global scale with full MySQL and PostgreSQL compatibility. It provides built-in security, continuous backups, serverless compute, up to 15 read replicas, automated multi-Region replication, and integrations with other AWS services. To get started with Amazon Aurora, take a look at our getting started page.

Read More for the details.

2024 11 18

AWS – AWS Chatbot adds support for chatting about AWS resources with Amazon Q Developer in Microsoft Teams and Slack

AWS, Cloud AWS

We are excited to announce the general availability of Amazon Q Developer in AWS Chatbot, which provides answers to customers’ AWS resource related queries in Microsoft Teams and Slack.

When issues occur, customers need to quickly find relevant resources to troubleshoot issues. Customer can now ask questions in natural language in chat channels to list resources in AWS accounts, get specific resource details, and ask about related resources using Amazon Q Developer.

With Amazon Q Developer in AWS Chatbot, customers find AWS resources by typing “@aws show ec2 instances in running state in us-east-1” or “@aws what is the size of the auto scaling group XX in us-east-2?”

Get started with AWS Chatbot by visiting the Chatbot Console and by downloading the AWS Chatbot app from the Microsoft Teams marketplace or Slack App Directory. To get started with chatting with Amazon Q in AWS Chatbot, visit the Asking Amazon Q questions in AWS Chatbot in AWS Chatbot documentation.

Read More for the details.

2024 11 18

AWS – Amazon DynamoDB announces general availability of attribute-based access control

AWS, Cloud AWS

Amazon DynamoDB is a serverless, NoSQL, fully managed database with single-digit millisecond performance at any scale. Today, we are announcing the general availability of attribute-based access control (ABAC) support for tables and indexes in all AWS Commercial Regions and the AWS GovCloud (US) Regions. ABAC is an authorization strategy that lets you define access permissions based on tags attached to users, roles, and AWS resources. Using ABAC with DynamoDB helps you simplify permission management with your tables and indexes as your applications and organizations scale.

ABAC uses tag-based conditions in your AWS Identity and Access Management (IAM) policies or other policies to allow or deny specific actions on your tables or indexes when IAM principals’ tags match the tags for the tables. Using tag-based conditions, you can also set more granular access permissions based on your organizational structures. ABAC automatically applies your tag-based permissions to new employees and changing resource structures, without rewriting policies as organizations grow.

There is no additional cost to use ABAC. You can get started with ABAC using the AWS Management Console, AWS API, AWS CLI, AWS SDK, or AWS CloudFormation. Learn more at Using attribute-based access control with DynamoDB.

Read More for the details.

2024 11 18

AWS – AWS Controllers for Kubernetes for AWS Private CA now generally available

AWS, Cloud AWS

AWS Controllers for Kubernetes (ACK) service controller for AWS Private Certificate Authority (AWS Private CA) has graduated to generally available status.

By using ACK service controller for AWS Private CA, customers can now provision and manage AWS Private CA certificate authorities (CAs) and private certificates directly from Kubernetes. You can use private certificates to secure containers with encryption and identify workloads. AWS Private CA enables creation of private CA hierarchies, including root and subordinate CAs, without the investment and maintenance costs of operating an on-premises CA. With AWS Private CA, you can issue certificates automatically and at scale from a highly-available, managed cloud CA that is backed by hardware security modules.

To get started using ACK service controller for AWS Private CA visit the documentation. You can learn more about ACK and other service controllers here.

Read More for the details.

2024 11 18

AWS – Announcing business planning feature in AWS Partner Central

AWS, Cloud AWS

AWS Partner Central is launching a business planning feature to help AWS Partners create successful partnerships and accelerate co-sell with AWS.

Currently, Partners have multiple touchpoints, conversations, and emails with AWS Partner management and sales teams as part of business planning exercises. AWS is making this collaboration easier and more efficient by centralizing the business planning process and standardizing templates in Partner Central. This will provide a central mechanism to help track progress toward business goals with AWS.

Partners can create joint business plans with AWS that are tailor-made for their unique business needs. Partners can review and edit inputs, set goals, and track progress in a single experience. Comprehensive reporting provides year-to-date actual performance, current-year attainment, and year-over-year changes for selected business metrics, reducing manual effort for collecting data from various sources.

The business planning feature is available to AWS Partners who are actively engaged with AWS Partner management teams to create joint business plans. To get started, reach out to your AWS Partner contact to initiate a business plan. Once a draft plan is shared, log in to AWS Partner Central, navigate to “My company,” and click on “Business plan” to start collaborating.

Read More for the details.

2024 11 18

AWS – Amazon Q Developer in the AWS Management Console now uses the service you’re viewing as context for your chat

AWS, Cloud AWS

Amazon Q Developer in the AWS Management Console now provides context-aware assistance for your questions about resources in your account. This feature allows you to ask questions directly related to the console page you’re viewing, eliminating the need to specify the service or resource in your query. Q Developer uses the current page as additional context to provide more accurate and relevant responses, streamlining your interaction with AWS services and resources. When the service or resource cannot be inferred, Q Developer now prompts for clarification about the specific resource in question. It presents a list of potentially relevant resources, allowing you to select the appropriate one.

Customers use AWS Management Console’s curated experiences to investigate and act on their resources. Q Developer chat in the console allows customers to ask questions about AWS services and resources. Now, Q Developer uses the resource you’re currently viewing as context, reducing the need to specify resource identifiers to Q. For example, if you are viewing an EC2 instance and ask Amazon Q, “what is the ami of this instance?” you will not need to specify the instance you are referring to. For ambiguous questions without clear context, Q Developer offers potentially relevant resource options. Q can now count up to 500 resources of a specific type to assist with quantification.

Start gaining deeper insight into your resources using the AWS resource inspection capabilities with Amazon Q in the AWS console. Learn more about Amazon Q Developer here.

Read More for the details.

2024 11 18

AWS – Announcing Amazon CloudWatch Metrics support in AWS End User Messaging

AWS, Cloud AWS

Today, AWS announces general availability support for 10 new Amazon CloudWatch metrics in AWS End User Messaging for the SMS and MMS channel. AWS End User Messaging provides developers with a scalable and cost-effective messaging infrastructure without compromising the safety, security, or results of their communications.

You can now use CloudWatch metrics to monitor SMS and MMS message performance. The new metrics allow you to track the number of messages sent and delivered, messages feedback rates such as one-time passcodes conversions, and track messages blocked by SMS protect. Customers can use CloudWatch Metrics Insights to graph and identify trends in real time and monitor those trends directly in the AWS End User Messaging console or in Amazon CloudWatch.

To learn more, visit the AWS End User Messaging SMS User Guide.

Read More for the details.