Slack has introduced a new suite of Microsoft Office 365 integrations, connecting the collaboration platform with many of Office’s features, such as email, calendar and OneDrive.

Although the ability to share files with cloud-based platforms such as Google Drive and Box has existed for a while within the Slack communication tool, its enhanced integration with OneDrive enables users to import and search for files stored in the cloud, directly from Slack.

If you want to share files stored in OneDrive with others using Slack, you can now just click the + icon, choose OneDrive and select the file you want to share. If you add the file to a message stream in a channel or direct chat, everyone can discuss it.

You can also preview Slack files stored in OneDrive, whether you want to view a presentation, Excel document or Word file without needing to download it. This means you can quickly check a spreadsheet, view changes in a presentation or approve a Word document with a single click.

For Outlook users, Slack has tagged on the ability to send or forward emails to a Slack channel. For example, if a customer or partner emails you, but you need a response from the appropriate team before replying, you can just forward the email to the Slack channel to get a collaborative response.

Slack also now integrates more closely with Outlook calendars. If you’re invited to an event, such as a meeting, it’ll be forwarded to your Slack stream, where you can instantly reply. You’ll also get reminders, can join Skype meetings if the meeting is virtual and if you’re in the meeting, your Slack availability will be updated as “in a meeting” so you’re not disturbed.

“By using apps to connect Outlook and OneDrive with Slack, repetitive tasks such as checking your calendar or sharing email attachments with a group can be done right from your workspace,” Slack said. “Each little improvement to these workflows adds up to a whole lot more time for you and your team to do your best work.”

Google Cloud has revealed that Android devices can now be used as a Titan authentication key in what’s seen as a major push to protect user accounts from online scams.

Working much like Google’s Titan key, which is built in accordance with FIDO standards, your phone can now act as the most secure version of multi-factor authentication (MFA) yet.

Other MFA methods, such as confirmation texts and mobile apps, have come under scrutiny as they can still be exploited by phishers who can trick users into helping them access their accounts.

The key is able to keep a log of phishing websites that Google is aware of and, if you visit one, the security key built into your Android phone will block you from handing over login credentials to phishers.

Google calls the new security standard ‘phone-as-a-security-key’ (PaaSK); the phone connects to your device via the Google-built standard, which itself is built on top of Bluetooth to create a three-pronged layer of protection.

The security also works through proximity, and so long as your phone is connected to your device, say a laptop, then the device will recognise you as both the user attempting to log in and the owner of the account’s corresponding security key. Instead of waiting for a text, a security screen will automatically appear on your phone requiring you to either hold down a volume button if using a Google phone or press an on-screen button for any other Android device.

The advantage of this is that although attackers can get you to hand over your phone number to access an SMS-based 2FA protection barrier, an attacker would find it much harder to get their hands on your phone and stay in close proximity to your computer.

Google has said that only Android devices running version 7.0 or later will support the new PaaSK platform at launch, but it can be used on all major computer operating systems including Windows, MacOSX, and Chrome OS.

“We’re focussed on Android first, but it’s not out of the realms of possibility that in the future there will be something for iOS, at least for Google accounts,” said Sam Srinivas, product management director at Google Cloud.

You’ll be able to associate as many Google accounts with the PaaSK as you wish but the user must be logged into the correct key on the phone first before making the login attempt on a browser.

Although Google says it blocks 99.9% of all fraudulent log-in attempts on its users’ accounts, there is still a 0.1% issue regarding cases of phishing, keylogging and data breaches – cases where the attacker has the correct password, making it difficult to differentiate between a genuine and fraudulent attempt.

Google chose to implement FIDO in its most recent push against phishing attacks because out of all the other MFA methods, namely SMS/voice, backup code and authenticator apps, FIDO has proved the only phishing-resistant method.

According to Google’s own assessments, user accounts becomes 10x more vulnerable if credentials are used in a data breach, 40x more vulnerable when threatened by keylogging, and 500x more vulnerable if compromised by a phishing scam.

Google has announced 30 security features for its Google Cloud Platform (GCP) at Google Cloud Next 2019, building on a two-year-long commitment to making its platforms more robust.

Prior to today’s announcement, Google Cloud had invested heavily into its security systems, launching more than 70 products and services in 2018 and with it now adding to that tally.

The company split its announcements over three different sectors:

• Security of the cloud: referring to the infrastructure that keeps GCP secure such as datacentres, network cables and its Titan chip
• Security in the cloud: features that allow customers to build secure applications for their businesses in their cloud environment e.g. encryption key management
• Security services: direct security-as-a-service solutions that Google is starting to provide

Security of the cloud

«One of the things we deeply believe in at Google is that transparency breeds trust,» said Michael Aiello, product management director at Google Cloud, adding that Google wants to reduce the number of mechanisms that customers have to trust Google with.

Access Transparency has been in GCP for some time now but it’s now released in beta for G-suite. This involves providing the customer with near real-time logs whenever a Google engineer authorises access to their environment to correct an issue they reported. Previously, a Google engineer, in this case, could self-authorise access to the environment but now they must get authorisation from the customer.

Security in the cloud

According to Gartner, 95% of all cloud security breaches are caused by customer misconfigurations such as firewalls with misconfigured buckets. Just last week a massive data trove was found to be left exposed because of an improperly configured AWS S3 bucket. The WWE, Accenture and even the NSA have fallen victim to this type of security incident and Google has recognised that.

Google’s Cloud Security Command Centre will now go to general availability (GA) after a successful beta phase. It’s a single app that provides a complete overview of your organisation’s cloud resources and the security threats that are presented to them.

Using machine learning, the app learns all the different access attempts over time and uses that intelligence to grant permissions and make smart recommendations on cloud configurations to increase overall security.

«It will give you a full rundown of all of your assets and from there you can apply security analytics and threat intelligence to best protect your GCP environment,» said Jess Leroy, product management director at Google Cloud.

After some customer requests from the beta phase, the command centre will now feature more export options to Docs and Sheets and even a custom export option for Splunk Web. New threat intelligence integrations with third-parties such as Tenable and McAfee will also be supported in the GA release.

G-suite also gets a security makeover with advanced phishing and malware protection – something Google dedicated lots of resources to. Among other things such as new controls being made available to admins against phishing attacks such as domain spoofing, Gmail will be getting a sandbox mode.

The sandbox mode aims to tackle the threat of malware spread over email and because the only way to see what a malicious program does is to run it. As such, virtual environments will now be embedded into Gmail so you can know with certainty what an executable program does before downloading it.

Security services

Aside from security features added to GCP specifically for GCP customers, Google announced a set of services that can be used on other platforms such as AWS or Azure as well as its own cloud platform.

One of the most common ways that companies will discover threats is by scanning through all of the logs in their environments. Event Threat Detection is a service that scans logs for suspicious activity and can consolidate logs from private clouds, traditional datacentres, even from other cloud platforms into GCP.

After the logs have been consolidated, they will be scanned and fed through the command centre to find vulnerabilities and users can then remediate them and even manipulate the data through BigQuery.

Security has been quite the theme here at Next – Google also announced that Android phones can now become a user’s Titan key, the only phish-resistant method of multi-factor authentication.

Google Cloud’s serverless compute platform Cloud Run has entered a beta phase and aims to prevent the vendor lock-in problem faced by enterprises looking to go serverless.

Revealed at Google Cloud Next 2019 in San Francisco, the Cloud Run environment is stateless, which will tackle the issue that developers face when making the choice between the ease of serverless or the flexibility of containers.

With a serverless environment, developers need not worry about configuring the underlying infrastructure and how much resources they will need to power their applications. 

As such, with a stateless environment, enterprises can commit to a vendor for some of their serverless products, let’s say Dell, but not have to worry about being restricted only to the vendor’s software partners.

Cloud Run is fully serverless and automatically scales up or down with your website’s traffic within seconds, meaning that you’ll only pay for the resources that you need.

«What’s beautiful about the system is that you’re paying by the hundred-millisecond for what you use only and it scales up horizontally to many, many thousands of cores in just a few seconds,» said Oren Teich, director product management at Google Cloud.

It’s already and being deployed by some of the world’s biggest firms. Veolia, the waste management giant praises the ease and cost-effectiveness of the new environment.

«Cloud Run removes the barriers of managed platforms by giving us the freedom to run our custom workloads at lower cost on a fast, scalable, and fully managed infrastructure,» said Hervé Dumas, group CTO at Veolia. «Our development team benefits from a great developer experience without limits and without having to worry about anything.»

The Cloud Run environment can be used on its own or integrated with your company’s existing Kubernetes cluster; merging the two will also offer you some specific enhancements to your stack.

Using Cloud Run on Kubernetes grants access to Google’s other cloud products such as Custom Machine Types on its Compute Engine networks, which provides users with the ability to create scalable virtual machines tailored for each process that are configurable for optimal pricing.

Cloud Run on Kubernetes, the industry standard for container management, also allows you to run side-by-side with other networks deployed in the same cluster. Airbus Aerial, the aerospace company’s satellite imagery arm is already using Cloud Run on Kubernetes to process and stream aerial images.

«With Cloud Run on GKE, we are able to run lots of compute operations for processing and streaming cloud-optimized aerial images into web maps without worrying about library dependencies, auto-scaling or latency issues,» said Madhav Desetty, chief software architect at Airbus Aerial.

Cloud Run is also based on Google’s Knative open API which lets users run workloads on Google Cloud Platform, on a Google Kubernetes Engine (GKE) cluster or on a company’s own self-managed Kubernetes cluster. The underlying Knative API makes it easier for businesses to start on Cloud Run and then move to Cloud Run on GKE later on.

There are some operational constraints to Cloud Run which Teich detailed in a press conference. It runs at a maximum of 1Gb memory size instance, you get a single core per instance so it’s horizontal scale and not vertical scale. Each process must also respond to an HTTP 1.1 request in a maximum time of 15 minutes.