None of Google's 85,000 employees have been successfully phished in over a year - and it's because of a simple $20 product anyone can use
- Google told Business Insider that none of its employees have been successfully phished since it started requiring its employees to use security keys to log in.
- Phishing, or the use of misleading emails to steal passwords, is one of the most common ways people get hacked.
- Google attributes its success to products called "security keys," or USB devices that you need in addition to a password in order to log in to a protected account.
One of the most common ways that people get hacked is called phishing or spearphishing: Basically, attackers craft an email that looks just like something you'd normally click on, like a bill or an email telling you to change your password.
Unsuspecting people click on the link in the phishing email and it leads them to a site specially designed to look legitimate. The victim plugs in their user name and password, unwittingly giving it to the attacker. Now there's a good chance that account will be hacked. Spearphishing was one of the main ways Russian spies were able to break into the DNC network, according to the FBI, for example.
It's a big problem for businesses: you can make sure your computers are as secure as possible, but all it takes is one employee with access to sensitive data who gets fooled by an email to cause a bad breach.
One company seems to have solved the phishing problem, however: Google. And it's all due to a $20 gadget called a security key, which Google requires its employees use.
None of Google's 85,000 employees have been successfully phished on their work accounts since the company started requiring security keys in order to log in.
"We have had no reported or confirmed account takeovers since implementing security keys at Google," Google told Business Insider.
Google started requiring employees to use physical security keys in early 2017, according to Brian Krebs, the security journalist who first reported Google's success against phishing attempts.
Your company may already require you to have two-factor authentication turned on. That means that when you log in with a user name and password, you have to enter a second code, which is usually texted to you or delivered through an app.
Google took this one step farther in early 2017, and required all employees to start using a security key, according to Krebs. Instead of getting a text after entering your password, you merely plug the security key into a USB port on your computer and press a button.
That's a pretty big success for such a large company. Google has a lot of sensitive user data, so it's very encouraging to know that its employees aren't getting phished.
You can use a security key with your own personal Gmail account. Models compatible with USB, USB-C, and mobile devices are available from YubiKey.
In October 2017, Google launched an advanced protection program for people who may have the highest risk of being phished, including journalists, business leaders, and activists, using YubiKey devices. Google has worked with various industry groups, such as the FIDO Alliance, to develop security key technology called U2F.
A 2016 Google study showed that the text-message or app-based two-factor authentication, sometimes called "one-time-password," had an average failure rate of 3%. But the same study showed the U2F, or security key approach, had a 0% failure rate.
There are more details about how Google's approach to authentication and login security is starting to pay off over at Krebs On Security.