Google Apps Adds Two-Step Verification

Enhanced security is now available to Google Apps enterprise customers via their mobile phones.

(click image for larger view)
Google Authenticator App
Google on Monday plans to offer its users improved security through the introduction of
a two-step login verification process
.
Initially, two-step verification will be available to
Google Apps
Premiere, Government, and Education edition users, at no extra charge. But Google plans to make the technology available to all its users in the coming months, once the company is confident it can scale the technology to meet demand.
Google is expected to make the announcement at an enterprise conference called Atmosphere, which is being held in a
hotel near Paris, France
.
Two-step verification is already offered as an option by many online banks. An online banking customer can have a verification code sent to his or her mobile phone when a login attempt is initiated. In order to complete the login process successfully, the customer must supply the code sent to the mobile device in addition to a user name and password.
Starting Monday, if enabled by a Google Apps administrator, Google Apps Premiere, Government, and Education edition users have the option of receiving an SMS message or voice call on their mobile phones with a login verification code. Users of Android, Blackberry, and (soon) iPhone devices also have the option of downloading a mobile app called Google Authenticator that can generate a login verification code without the need for network access.
Google plans to open-source the code for these mobile applications to allow third parties to adapt them to specific enterprise security needs, such as integration with an existing on-premises authentication system.
Google security product manager Travis McCoy says that the widespread adoption of cloud computing means that employees are often off-premises and outside corporate security controls when they access company data. This has created a challenge: making external points of access as safe as internal ones.
McCoy says that Googles security team determined that improving login security would have the most impact on user security. The user name and password model is fundamentally flawed in several ways, he said in a phone interview.
Gartner VP Avivah Litan says that Google is taking a step in the right direction, though she argues that more needs to be done. Its better than just passwords, she said in a phone interview.
Two-factor authentication has become popular as a way to give users confidence in cloud computing services, she said, pointing to several recent identity access management acquisitions, such as VMwares acquisition of TriCipher.
Enterprise customers dont want their accounts being taken over, especially if theyre using them to store intellectual property or business plans, she said.
Litan observes that verification codes wont prevent unauthorized access if the users computer is already compromised by malware like the Zeus trojan and McCoy concedes that point. Its not a panacea but we do think its a significant step forward, he said.
Google has already taken a number of such steps to improve online security. In 2004, it added SSL support to Gmail and made SSL the default earlier this year. The company has also made an encrypted version of Google Search available and had taken steps to allow Gmail users to see when and from which IP address their Gmail account was last accessed.
Litan notes that two-factor authentication is no longer enough for many banks and she suggests that Google will have to move on to monitoring for suspicious use patterns. While McCoy declined to provide specifics about Googles future security plans, he points to Gmails IP address login records as evidence that Google is already moving in the direction that Litan advocates.
We have to assume there is no security system we can deploy thats bulletproof, he said. At that point, it makes sense to switch to notification.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google Apps Adds Two-Step Verification