A practical guide to securing Google Workspace for a startup

Yep. You can't count on Google to be anything other than an advertising company and even then it's a pretty bad one at that e.g. https://talktotheduck.dev/production-horrors-handling-disast...

Even search which used to be its crowning achievement isn't great for most terms. SEO dominates google completely.

As a Gsuite customer, I do mostly agree. I'll say I'm very pleased with GSuite, but I also think that Google is about as bad as it gets with regards to customer service, and I would never put customer data into Google Cloud since I would never risk losing that data due to their idiotic, inane systems deciding to ban me, and no support channel for getting it back.

If your business relies on it, whatever "it" is, then you probably need to pay for it, so that if it has some serious problem, you can call up a human and either beg or yell at them to fix it, depending on the situation.

I've always thought it madness to even rely on gmail for a business, who can cancel you whenever.

We did mention DMARC DKIM etc but I did not put a link to this very useful tool. Feel free to submit a PR and we'll merge it - https://github.com/fleetdm/fleet/edit/main/handbook/security... - or if you don't mind I can also add it on my side next time I make an edit.

Just wanted you to know that this made a huge difference on my most important domain, today. I appreciate your pointing it out because I assumed Gmail would automagically handle everything

Neat but inadequate. My domain passes all the checks, yet I already know that I have SPF and DMARC set, but so that spoofs get through. A proper tool should have flagged that.

I rather like easydmarc.com. They charge for analytic services but you can use their checker for free. They also have very easily digested guides and recommendations for setting up the various records.

I'm excited to see how Guillaume is sharing our security journey as Fleet grows!

We've been meaning to write about this. You can actually do it with just Google Business, but you have to then also buy their Identity service, which I forget the name of. It's packaged into Enterprise edition but also sold separately.

We also reached out to sales and got a deal, explaining we didn't want to pay prices designed for companies with 1000s of employees.

Super cool, thanks so much for publishing. I’ll even use this for my families Google business personal emails - I have found the Google apps admin to be a bit intimidating and I was nervous to adjust defaults but the quarantine options seem very approachable and valuable.

It’s also been a while since I’ve seen a nice quick Mac OS security settings list to go ahead and toggle.

My only request would be additional guide for iOS security. The iVerify app suggests some good defaults

Yes! With advanced protection you get enforced security keys, recovery only through admins, enforced safe browsing in Chrome. It's a nice way to get a bunch of improved controls in one shot.

Would be nice if Google allowed enforcing it with a grace period for new accounts though!

One hundred percent agreed. Not sure why Google doesn't allow enforcement of this for Workspace accounts.

This is a great guide, I just wish Google made it easier to be "secure by default". It's very difficult to know all the various toggles you need to have switched on to be secure.

I enjoy the enhanced security that advanced protection program offers but miss being able to use gmail in exchange mode specifically because it allows receiving push notifications for new emails without having to trust gmail’s iOS app which always spooks me as being an extra tracking app on my phone

Great advice. This is such a classic attack.

I would be interested in hearing about experiences with these threat detection systems I general. They’re typically quite expensive, and I always wonder whether they actually produce reliable alerts. I’m conditioned by noisy virus scanners and firewalls, and wonder whether these corporate threat detection systems have a similar signal:noise ratio when it comes to alerts.

You are 100% right that the domain is the keys to the kingdom.

Definitely only use registrars and DNS providers that have 2FA. Google has a registrar now, as well as DNS in GCP https://cloud.google.com/domains/docs/register-domain and https://cloud.google.com/dns. By using those you can leverage your Google account's security (use separate accounts for admin level access on GCP and enforce hardware 2FA), and control who gets access using IAM. AWS has similar options.

Thanks. There is no need to keep most security controls for common tools secret, and the more organisations discussing how they do it the better.

For example, a small org with no security people or a non-profit could be made much more secure by following this, so why not publish it?

I would only enable Google Drive local sync on laptops that we know are company owned. The guide didn't cover "Context-aware access". Depending on how you work, it is surprising to see that most people don't even mind that they can't sync files locally, where in other companies it would be completely impossible. I guess it comes down to how much of your work is Google Docs/Sheets vs other file types.

That is exactly what it is for! We will be adding more about how we secure Fleet to our handbook, check it again in a few weeks and it should have even more stuff that a startup CTO can use!

Secure is very subjective. One of the tasks in the article is enabling email quarantine for encrypted attachments. What if an org receives a lot of encrypted attachments as part of their business, that option would slow them down. Or what if an organization is in a country that can’t easily receive yubikeys, why would they want to enforce those?

There is, though it is not ultra granular. They introduced it last year and we mention it in the guide.

https://workspaceupdates.googleblog.com/2019/03/more-control...

Essentially you can enforce 2FA or not, then, you can allow ANY method, any method BUT telephony based (calls and SMS), or hardware security key only.

The middle option for most people is a great one as it allows Google Prompt (push notifications) as well as Google Authenticator style OTPs, plus security keys.

That is true especially if your sessions are made very short, which requires the more expensive Google Workspace edition. But if sessions are long, the risk is users lose access to their 2FA and don't notice until it becomes a bigger problem...

The API Access section covers OAuth apps. Essentially you:

1. Mark Google services you consider critical as "restricted" (ex: Drive, gmail) 2. On Gmail and Drive, you can then allow apps that use lower levels of permissions, but not those who need "dangerous access" 3. Then on a per app basis you can mark apps as "trusted" which lets them access "restricted" Google services.

It is not super granular in the sense that you can't easily say - Calendar2000 can be used by my sales team, and should have access only to the invites date and time but not attendees, body or attachment, but it is better than nothing!

That requires their endpoint to be compromised, doesn't it?

Hi! We will eventually cover other OSes. In the meantime, for Windows, Microsoft has good guides through they are usually very lengthy - https://techcommunity.microsoft.com/t5/microsoft-security-ba...

Haha.. I tried a bit and failed to get it to hang together with some poking.

One user request was to STOP the "windows hello" PIN requirement, and just have a password (+ MFA) for login. Does anyone know how to do this with either standard Office 365 subscriptions, or office 365 + Intune or similar? Would love not to have to do Azure AD outside of the office subscriptions. Microsoft has a fair number of SKU's these days that kind of overlap (and get renamed).

And all the downvotes! From the same site in which so many other people complain about so many ways in which Google hurt them or their business in some way. Absurd.