Google Workspace is a strong platform, however misconfigurations or lax security settings can go away any group susceptible. IT and security professionals ought to pay shut consideration to key security options to guard information and accounts. Beneath we define the highest 5 Google Workspace security settings and customary misconfigurations, together with actionable suggestions and greatest practices.
1. Multi-Issue Authentication (MFA) enforcement
Why it issues: Implementing multi-factor authentication (MFA) is without doubt one of the handiest methods to forestall account breaches. MFA provides an additional layer past only a password, thwarting many assaults like phishing and password guessing. In response to trade analysis, stolen credential use is the commonest preliminary motion in data breaches. The US Cybersecurity and Infrastructure Safety Company (CISA) experiences that accounts with MFA enabled are 99% much less prone to be hacked. This underscores that if MFA is just not enabled, accounts are dramatically extra prone to be compromised. Google Workspace admins should guarantee MFA is enabled for all customers to cut back the possibility of account takeover.
Widespread misconfigurations: Some organizations allow MFA however don’t totally implement it for all customers. In Google Workspace, it’s doable for a consumer to register a second-factor methodology but nonetheless be allowed to log in with only a password if enforcement isn’t appropriately configured.
One other mistake is leaving an extended grace interval for enrollment or having “optionally available” MFA, which ends up in many customers by no means truly turning it on. Counting on weaker second-factor strategies (like SMS texts or voice calls) can be a mistake—these are higher than nothing, however they’re extra inclined to SIM-swapping and social engineering in comparison with stronger strategies like authenticator apps or security keys.
Greatest practices and suggestions: Implement MFA for each account, particularly admin accounts, with no exceptions for day-to-day use. Key suggestions embrace:
- Activate MFA enforcement in Admin Console: In Google’s Admin Console, go to Safety > Authentication > 2-Step Verification and allow enforcement for all customers (after a brief enrollment interval).
- Use robust MFA elements: Configure allowed second-step strategies to exclude weaker elements. Google Workspace allows you to prohibit MFA strategies—as an example, you’ll be able to disallow SMS and voice codes (that are susceptible) and permit solely stronger strategies like authenticator apps or security keys.
- The really helpful setting is “Any besides verification codes by way of textual content or cellphone name,” which forces customers to undertake safer app-based codes or keys
- Even higher, require security keys on your most delicate accounts, as this gives the best phishing resistance (although it could be impractical for all customers).
- Educate customers: Present steerage and coaching so customers know the right way to use MFA (e.g., utilizing Google Authenticator or cellphone prompts) and why it’s required. Typically customers resist adjustments, however emphasizing that this can be a easy step that stops the overwhelming majority of assaults may help get buy-in.
2. Google Drive public sharing dangers
Why it issues: Google Drive makes file sharing simple—typically too simple. One frequent misconfiguration is permitting recordsdata or folders to be shared with “Anybody with the hyperlink.” This public sharing possibility means no authentication is required to view the file; if somebody obtains the hyperlink, they’ll entry the content material. Whereas handy for non-sensitive paperwork, it may be disastrous if utilized to delicate information.
Dangers of public sharing: If recordsdata are shared publicly, information leaks can happen. Delicate paperwork might be listed by serps or found by malicious actors.
Widespread misconfigurations: The commonest mistake is utilizing “Anybody with the hyperlink can view” as a sharing setting for recordsdata that ought to be inside. Usually, workers choose this out of comfort—they’re unsure who will want entry or they wish to keep away from coping with permission requests.
Learn how to safe Google Drive sharing: IT admins ought to take a proactive stance on Google Drive sharing settings to forestall unintentional information publicity. Listed here are some greatest practices:
- Limit or disable “Anybody with the hyperlink” sharing: Within the Admin Console, you’ll be able to regulate Drive sharing settings for the group. It’s extremely advisable to disable the “Anybody with the hyperlink” possibility fully for inside customers.
- Most organizations not often want really public hyperlinks. As an alternative, want choices that require sign-in. If fully disabling isn’t possible (maybe your advertising crew must share paperwork publicly), take into account an method the place solely a sure sub-organization or group has the flexibility to create public hyperlinks, and even then, implement an approval course of. At minimal, make “Off (restricted)” the default setting for file hyperlinks in order that new recordsdata aren’t by chance shared overtly.
- Monitor shared recordsdata: Commonly audit what recordsdata are being shared externally or publicly. Google’s Safety Dashboard gives a File publicity report that exhibits what number of recordsdata are shared externally or publicly throughout your area. Periodic audits (e.g., month-to-month or quarterly) will assist catch misconfigurations early.
- Educate and implement least privilege in sharing: Practice customers on safe file sharing practices. They need to perceive the distinction between “Share with particular folks” vs. “Anybody with the hyperlink.” Encourage a tradition the place workers default to the least permissive entry—share with particular person customers or teams who want the file, slightly than broad hyperlinks. As a suggestion, by no means use “Anybody with the hyperlink” for delicate or inside information.
Penalties of misconfiguration: The fallout from public sharing misconfigurations may be extreme. Uncovered inside recordsdata can result in data breaches, regulatory compliance violations (think about if private information or well being info is by chance leaked), and reputational injury.
3. Superior Safety Program (APP) for high-privilege accounts
Why use APP for admins: Google’s Superior Safety Program (APP) is a free providing that gives Google’s strongest account security settings—initially designed to guard people at excessive danger (like journalists or politicians) and now out there for enterprise customers. In a Workspace context, high-privilege accounts (equivalent to tremendous directors or executives with entry to delicate information) ought to enroll in APP to profit from its elevated protections. Excessive-value accounts are sometimes focused by attackers, and the APP is particularly constructed to protect towards focused assaults, phishing, and account hijacking.
Google itself recommends enrolling customers like IT admins, C-level executives, and others in delicate roles within the Superior Safety Program.
These accounts have the “keys to the dominion,” so an attacker who compromises an admin can do much more injury than a daily consumer compromise. Thus, locking down admin accounts with APP is a great transfer to drastically cut back danger.
What APP does: The Superior Safety Program enforces a bundle of enhanced security measures on enrolled accounts. Notable options embrace:
- Strongest Two-Issue Authentication: APP requires using security keys (or passkeys) for 2-Step Verification, slightly than much less safe strategies. Enrolled customers should authenticate with a bodily FIDO2 security key or equal, which gives phishing-resistant MFA. This stops most account takeover makes an attempt lifeless of their tracks, as an attacker would wish the bodily key to breach the account. (Google lately enabled assist for phone-based passkeys as effectively, providing robust security with out a separate {hardware} key.)
- Restricted third-party entry: APP blocks entry to your Google information by untrusted third-party apps. In apply, this implies if an attacker tries to make use of a malicious OAuth app to trick an admin into granting entry (a typical phishing approach), APP will robotically forestall it except the app is explicitly whitelisted by your group. Solely Google’s personal apps and trusted third-party apps can combine with an APP-enrolled account
- Enhanced scanning for threats: APP accounts get further scrutiny on incoming emails, attachments, and downloads. Google applies extra aggressive phishing and malware checks for customers in APP. For instance, an admin enrolled in APP may need Chrome block sure dangerous file varieties by default and have Gmail carry out enhanced scans on messages, including one other layer of protection.
- Tightened account restoration: To stop attackers from utilizing the account restoration course of as a backdoor, APP makes account restoration extra arduous. If an admin loses their security keys or forgets their password, the restoration requires further verification steps and time. This mitigates the danger of somebody hijacking the account by, say, impersonating the consumer to Google assist.
4. Password power insurance policies
Why it issues: Regardless of the push in direction of MFA and even passwordless applied sciences, robust passwords stay a elementary security requirement. They’re the primary line of protection for accounts. A weak or compromised password can render different security measures ineffective. Customers usually select easy-to-remember passwords which might be sadly simple to guess. Attackers exploit this by utilizing password spraying (attempting frequent passwords throughout many accounts) and credential stuffing (utilizing passwords leaked from different breaches). Implementing a powerful password coverage in Google Workspace ensures that customers create passwords that meet complexity and size necessities, making these assaults a lot tougher to succeed. It additionally helps meet compliance requirements that usually mandate particular password controls.
Widespread misconfigurations: A typical misconfiguration is just not enabling Google Workspace’s password insurance policies—by default, some superior password necessities are off. For example, the “Implement robust password” setting is OFF by default, which means customers might set quite simple passwords if not modified by an admin.
Equally, not setting a minimal password size (or leaving it at a low quantity like 4 or 6) is a mistake; trade apply is to require a fairly lengthy password (8 at absolute minimal, with many recommending 12+ characters for higher security). Permitting password reuse is one other misstep—if customers can recycle their final password or swap between a few favorites, it undermines the intent of password adjustments.
One other potential difficulty is just not forcing a coverage replace for current passwords. Google Workspace allows you to implement new guidelines both at subsequent password change or at subsequent login. For those who don’t select “at subsequent sign-in,” a consumer with a weak password might technically maintain that password till they determine to alter it on their very own. Lastly, some organizations overdo one side (like frequent compelled adjustments) however neglect others (like complexity), which might result in customers writing passwords down or utilizing predictable patterns.
Google Workspace password coverage settings: As an admin, you must configure the next in Safety > Password Administration on your area to implement robust authentication:
- Implement robust passwords: Allow the choice to require a powerful password for all customers. Google defines a powerful password as one which mixes letters, numbers, and symbols (and isn’t on Google’s listing of frequent weak passwords). With this setting on, if a consumer’s password is weak or frequent, Google will power them to alter it.
- Minimal password size: Set a minimal size requirement. Eight characters is the naked minimal really helpful, however take into account larger for higher security (equivalent to 10 or 12). Maintain consumer expertise in thoughts—extraordinarily lengthy minimums would possibly trigger pushback—however notice that password size considerably will increase power. The Admin Console permits you to set a size; a typical coverage is minimal 8 or 10 characters.
- Stop password reuse: Be sure “Enable password reuse” is unchecked (it’s unchecked by default, which suggests reuse is just not allowed). This ensures customers can’t cycle by means of a small set of favourite passwords. Usually, Google will bear in mind a sure variety of earlier passwords (the precise quantity isn’t proven, however you’ll be able to assume at the very least final 5) and forestall the consumer from reusing them when altering to a brand new password.
- Password expiration: Determine on a password expiration interval if required. Google Workspace permits you to expire passwords after a set variety of days. Many organizations select 90 days (the basic advice).
- Google’s personal steerage is that in the event you’re not sure about forcing rotation, it’s acceptable to go away it at “By no means” (no expiration) as a result of overly frequent adjustments can result in worse passwords or customers writing them down.
- Apply coverage to current customers: Within the Password Administration settings, there’s an choice to implement the coverage at subsequent sign-in (versus subsequent password change). It’s clever to test this when rolling out a brand new coverage. That method, any consumer at present with a weak or non-compliant password will probably be compelled to set a brand new one the very subsequent time they log in, slightly than ready till they determine to alter it on their very own. This closes any loopholes for accounts that haven’t modified their password in a very long time.
- Completely different insurance policies for privileged customers: Think about creating stricter password insurance policies for admins or extremely privileged accounts. Google Workspace permits totally different settings per organizational unit (OU).
5. Google Teams with unrestricted entry
Why it issues: Google Teams is a service inside Workspace usually used for mailing lists, crew discussions, and permission administration. Nevertheless, misconfiguring Google Teams settings can inadvertently expose confidential info. The results of mismanaging Google Teams may be extreme information leakage.
Widespread misconfigurations: In Google Teams settings, you’ll be able to management who can view subjects, who can submit, and who can be a part of the group. An “unrestricted” group would possibly permit anybody on the web to hitch or view messages, or permit outdoors (exterior) members to be a part of the group freely. Some organizations unintentionally go away group discussions open to the general public or to the complete group once they have been meant to be confidential.
For instance, if a bunch’s entry is ready to “Public on the web” for viewing, then all of the messages posted in that group (which might be inside emails or recordsdata) are successfully printed for anybody to learn in the event that they discover the URL or the group identify. Equally, if “Exterior members” are allowed with out warning, somebody might add a private Gmail tackle to an inside group and obtain delicate emails. Usually, these misconfigurations occur as a result of Google Teams has many settings and the interface may be complicated, or an admin would possibly assume “no one will discover this obscure group.”
Greatest practices for group entry controls: To keep away from exposing delicate info by means of Google Teams, take into account the next practices:
- Evaluation group privateness settings: Audit all of your Google Teams and see who can entry them. For inside dialogue teams (e.g., an HR group or an IT assist group), the viewing entry ought to usually be set to “Personal – Solely members of the group” can view messages. In case you have teams that want to incorporate exterior events (like a buyer discussion board or a companion mailing listing), rigorously set these to “Personal” for viewing however permit exterior members by invitation. Google themselves urged organizations to set any teams used for inside communication to personal, separate from any public teams used for exterior communities
- Lock down membership and posting: Restrict who can be a part of and submit to teams. For delicate teams, set “Who can be a part of” to Invite solely (or at most, Solely customers throughout the group can ask to hitch, which nonetheless requires approval). Don’t go away it open for anybody to hitch. Additionally set “Who can submit” to group members solely (or a subset like managers), so outsiders can’t electronic mail a bunch from the skin except explicitly allowed. This prevents exterior spam or phishing makes an attempt from reaching your inside teams, and it prevents the situation the place somebody subscribes their private account to an inside listing with out oversight.
- Exterior group communications: If a bunch is supposed to incorporate exterior folks (for instance, a bunch for a challenge that features an outdoor contractor), use the setting to permit exterior members however don’t permit the group to be public. This fashion, solely the invited exterior customers see the conversations. Clearly differentiate these teams (maybe within the naming conference) and remind members that externals are current (to keep away from unintentional sharing of ultra-sensitive information on them).
- Common auditing and monitoring: Identical to with file shares, you must commonly audit Google Teams settings.
- Educate Google Group house owners: In Google Workspace, any consumer is usually a group proprietor (relying in your permissions). Those that handle Google Teams (for instance, a division supervisor who runs a crew group) won’t pay attention to the dangers. Present steerage and even implement templates: as an example, when a brand new group is created, have a default setting of personal membership and archives. For those who permit customers to create teams, take into account limiting that skill to admins or implementing a workflow the place IT evaluations new teams. Encourage group house owners to overview their member listing and settings often, particularly if the group was created way back when settings may need been totally different. Google has improved defaults over time, however older teams would possibly retain much less safe settings.
How SSPM (SaaS Safety Posture Administration) may help
As you’ve possible gleaned, Google Workspace gives a variety of security settings that should be correctly configured, making it simple to overlook important settings. Some necessary Google security options are turned off by default, which suggests organizations must actively allow and handle them. Google additionally commonly introduces new security controls, making it necessary to establish and replace legacy settings. Plus, stress to take care of comfort can result in dangerous decisions that may accumulate over time.
SaaS Safety Posture Administration (SSPM) options tackle these challenges and supply vital worth to security groups:
- Steady monitoring of security settings for important SaaS apps like Google Workspace to detect configuration drift and catch legacy settings that should be up to date.
- Automated id security posture checks to detect privilege escalation, weak authentication, and different id dangers.
- Discovery of app-to-app integrations like market apps, API keys, service accounts, OAuth grants, and different non-human identities with entry to important SaaS apps and information.
- Actual-time alerts for dangers and misconfigurations that may have an effect on your group’s security posture.
- Dashboards to visualise security posture tendencies and assist groups prioritize their highest-risk findings.
Nudge Safety’s SSPM resolution robotically detects frequent Google Workspace security misconfigurations equivalent to:
- Lacking or improperly configured multi-factor authentication settings.
- Public or unrestricted Google Teams or Google Drive settings that may allow unauthorized entry.
- Weak or misconfigured password insurance policies that would go away Google accounts susceptible.
- Dangerous or unapproved integrations with privileged entry to your Google Workspace setting.
Begin a free 14-day trial of Nudge Safety to begin bettering your Google Workspace security posture and your total SaaS security posture at this time.
