2-Step Verification (2SV):

2-Step Verification adds an extra layer of security by requiring users to verify their identity using a second factor in addition to their password. This helps protect against unauthorized access, even if the password is compromised.

Google Authenticator:

Google Authenticator is a mobile app that generates time-based one-time passcodes (TOTP) for 2SV. It works even when the device is offline, providing a secure and reliable second factor for authentication.

Implementation Steps:

Enable 2-Step Verification:

Go to the Google Admin console (admin.google.com).

Navigate to Security > Authentication > 2-Step Verification.

Turn on 2-Step Verification for the organization.

Deploy Google Authenticator:

Instruct users to download the Google Authenticator app from their respective app stores (iOS or Android).

Provide guidance on setting up Google Authenticator with their Google Workspace accounts.

Users will scan a QR code provided during the setup process to link their account with the Authenticator app.

Advantages of Google Authenticator:

Security: It provides a highly secure method of 2-step verification as the codes are generated on the user's device and change every 30 seconds.

Ease of Use: It's easy to set up and use, with a straightforward user interface.

Offline Functionality: Codes can be generated even without internet access, ensuring consistent access to 2SV codes.

Why Other Options Are Less Suitable:

A. Enable additional security verification via email:

Email-based verification is less secure than app-based 2SV because email accounts can be more easily compromised.

C. Deploy browser or device certificates via Google Workspace:

While device certificates add security, they are typically used for device management and access control rather than for 2-step verification purposes.

D. Configure USB Yubikeys for all users:

USB Yubikeys are highly secure and suitable for 2SV, but they require physical distribution and management of hardware tokens, which can be logistically complex and costly. Given the context of disabled peripheral access, this option might contradict the policy of the Chief Information Security Officer.

References:

Google Workspace Admin Help: Set up 2-Step Verification

Google Workspace Security: 2-Step Verification

To audit if user1@example.com has shared any sensitive documents outside the organization, use the Security Investigation Tool in the Google Admin console. This tool allows administrators to investigate and take action on security issues within the organization.

Open Security Investigation Tool:

Go to the Google Admin console.

Navigate to Security > Investigation tool.

Set Conditions in Drive Log Events:

In the Investigation Tool, select the data source as "Drive Log Events".

Add the following conditions:

Visibility Is External: This filters the events to show only documents that have been shared externally.

Actor Is user1@example.com: This specifies that the actions performed by the user1@example.com should be displayed.

Run the Investigation:

Click on “Search” to run the investigation with the specified conditions.

Review the results to identify any documents that have been shared externally by the user.

Remediate:

For any documents that were shared inappropriately, you can take corrective actions such as changing permissions or removing external sharing.

References:

Security Investigation Tool

Audit Drive log events

To transfer all of Alice's data from her Drive to Bob's Drive in the most simple and efficient manner, follow these steps:

Sign in to the Google Admin console: Use an account with super administrator privileges.

Navigate to the Data Transfer tool:

Go to Apps > Google Workspace > Drive and Docs.

Click on "Transfer ownership."

Initiate the transfer:

Enter Alice's email address as the current owner.

Enter Bob's email address as the new owner.

Select the option to transfer all files and folders from Alice's Drive to Bob's Drive.

Click on "Transfer files" to initiate the process.

Verify the transfer:

Once the transfer is complete, confirm that all files and folders are now owned by Bob and accessible in his Drive.

References:

Google Workspace Admin Help - Transfer Drive files

Create External Accounts: In the Google Admin console, create new Google Workspace accounts for the external regulatory authority members.

Assign Vault Privileges: Navigate to the Admin roles and assign the necessary Google Vault privileges to these accounts, ensuring they have the access needed to view reports and data for the investigation.

Configure Security Settings: Ensure that the external users have secure access, potentially with additional security measures such as two-factor authentication.

Monitor Access: Regularly audit and monitor the activity of the external users to ensure compliance with your organization’s data policies and security requirements.

Revoke Access When Done: Once the investigation is complete, promptly revoke access to ensure continued security of your data.

References:

Google Vault Help - Assign Vault Privileges

Google Workspace Admin Help - Add Users

Access Google Vault: The Vault admin should log in to Google Vault.

Create a New Matter: In Google Vault, create a new matter specifically for this investigation related to the disgruntled employee.

Place Data on Hold: Place all the user’s email and Drive data on hold to ensure it is preserved. This prevents the data from being permanently deleted or altered.

Search for Data: Use Google Vault’s search functionality to locate relevant emails and documents that may pertain to the leak.

Export Data if Needed: If necessary, export the preserved data for further analysis and review by the security team.

Collaborate with Security Team: Share the findings with the security team to aid in their investigation of the data leak.

References:

Google Vault Help - Create and Manage Matters

Google Vault Help - Place Data on Hold

Assess the Current State: Identify which users are using the @madeupcorp.com email addresses for services like AdSense, AdWords, and YouTube.

Use the Transfer Tool for Unmanaged Users:

Access Google Admin Console: Go to admin.google.com and sign in with your administrator account.

Navigate to Tools: In the Admin console, go to "Tools" and then select "Transfer tool for unmanaged users."

Enter Domain Information: Enter the domain name (madeupcorp.com) and verify the domain.

List Unmanaged Users: The tool will generate a list of unmanaged users who are using their @madeupcorp.com email addresses.

Send Transfer Requests: Send transfer requests to these users, prompting them to accept the transfer to the managed Google Workspace account.

Follow Up: Ensure all users have accepted the transfer request to avoid any disruptions in accessing Google services with their corporate email addresses.

Verify: Confirm that the transferred accounts are now managed under the Google Workspace domain.

References

Google Workspace Admin Help - Transfer tool for unmanaged users

Organizational Units (OUs): Ensure that each sales team (Madrid, Tokyo, London, New York) is organized into their own Organizational Units (OUs) within Google Workspace. This helps in applying specific settings to each group individually.

Navigate to Admin Console: Go to the Google Admin console (admin.google.com) and sign in with your administrator account.

Access Gmail Settings: In the Admin console, go to Apps > Google Workspace > Gmail > Compliance.

Configure Append Footer:

Click on “Add another rule” under the “Content compliance” section.

Name the rule appropriately (e.g., Sales Compliance Footer).

Under the “Email messages to affect” section, select “Outbound” to ensure the rule applies to emails sent by the sales teams.

In the “Add setting” section, select “Append footer” and enter the footer content. Ensure the footer text is translated according to each locale.

Footer Content: The footer should include the message: “Should you no longer wish to receive emails about this offer, please reply with UNSUBSCRIBE.” Ensure this is translated appropriately for each office’s locale.

Enforce Non-removable Footer: By configuring this at the OU level and using the Append Footer setting in compliance rules, users will not be able to remove this footer from their emails.

Save and Apply: Save the rule and ensure it is applied to the specific OUs containing the sales teams.

References

Google Workspace Admin: Set up compliance rules for Gmail

Google Workspace Admin: Configure email footers

To prevent external, inbound messages from known senders from being incorrectly classified as spam, add the sender's domain to an allowlist in the Admin console.

Access Gmail Settings in Admin Console:

Go to the Google Admin console.

Navigate to Apps > Google Workspace > Gmail > Spam, Phishing, and Malware.

Add Approved Senders:

In the Spam settings, find the section for “Email whitelist” or “Approved senders”.

Click on “Configure” to add a new entry.

Specify the Sender’s Domain:

Enter the domain of the external sender that needs to be allowed.

Save the changes to update the whitelist.

Verify and Monitor:

Ensure that the settings are applied and monitor the spam filter to confirm that the known sender’s emails are no longer being flagged as spam.

By adding the sender’s domain to an allowlist, you instruct the spam filter to accept emails from this domain, reducing false positives.

References:

Prevent mail from being marked as spam

Approved sender list in Gmail

https://support.google.com/a/users/answer/ 9310352#1.1

Enable the Groups Settings API:

In the Google Workspace Admin console, enable the Groups Settings API under "Security" > "API controls" > "Manage Domain Wide Delegation".

Authorize API Access:

Set up OAuth 2.0 authorization for your application to access the Groups Settings API.

Update Group Settings Programmatically:

Use the Groups Settings API to programmatically update settings for the Google Groups.

You can set parameters such as who can post, who can join, and external member settings.

Automate and Validate Updates:

Develop scripts or use tools to automate the update process for all groups.

Validate the changes to ensure that all groups have the correct settings as per your requirements.

References

Google Workspace Admin Help: Google Groups Settings API

Google Workspace Admin Help: Manage Groups for Business

Enable Context-Aware Access:

In the Google Admin console, go to Security > Context-Aware Access.

Enable the context-aware access feature.

Create Access Levels:

Define access levels based on geographic locations (Canada, Italy, and the United States).

Use IP address ranges or other location indicators to specify these regions.

Assign Access Levels:

Assign the created access levels to the Google Workspace services, specifically corporate Gmail and Drive.

Ensure that only users accessing from the specified regions can access these services.

Apply and Monitor:

Save and apply the settings.

Monitor access logs to ensure compliance and security.

References:

Google Workspace Admin Help: Set up context-aware access

Google Workspace Admin Help: Manage context-aware access levels

https://support.google.com/a/answer/2463723?hl=en

Access the Admin Console:

In the Google Workspace Admin console, navigate to "Reports" > "Audit" > "Login".

Generate a Login Audit Report:

Customize the report to include details about suspicious login attempts.

Set the time frame to the past year and filter the results to show only suspicious logins.

Export the Report:

Export the login audit report in a suitable format (e.g., CSV) for further analysis.

Ensure the report includes user account details and the number of suspicious login attempts for each account.

Analyze the Data:

Review the exported data to identify patterns and determine how frequently suspicious login attempts occur within the organization.

Provide the analysis to the CISO with the required details for each user account.

References

Google Workspace Admin Help: View and analyze login audit logs

To transfer ownership of the existing meetings and resources from the resigning employee to their manager, follow these steps:

Sign in to the Google Admin console: Use an account with super administrator privileges.

Navigate to the Calendar settings:

Go to Apps > Google Workspace > Calendar > Manage resources.

Transfer calendar events:

Go to Tools > Data Transfer.

Select the user whose data you want to transfer (the resigning employee).

Choose "Calendar" as the service to transfer.

Enter the email address of the manager who will receive the ownership.

Initiate the transfer.

Verify transfer completion:

Once the transfer is complete, check that the manager now owns the calendar events and resources.

Ensure that all recurring events and resources are correctly transferred.

References:

Google Workspace Admin Help - Transfer Calendar events

Google Workspace Admin Help - Data Transfer Tool

Additional GCDS Instance:

Running a separate instance of GCDS on another server allows you to manage synchronization for the acquired organization independently.

This avoids conflicts and simplifies management for different LDAP directories.

Multiple LDAP Version:

Upgrading to the multiple LDAP version of GCDS supports synchronizing data from multiple LDAP directories.

This is useful for handling different organizations with distinct LDAP setups.

Steps for Setting Up:

Install a second instance of GCDS on a separate server.

Configure the new instance with the acquired organization's LDAP details.

If using the multiple LDAP version, upgrade your existing GCDS setup and configure rules for both LDAP directories.

Test the synchronization to ensure proper setup and no conflicts.

References

Google Workspace Admin Help: Set Up GCDS

For the Finance OU, enable the third-party app in Marketplace Apps:

To deploy a third-party app specifically to the finance department, you need to enable it within the Google Workspace Marketplace and restrict its availability to the Finance organizational unit (OU).

In the Admin console, navigate to Apps > Google Workspace Marketplace apps, find the third-party app, and configure its settings to be available only for the Finance OU. This ensures that only users within this OU can access and use the app.

References:

Google Workspace Admin Help: Manage Google Workspace Marketplace apps

Google Workspace Admin Help: Organizational Units

Access Context-Aware Access Settings: In the Google Admin console, go to Security > Context-Aware Access.

Review Access Levels: Check the existing access levels and policies applied to Google Drive.

Update IP Ranges: Update the IP range in the access levels to include the new IP addresses from the satellite office.

Apply Changes: Save and apply the changes to ensure that users in the satellite office can access Google Drive.

Verify Access: Test access from the satellite office to confirm that users can now access Google Drive without issues.

References:

Google Workspace Admin Help - Context-Aware Access

Google Workspace Admin Help - Setting up Context-Aware Access

Access the Admin Console: Log into your Google Workspace Admin Console.

Select User A: Navigate to the Directory and select User A's account.

Check Licenses: Under the Licenses section, check the current license type of User A. As User A holds a Basic License, they lack access to certain services available to Business License holders.

Change License: Change User A's license from Basic to Business. This can be done by assigning the Business License to User A within the Licenses section.

Verify Access: After changing the license, verify that User A can now access Google Drive and Docs without any errors.

References

Google Support: Assign or remove a user license

To meet the HR team's requirements, the best approach is to create a shared drive for non-confidential files, give the HR team content manager access, and give view access to the organization. This setup ensures that the HR team can edit documents while the entire organization can view them. Confidential documents can be stored in a separate location with restricted access to mitigate risks.

References:

Google Workspace Admin Help - Create shared drives

Google Workspace Admin Help - Shared drives access levels

Create an Alert for External Sharing:

Access Google Admin Console: Go to admin.google.com and sign in with your administrator account.

Navigate to Rules: Go to "Security" > "Alert Center" > "Manage Rules".

Create a New Rule: Select "Create Rule" and choose "Drive Audit" as the event source.

Configure Rule Settings: Set the conditions to trigger alerts when files or folders are shared externally.

Set Notification Preferences: Configure who should receive the alerts and how they should be notified.

Save the Rule: Save and activate the rule to start receiving alerts on external sharing activities.

Create a Custom Dashboard for External Sharing:

Access Security Investigation Tool: In the Admin console, go to "Security" > "Investigation Tool".

Create a New Investigation: Click "Create" and select "Drive" as the data source.

Set Up Investigation Parameters: Define the parameters to track external sharing activities (e.g., file shared externally, users involved).

Create Dashboard: Save the investigation as a custom dashboard to continuously monitor external sharing activities.

Review and Monitor: Regularly review the dashboard and set up automated reports if necessary.

References

Google Workspace Admin Help - Create and manage alerts

Google Workspace Admin Help - Use the security investigation tool

When planning to sync all Active Directory group objects to Google Groups using Google Cloud Directory Sync (GCDS), you must consider the sensitivity of the group memberships. If some of the groups contain sensitive information or membership, an alternative deployment strategy might be necessary.

Sensitive Group Membership: If certain groups contain members or data that are sensitive, synchronizing these groups directly might expose this sensitive information to unauthorized users.

Alternative Strategies:

Implement separate synchronization settings for sensitive groups.

Use security groups to control access to sensitive information.

Manually manage sensitive groups to ensure tight control over membership and data access.

Steps to Consider:

Evaluate which groups contain sensitive information.

Configure GCDS to exclude these sensitive groups from the general synchronization process.

Synchronize sensitive groups separately or manage them manually to ensure data security and compliance with privacy policies.

References:

Google Cloud Directory Sync Admin Help

Best practices for using Google Cloud Directory Sync (GCDS)

Access Admin Console: Log in to the Google Admin console using your administrator account.

Navigate to Devices: Go to Devices > Mobile and endpoints.

Download Inventory Template: Click on Manage company-owned inventory > Download template CSV.

Enter Device Details: Fill in the template with the serial numbers and other relevant information of the devices.

Upload Completed File: Once the CSV file is completed with all device details, upload it back to the Admin console under Manage company-owned inventory.

Verify and Save: Ensure that the uploaded data is correct and save the inventory. This keeps a record of all company-owned devices.

References:

Google Workspace Admin Help: Manage company-owned devices

Google Workspace Device Inventory Management

Access Admin Console: Log in to the Google Admin console.

Navigate to Admin Roles: Go to Admin roles under Account settings.

Create Custom Role: Click on 'Create new role' and name it appropriately.

Assign Vault Privileges: Select the privileges related to Google Vault, including managing matters, holds, searches, and exports.

Assign Role to User: Assign this custom role to the designated administrator who will handle the security investigations.

Verify Access: Ensure that the new administrator has the necessary access to Google Vault to monitor and manage ongoing security investigations.

References:

Google Workspace Admin Help - Create Custom Admin Roles

Google Workspace Admin Help - Google Vault Privileges

Access the Admin Console: Log into your Google Workspace Admin Console.

Navigate to Security Settings: Go to the Security section in the Admin Console.

Password Recovery: Enable the option for non-admin password recovery. This feature allows users to reset their own passwords using their recovery email address or phone number without needing to contact the helpdesk.

Configure Recovery Options: Ensure users have their recovery options set up (recovery email and phone number) so they can use this feature effectively.

Inform Users: Notify users about this new self-service password recovery option and provide instructions on how to use it.

References

Google Support: Set up self-service password recovery

Access the Admin Console: Log into your Google Workspace Admin Console.

Navigate to Apps: Go to Apps > Google Workspace > Gmail > Compliance.

Create a Content Compliance Rule: Create a new content compliance rule.

Set Conditions: Set the condition to apply to incoming mail for customercare@your-company.com.

Change Route: Configure the rule to change the route to your-company@cloudprovider.com. This effectively reroutes emails without using traditional forwarding, which is disabled at the domain level.

Save and Apply: Save the compliance rule and ensure it is applied to enforce the new routing policy.

References

Google Support: Set up content compliance

Update Active Directory: Since your organization syncs directory data from Active Directory to Google Workspace, any changes to user data need to be made in Active Directory first.

Change Primary Email in AD: Change the user's primary email address in Active Directory. This will ensure that the new email address is synchronized with Google Workspace.

Change Last Name in AD: Similarly, change the user's last name in Active Directory. This ensures the updated name is synchronized correctly.

Sync Changes: Wait for the next synchronization cycle of Google Cloud Directory Sync (GCDS) to update the changes in Google Workspace.

Verify Changes in Google Workspace: After the sync is complete, verify that the changes to the user's email address and last name have been successfully updated in Google Workspace.

References

Google Support: Google Cloud Directory Sync

Access the Admin Console:

Log in to the Google Workspace Admin console at https://admin.google.com/ .

Configure Email Routing:

Navigate to "Apps" > "Google Workspace" > "Gmail" > "Default routing".

Set Up Split Delivery:

Create a new default routing rule.

Under "Add setting," click on "Routing."

In the "Add setting" box, under "Inbound," select "Configure" next to "Routing."

Under "Add setting," name your routing policy.

In the "Email messages to affect" section, specify the conditions for the rule (e.g., recipients in the new-company.com domain).

Route to On-Premises Server:

In the "Route" section, select "Modify message" > "Add more recipients."

Enter the on-premises email server information (e.g., SMTP relay server) to forward emails to the on-premises server.

Save the rule and ensure it is active.

Test the Configuration:

Send test emails to ensure that emails are correctly routed to the on-premises server as per the split delivery setup.

Monitor the email flow and make adjustments if necessary to ensure smooth operation during the peak season.

References

Google Workspace Admin Help: Set up routing for your domain or organization

Google Workspace Admin Help: Configure routing for mail in Google Workspace

The sign-in issue arises because the SAML assertion provided by the third-party IDP is presenting a username that conflicts with the current username configured in Google Workspace. When a username is changed in the third-party IDP, it must be synchronized with Google Workspace. If this synchronization does not happen, Google Workspace will not recognize the updated username and will prevent the user from signing in.

Verify that the username in the SAML assertion matches the username in Google Workspace.

If there is a mismatch, update the username in Google Workspace to match the SAML assertion.

Ensure that future changes in the third-party IDP are reflected in Google Workspace.

References:

Google Workspace Admin Help: Troubleshoot single sign-on

To implement a scan of all incoming email attachments effectively, you should enable virtual execution of attachments in the security sandbox for the entire organization. This feature allows Google Workspace to execute attachments in a sandbox environment to detect malicious behavior before the email reaches the user's inbox. By applying this to the entire organization, you ensure that all users are protected regardless of their organizational unit.

References:

Google Workspace Admin Help - Security Sandbox

Google Workspace Admin Help - Protect your organization from attachments with scripts

Check Service Status: Verify that the Password Sync service is running on all domain controllers by accessing the Services panel on each domain controller.

Restart Service if Necessary: If the service is not running, restart it and ensure it is set to start automatically.

Review Logs: Check the event logs on the domain controllers for any errors related to Password Sync.

Sync Test: Perform a password change on a test user account and verify that the change is synchronized with Google Workspace.

References:

Google Workspace Admin Help - Set Up Password Sync

Google Workspace Admin Help - Troubleshoot Password Sync

Access Admin Console: Sign in to your Google Admin console.

Navigate to Security: Click on "Security" and then "Set up single sign-on (SSO) with a third party IdP."

Add SAML Apps: Click on "Add SAML app" and select the app to configure.

Create SSO Profiles: Set up SSO profiles for each identity provider by entering the required SAML details such as ACS URL, Entity ID, etc.

Assign to OUs/Groups: Assign the created SSO profiles to specific organizational units (OUs) or groups of users based on their IdP.

Verify Configuration: Ensure that each profile is properly configured and tested.

References:

Google Workspace Admin Help: Set up SSO via SAML for single sign-on

Navigate to Google Admin Console: Go to admin.google.com and sign in with your admin account.

Access Buildings and Resources: In the Admin console, go to Menu > Directory > Buildings and resources.

Create Buildings and Rooms: Create buildings and define floors and sections within these buildings. Each building should represent an office location.

Set Users' Work Locations: Assign building ID, floor name, and floor section to users. This can be done manually for each user or in bulk using a CSV file upload.

Configure Calendar Settings: Ensure that the Google Calendar settings are configured to suggest nearby meeting rooms based on users' work locations.

This setup allows Google Calendar to suggest meeting rooms near the users' defined work locations, improving the user experience and avoiding the booking of inconvenient rooms.

References

Manage buildings, features & resources

Set up work locations

Access Admin Console: Log into your Google Workspace Admin Console.

Navigate to Alert Center: Go to Security > Alert Center.

Enable Alert Rule: Find and enable the “Suspended user made active” rule.

Configure Recipients: In the alert rule settings, add the CTO as an additional recipient under the “Other Recipients” section.

Save Settings: Save the configuration. The CTO will now receive notifications whenever a suspended user’s account is re-enabled, ensuring compliance with the new security policy.

References

Google Support: Alert Center

Verify License Availability: Check the number of available licenses in your Google Workspace subscription.

Purchase Additional Licenses: If necessary, purchase additional licenses to cover the number of users you plan to sync.

Configure GCDS: Ensure that Google Cloud Directory Sync (GCDS) is properly configured to sync users from your identity provider.

Run GCDS: Run the GCDS sync again to sync the new users now that sufficient licenses are available.

References:

Google Cloud Directory Sync Admin Help

Access Admin Console: Log in to the Google Admin console.

Navigate to Sharing Settings: Go to Apps > Google Workspace > Drive and Docs > Sharing settings.

Set Up Trusted Domains: Enable the Trusted Domains feature and add the domains of the newly acquired companies to the allowlist.

Adjust Sharing Settings: Configure the sharing settings to restrict external sharing but allow sharing with the trusted domains. This ensures compliance with the CISO’s mandate while enabling collaboration with the newly acquired companies.

Communicate Changes: Inform all users about the new sharing policies and the specific domains they are allowed to share content with.

Monitor Compliance: Regularly monitor sharing activities to ensure compliance with the new policies and make adjustments as necessary.

References:

Google Workspace Admin Help - Sharing Settings

Google Workspace Admin Help - Allowlist Trusted Domains

Enable API Access:

In the Google Workspace Admin console, go to "Security" > "API controls".

Enable API access and ensure the Domain Shared Contacts API is enabled.

Use Domain Shared Contacts API:

Develop a script or application to use the Domain Shared Contacts API to create shared contacts.

Include the partner employees’ contact information in the shared contacts list.

Upload Shared Contacts:

Use the script or application to upload the shared contacts to the Google Workspace Directory.

Ensure all partner contacts are correctly added and available to your employees.

Verify and Educate Users:

Verify that the shared contacts are visible to your employees in their Google Contacts.

Educate users on how to access and use the shared contacts to reduce sending errors.

References

Google Workspace Admin Help: Domain Shared Contacts API

Google Workspace Admin Help: Manage shared contacts

Evaluate Third-Party Backup Solutions: Identify third-party tools that offer secure backup solutions for Google Workspace. Examples include Backupify, Spanning Backup, and Afi.ai.

Choose a Suitable Tool: Based on your organization's needs and compliance requirements, select a tool that offers robust data retention, secure storage, and easy recovery options.

Set Up the Backup Solution:

Create an Account: Sign up for the chosen third-party backup service.

Configure Backup Settings: Link your Google Workspace account and configure the backup settings to meet your data retention policies.

Schedule Backups: Set up regular backup schedules to ensure data is continuously backed up.

Test Backups and Recovery: Perform initial backups and test the recovery process to ensure data can be retrieved efficiently when needed.

Monitor and Maintain: Regularly monitor the backup status and maintain the system to comply with your organization's data retention regulations.

References

Google Workspace Admin Help - Choose a third-party backup tool

Backupify - Google Workspace Backup

Access Admin Console: Log into your Google Workspace Admin Console.

Navigate to Reports: Go to the Reports section in the Admin Console.

Token Audit Log: Within the Reports, access the "Token Audit" log. This log provides details on OAuth tokens issued to applications by your users.

Review Applications: Review the list of applications that have been granted access to your Google Workspace data. This will include information about the scopes (types of data) that each application can access.

Compile List: Compile a list of all the applications from the token audit log. Include details about the data they have access to and the number of users using each application.

Export Data: You can export this data to a spreadsheet for further analysis and reporting to your chief compliance officer.

References

Google Support: Token audit log

Access Admin Console: Go to admin.google.com and sign in with your admin account.

Navigate to Gmail Settings: In the Admin console, go to Apps > Google Workspace > Gmail > Safety.

Configure Spoofing and Authentication Controls:

Set up email authentication policies such as SPF, DKIM, and DMARC to verify incoming emails.

Enable options to quarantine messages that fail authentication checks and are perceived as threats.

Configure warnings for users to alert them about potentially harmful messages.

Create Compliance Rules: Under the Gmail settings, create rules that quarantine suspicious emails and notify users when they receive messages that might be phishing attempts.

Train Users: Educate users on how to recognize phishing attempts and the importance of marking suspicious emails as spam.

By configuring these settings, you enhance the security against phishing attacks by both automatically handling suspected threats and making users aware of potential dangers.

References

Protect against spam and phishing with Gmail

Set up email authentication (SPF, DKIM, DMARC)

Verify DMARC, DKIM, and SPF records:

Sign in to your domain host and navigate to the DNS settings.

Ensure that SPF (Sender Policy Framework) is set up correctly to prevent email spoofing.

Configure DKIM (DomainKeys Identified Mail) to add a digital signature to emails sent from your domain.

Set up DMARC (Domain-based Message Authentication, Reporting & Conformance) to provide instructions to receiving mail servers on how to handle emails that fail SPF or DKIM checks.

Enable Gmail spoofing and authentication settings:

Sign in to the Google Admin console.

From the Admin console Home page, go to "Apps" > "Google Workspace" > "Gmail" > "Safety."

Enable settings related to spoofing and authentication to add additional layers of protection against phishing attempts.

By verifying these email security settings and enabling spoofing protections, you can help prevent unauthorized or fraudulent emails from being sent, thus reducing the risk of wire transfer fraud.

References:

Google Workspace Admin Help - Set up SPF records

Google Workspace Admin Help - Set up DKIM

Google Workspace Admin Help - Set up DMARC

Access Admin Console: Go to admin.google.com and sign in with your admin account.

Navigate to Reports: In the Admin console, go to Reports > Audit > Login.

Review Login Activity: Look for any unusual or suspicious login attempts, such as logins from unknown IP addresses or locations.

Investigate Further:

Check the user’s activity for any signs of unauthorized access or unusual behavior.

Use the Security Audit Log to find more details about the login attempts and other security events.

Take Appropriate Actions:

If unauthorized activity is confirmed, consider resetting the user’s password and enabling two-factor authentication (2FA).

Notify the user and possibly suspend the account if the threat level is high until the issue is resolved.

By investigating the login and security logs, you can identify and mitigate potential security threats effectively.

References

View and analyze security reports and logs

Audit and investigation page

To prepare the Chromebooks for use and register them in Google Workspace, enterprise enrollment is required. This process ensures that the devices are managed under your organization's policies.

Enterprise Enrollment: This is a process that ties a Chromebook to your organization’s Google Workspace account, applying policies and settings you’ve configured in the Google Admin console.

Steps for Enrollment:

Turn on the Chromebook: Start the device and wait for the login screen to appear.

Initiate Enrollment: Press Ctrl + Alt + E at the login screen. This key combination is specifically designed to start the enterprise enrollment process.

Sign In: Use the credentials of an account that has the necessary permissions to enroll devices (typically a Google Workspace admin account).

Complete Enrollment: Follow the prompts to complete the process. The device will now be managed under your organization's policies.

Re-enrollment Settings: It’s recommended to enable forced re-enrollment in the Google Admin console to ensure that devices cannot be used without being enrolled again if they are wiped.

References:

Enroll ChromeOS devices before deployment

Access Google Vault:

Go to Google Vault by navigating to vault.google.com.

Perform a Search:

In Vault, create a new search query specifying the criteria (e.g., date range, email address, keywords) to locate the missing email.

Use search operators to refine the search and ensure you find the correct email.

Export the Email:

Once the email is located, select it and choose the export option.

Export the email data in a standard format, such as MBOX or PST, which can be used for investigation and recovery purposes.

Provide the Exported Data:

Provide the exported email data to the COO for their review and use in the contract dispute.

References

Google Vault Help: Search for and export data

Assign Vault Administrator Role: In the Google Admin console, assign the compliance team members the Google Vault administrator role to give them the necessary permissions.

Access Google Vault: Have the compliance team access Google Vault.

Create a Matter: In Google Vault, create a new matter for the investigation.

Create a Hold: Within the matter, create a legal hold specifically targeting the employee’s email and any other relevant data. This will preserve all the necessary information beyond the default retention period.

Review Data: The compliance team can now review the preserved data as part of their investigation.

References:

Google Vault Help: Assign Vault privileges

Google Vault Help: Create and manage holds

Create a Content Compliance Rule:

Access the Google Admin console.

Go to Apps > Google Workspace > Gmail > Compliance.

Click on "Add another rule" to create a new content compliance rule.

Define the conditions to detect sensitive data within email content.

Set actions to quarantine or reject emails that contain sensitive information.

Turn Off Dynamic Email:

In the Admin console, go to Apps > Google Workspace > Gmail > User settings.

Turn off dynamic email for your organization or specific organizational units.

Save and Apply:

Save the compliance rule and dynamic email settings.

These configurations ensure that sensitive data in Doc comments does not appear in recipient inboxes.

References:

Google Workspace Admin Help: Set up content compliance

Google Workspace Admin Help: Turn dynamic email on or off

Schedule regular meetings with your Google Workspace partner.

During these meetings, review the Google Workspace roadmap and upcoming features.

Discuss how new features can be leveraged to benefit your organization.

Plan business reviews to ensure that you are making the most of the platform's capabilities and staying up-to-date with developments.

Establishing a regular cadence of roadmap and business reviews ensures continuous alignment with the latest Google Workspace innovations and allows your organization to take full advantage of new features.

References:

Google Workspace Admin Help - Google Workspace Partners

Enable Visitor Sharing: In the Google Admin console, go to Apps > Google Workspace > Drive and Docs > Sharing settings. Enable the 'Visitor Sharing' feature.

Configure Visitor Sharing: Ensure that the sharing settings allow sharing with external users who do not have a Google account.

Demonstrate to Finance Team: Conduct a training session with the Finance team to demonstrate how to use the Visitor Sharing feature securely.

Share Reports: When sharing the quarterly financial reports, use the Visitor Sharing option to generate a secure sharing link that can be accessed by the external auditor without requiring a Google account.

Monitor and Review: Regularly review shared documents to ensure that access is being appropriately managed and that the security of shared data is maintained.

References:

Google Workspace Admin Help - Visitor Sharing

Google Workspace Admin Help - Sharing Settings

Access Work Insights: Log into your Google Workspace Admin Console and access Work Insights.

Gather Adoption Metrics: Use Work Insights to gather data on how users are adopting Google Workspace. This includes information on how often they are using different Google Workspace applications and features.

Analyze Data: Analyze the data to identify which teams or departments may need additional training and support.

Targeted Training: Develop targeted training exercises based on the insights gathered. Focus on areas where adoption is low or where users are not taking full advantage of the available features.

Implement Training: Use Google Guides or other training methods to deliver the targeted training sessions.

Monitor Progress: Continue to use Work Insights to monitor adoption and adjust the training plan as necessary.

References

Google Support: Work Insights

Create a Matter: Access Google Vault and create a new matter for the lawsuit. Matters are used to manage legal holds and searches.

Create a Hold: Within the matter, create a new hold.

Set the Hold Scope: Set the hold scope to Gmail, since the requirement is to discover and hold emails.

Specify Accounts: Set the usernames to user1@your-company.com and user2@your-company.com. This ensures that all emails for these specific users are held.

Set Search Terms: Use the search terms “secret project 123” to hold any emails that reference this specific term. This is a broad search that captures any email mentioning "Secret Project 123."

Save the Hold: Save the hold to ensure that it captures all relevant emails for the specified users and the search term.

References

Google Support: Create or update a hold

Access Status Dashboard: Open the Google Workspace Status Dashboard.

Check Service Status: Look for any reported issues or outages specifically for Gmail.

Verify Timing: Check the timing of the reported issues to see if they correlate with the time when users reported problems.

Additional Information: Review any additional details or updates provided by Google regarding the service disruption.

Communicate Status: Inform the affected users about the service status and any expected resolution time.

Open Ticket if Necessary: If no issues are reported on the status dashboard, proceed with other troubleshooting steps such as checking network connectivity or opening a ticket with Google Support.

References:

Google Workspace Status Dashboard

To mitigate the security risk of unauthorized sign-in attempts from countries without local employees, two effective and cost-efficient solutions are:

A. Deploy 2-Step Verification for all users who have security keys. This enhances account security by requiring an additional verification step, reducing the risk of unauthorized access.

D. Subscribe to Cloud Identity Premium for all accounts and define Context-Aware Access levels to allow access only from specific countries where the company has employees. This adds an additional layer of security by controlling access based on geographic location.

These solutions are effective in enhancing security while minimizing financial outlay compared to other options like upgrading to Enterprise Plus.

References:

Google Workspace Admin Help - Set up 2-Step Verification

Google Workspace Admin Help - Context-Aware Access

To ensure new users receive emails from their previous domain without affecting existing users:

Add the acquired domain as a secondary domain to the primary Google Workspace domain.

Update the email information of all new users to include alias emails from the previous domain. This allows them to receive emails sent to their old addresses.

This method segregates the old and new user groups effectively and maintains the integrity of the email addresses.

References:

Google Workspace Admin Help: Manage domains

Install GCPW on Windows Devices:

Download the Google Credential Provider for Windows (GCPW) from Google’s official site.

Install GCPW on each Windows device.

Configure GCPW to allow users to sign in using their Google Workspace credentials.

Enable Windows Device Management:

Go to admin.google.com and sign in with your admin account.

Navigate to Devices > Mobile & endpoints > Settings > Windows settings.

Enable Windows device management to allow Google Workspace to manage the Windows 10 devices.

Configure Settings and Policies:

Apply necessary device policies and settings through the Admin console to ensure security and compliance.

User Login:

Users can now use their Google Workspace credentials to log into their Windows 10 devices, and the devices will be managed via Google Workspace endpoint management.

This setup integrates Windows 10 devices with Google Workspace for unified credential management and device policy enforcement.

References

Set up Google Credential Provider for Windows (GCPW)

Set up and manage Windows devices

Move to Shared Drive:

Shared Drives in Google Workspace are designed to store files owned by the team or the organization rather than an individual user.

When files are moved to a Shared Drive, the ownership of those files is transferred to the domain, which means the storage quota for individual users is not affected.

To move files to a Shared Drive:

Navigate to Google Drive.

Select the files or folders to move.

Right-click and choose "Move to" and select the appropriate Shared Drive.

Transfer Ownership:

You can transfer ownership of files from one user to another within the same domain.

This is helpful if a user is running out of storage quota, as the storage used by the file will count against the new owner’s quota.

To transfer ownership:

Open the file in Google Drive.

Click on the Share button.

Add the new owner and change their role to 'Owner'.

The new owner must accept the ownership transfer.

References

Google Workspace Admin Help: Shared Drives

Google Drive Help: Transfer File Ownership