Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A practical guide to securing Google Workspace for a startup

fleetdm.com

Post reply on HN
Print view View original

11–20 of 64 posts

Re: A practical guide to securing Google Workspace for a startup

#11

Post by staticassertion »

gepeto42 wrote: post #2

This is how we secure Workspace here at Fleet. We figured the guide could be useful to companies of a similar size. The next step would be to enable Endpoint Verification to control access to specific apps such as Drive so it could only be done from up to date, encrypted devices, but that requires a the highest Google subscription.

We've been meaning to write about this. You can actually do it with just Google Business, but you have to then also buy their Identity service, which I forget the name of. It's packaged into Enterprise edition but also sold separately.

We also reached out to sales and got a deal, explaining we didn't want to pay prices designed for companies with 1000s of employees.

Re: A practical guide to securing Google Workspace for a startup

#12

Post by gepeto42 »

staticassertion wrote: post #8

Another tip - enabled Advanced Protection Program. You can't enforce this at the GSuite level but for a small company it's easy to just audit for it. We have everyone do this as part of onboarding and we audit once a month.

Yes! With advanced protection you get enforced security keys, recovery only through admins, enforced safe browsing in Chrome. It's a nice way to get a bunch of improved controls in one shot.

Would be nice if Google allowed enforcing it with a grace period for new accounts though!

Re: A practical guide to securing Google Workspace for a startup

#16

Post by staticassertion »

gepeto42 wrote: post #12
staticassertion wrote: post #8

Another tip - enabled Advanced Protection Program. You can't enforce this at the GSuite level but for a small company it's easy to just audit for it. We have everyone do this as part of onboarding and we audit once a month.

Yes! With advanced protection you get enforced security keys, recovery only through admins, enforced safe browsing in Chrome. It's a nice way to get a bunch of improved controls in one shot. Would be nice if Google allowed enforcing it with a grace period for new accounts though!

Agreed - there's basically nothing in GSuite about it, except the indicator on a user's page. It's enough for manual auditing at least. But since we handle it during our onboarding and we're small enough for a manual audit it works out alright.

Re: A practical guide to securing Google Workspace for a startup

#18

Post by gepeto42 »

mlrhazi wrote: post #13

Nothing about Addons/MarketApps ? should one disable all? can we manage the access they have to the domain/user data?

The API Access section covers OAuth apps. Essentially you:

1. Mark Google services you consider critical as "restricted" (ex: Drive, gmail) 2. On Gmail and Drive, you can then allow apps that use lower levels of permissions, but not those who need "dangerous access" 3. Then on a per app basis you can mark apps as "trusted" which lets them access "restricted" Google services.

It is not super granular in the sense that you can't easily say - Calendar2000 can be used by my sales team, and should have access only to the invites date and time but not attendees, body or attachment, but it is better than nothing!

Re: A practical guide to securing Google Workspace for a startup

#19

Post by gepeto42 »

codegeek wrote: post #17

Nice guide. I would also suggest checking your domain's MX records to ensure you have things configured correctly including DKIM etc. Google has this tool that gives your domain a scan: https://toolbox.googleapps.com/apps/checkmx/

We did mention DMARC DKIM etc but I did not put a link to this very useful tool. Feel free to submit a PR and we'll merge it - https://github.com/fleetdm/fleet/edit/main/handbook/security... - or if you don't mind I can also add it on my side next time I make an edit.
Post reply on HN