Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A practical guide to securing Google Workspace for a startup

fleetdm.com

Post reply on HN
Print view View original

31–40 of 64 posts

Re: A practical guide to securing Google Workspace for a startup

#31

Post by jiveturkey »

codegeek wrote: post #17

Nice guide. I would also suggest checking your domain's MX records to ensure you have things configured correctly including DKIM etc. Google has this tool that gives your domain a scan: https://toolbox.googleapps.com/apps/checkmx/

Neat but inadequate. My domain passes all the checks, yet I already know that I have SPF and DMARC set, but so that spoofs get through. A proper tool should have flagged that.

I rather like easydmarc.com. They charge for analytic services but you can use their checker for free. They also have very easily digested guides and recommendations for setting up the various records.

Re: A practical guide to securing Google Workspace for a startup

#33

Post by codegeek »

gepeto42 wrote: post #19
codegeek wrote: post #17

Nice guide. I would also suggest checking your domain's MX records to ensure you have things configured correctly including DKIM etc. Google has this tool that gives your domain a scan: https://toolbox.googleapps.com/apps/checkmx/

We did mention DMARC DKIM etc but I did not put a link to this very useful tool. Feel free to submit a PR and we'll merge it - https://github.com/fleetdm/fleet/edit/main/handbook/security... - or if you don't mind I can also add it on my side next time I make an edit.

Yes of course go ahead add it :)

Re: A practical guide to securing Google Workspace for a startup

#34

Post by gepeto42 »

tempnow987 wrote: post #32

Turning on trust devices makes users a TON happier. You'll still get a password prompt if elevating security profile for something higher privilege in my experience.

That is true especially if your sessions are made very short, which requires the more expensive Google Workspace edition. But if sessions are long, the risk is users lose access to their 2FA and don't notice until it becomes a bigger problem...

Re: A practical guide to securing Google Workspace for a startup

#36

Post by codegeek »

tomcam wrote: post #30
codegeek wrote: post #17

Nice guide. I would also suggest checking your domain's MX records to ensure you have things configured correctly including DKIM etc. Google has this tool that gives your domain a scan: https://toolbox.googleapps.com/apps/checkmx/

Just wanted you to know that this made a huge difference on my most important domain, today. I appreciate your pointing it out because I assumed Gmail would automagically handle everything

Glad to be of help. I also found this the hard way. Google Workspace doesn't do this by default

Re: A practical guide to securing Google Workspace for a startup

#38

Post by yellow_mixer »

gepeto42 wrote: post #24
latchkey wrote: post #20

This article covers Macs as well. I wonder about Windows.

Hi! We will eventually cover other OSes. In the meantime, for Windows, Microsoft has good guides through they are usually very lengthy - https://techcommunity.microsoft.com/t5/microsoft-security-ba...

May I ask what you are using for endpoint management? Are you using JAMF, Intune, something else? Are you using an always on VPN to all users? All cloud based or on-prem infra? DNS security? Endpoint protection?

Thanks for posting the guide!

Re: A practical guide to securing Google Workspace for a startup

#39

Post by stingraycharles »

adev123 wrote: post #37

Thoughts on using Event Threat Detection / Chronicle or exporting logs to GCP and beyond for analysis? https://cloud.google.com/security-command-center/docs/how-to... https://cloud.google.com/logging/docs/audit/configure-gsuite...

I would be interested in hearing about experiences with these threat detection systems I general. They’re typically quite expensive, and I always wonder whether they actually produce reliable alerts. I’m conditioned by noisy virus scanners and firewalls, and wonder whether these corporate threat detection systems have a similar signal:noise ratio when it comes to alerts.

Re: A practical guide to securing Google Workspace for a startup

#40

Post by helloworld11 »

Given Google's capacity for freezing organizations and individuals (even those who are paying customers of its products) from Google services out of the blue and with little to no recourse, I'd most recommend that you secure your startup best by simply not even using google for key parts of its operations if at all possible.
Post reply on HN