51–60 of 64 posts
Given Google's capacity for freezing organizations and individuals (even those who are paying customers of its products) from Google services out of the blue and with little to no recourse, I'd most recommend that you secure your startup best by simply not even using google for key parts of its operations if at all possible.
My advice is to never, ever, ever rely on Google Workspace for a startup. Office 365 is a little bit less usable, but Microsoft can work with businesses. I used Google Workspace for a startup. Startup went idle for a while. Google sent a message to me warning the account would be terminated unless I logged in on some short timeline. GMail filed its own email as spam. Boom. Everything from that startup was gone. I use…
I've always thought it madness to even rely on gmail for a business, who can cancel you whenever.
On the other hand, the workflow of “manually download file, modify file in app, manually upload file” is clumsy and error prone, often leaving files stranded on the laptop.
On the gripping hand, google drive (as it is called again) seems to crash every few days so perhaps your restriction isn’t much of a limitation :-(
I recently seen many youtubers having their channel hijacked due to hackers taking over their Google account.
I was hoping that there will be something in the guide for session hijacking. I recently seen many youtubers having their channel hijacked due to hackers taking over their Google account.
This is how we secure Workspace here at Fleet. We figured the guide could be useful to companies of a similar size. The next step would be to enable Endpoint Verification to control access to specific apps such as Drive so it could only be done from up to date, encrypted devices, but that requires a the highest Google subscription.
It’s also been a while since I’ve seen a nice quick Mac OS security settings list to go ahead and toggle.
My only request would be additional guide for iOS security. The iVerify app suggests some good defaults
Another tip - enabled Advanced Protection Program. You can't enforce this at the GSuite level but for a small company it's easy to just audit for it. We have everyone do this as part of onboarding and we audit once a month.
It never made sense to me that large software suites like these don't offer a secure by default option on creation or as a progressive migration after creation. Why soo many steps...
Thanks for this! THis kind of domain security is usually poorly articulated or just not out in the open. I still think the basis of most risk for small companies is their domains. Lose control of those and well.. you're fucked. Any recs for "high security" domain providers?
You are 100% right that the domain is the keys to the kingdom. Definitely only use registrars and DNS providers that have 2FA. Google has a registrar now, as well as DNS in GCP https://cloud.google.com/domains/docs/register-domain and https://cloud.google.com/dns . By using those you can leverage your Google account's security (use separate accounts for admin level access on GCP and enforce hardware 2FA), and control…