Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A practical guide to securing Google Workspace for a startup

fleetdm.com

Post reply on HN
Print view View original

41–50 of 64 posts

Re: A practical guide to securing Google Workspace for a startup

#41

Post by Hnrobert42 »

yellow_mixer wrote: post #38
gepeto42 wrote: post #24

Earlier quoted context omitted.

Hi! We will eventually cover other OSes. In the meantime, for Windows, Microsoft has good guides through they are usually very lengthy - https://techcommunity.microsoft.com/t5/microsoft-security-ba...

May I ask what you are using for endpoint management? Are you using JAMF, Intune, something else? Are you using an always on VPN to all users? All cloud based or on-prem infra? DNS security? Endpoint protection? Thanks for posting the guide!

We use Jamf and DataJar for patch management, and we have been happy with both. DataJar’s customer service /sales is lousy, but they are the only game in town.

Re: A practical guide to securing Google Workspace for a startup

#42

Post by Melatonic »

gepeto42 wrote: post #27
qwertox wrote: post #26

I wish it had a feature in the admin section where one could disable different 2FA methods. For example, in my family everyone has SMS as a 2FA, as well as hardware tokens and device prompts. SMS was there from the beginning, so everyone has it activated. Only one account is not using hardware tokens. So what I'd like to do is to set SMS to off, and all the accounts which already have something like device prompts an…

There is, though it is not ultra granular. They introduced it last year and we mention it in the guide. https://workspaceupdates.googleblog.com/2019/03/more-control... Essentially you can enforce 2FA or not, then, you can allow ANY method, any method BUT telephony based (calls and SMS), or hardware security key only. The middle option for most people is a great one as it allows Google Prompt (push notifications) as w…

Awesome - did not realize they had rolled this out either!

Re: A practical guide to securing Google Workspace for a startup

#43

Post by theptip »

stingraycharles wrote: post #39
adev123 wrote: post #37

Thoughts on using Event Threat Detection / Chronicle or exporting logs to GCP and beyond for analysis? https://cloud.google.com/security-command-center/docs/how-to... https://cloud.google.com/logging/docs/audit/configure-gsuite...

I would be interested in hearing about experiences with these threat detection systems I general. They’re typically quite expensive, and I always wonder whether they actually produce reliable alerts. I’m conditioned by noisy virus scanners and firewalls, and wonder whether these corporate threat detection systems have a similar signal:noise ratio when it comes to alerts.

I concur, interesting but has always been expensive.

And looking this up:

> If your total annual Google Cloud spend or commit is less than $15 million, the annual cost of Security Command Center Premium is 5% of the larger of the following:

> Your committed annual Google Cloud spend (for deals up to the term of your commit), or Your actual annual current annualized Google Cloud spend (for deals up to one year) There is a minimum annual cost of $25,000.

Yeah I need to be a few orders of magnitude bigger before this is anything close to sane.

Re: A practical guide to securing Google Workspace for a startup

#45

Post by blip54321 »

My advice is to never, ever, ever rely on Google Workspace for a startup. Office 365 is a little bit less usable, but Microsoft can work with businesses.

I used Google Workspace for a startup. Startup went idle for a while. Google sent a message to me warning the account would be terminated unless I logged in on some short timeline. GMail filed its own email as spam. Boom. Everything from that startup was gone.

I used Google Workspace for my family domain. Google decided to discontinue GSuite/Free. Now, I'm SOL.

I've had similar experiences with Youtube. I build a major startup with Google as a partner. Videos were on Youtube. Google had 4 engineers assigned to us. Youtube has a bug which took us down. There was no way to resolve the bug, even with a team supporting us (in a different part of Google). We had to migrate off.

I've more recently been involved in businesses integrating with Workspace. On the API side, Google suddenly required a security audit for our business integrations to keep working. That's tens of thousands of dollars. Many small businesses went under when Google introduced this. (https://www.prescientsecurity.com/google-oauth-api-verificat...)

We also had an extension, which is in the process of breaking with Manifest V3 (https://www.eff.org/deeplinks/2021/12/chrome-users-beware-ma...). Again, many Google partners are going out-of-business over this.

Each time I've done business with Google, I've eventually been !@#$%.

These are all true stories, but they're not all the true stories I have. I have a much longer collection of stories of being !@#$% by Google. Some I can't talk about have to do with Workspace security issues. BOY was that a rabbit hole. If I could talk about it, you'd never do business with Google either. Google has excellent security for their data, but not for your data.

Google doesn't mind killing your livelihood with random changes like these. It happens over, and over, and over. Everyone thinks it won't happen to them, until it does.

Re: A practical guide to securing Google Workspace for a startup

#46

Post by technion »

gepeto42 wrote: post #10
71a54xd wrote: post #7

Thanks for this! THis kind of domain security is usually poorly articulated or just not out in the open. I still think the basis of most risk for small companies is their domains. Lose control of those and well.. you're fucked. Any recs for "high security" domain providers?

You are 100% right that the domain is the keys to the kingdom. Definitely only use registrars and DNS providers that have 2FA. Google has a registrar now, as well as DNS in GCP https://cloud.google.com/domains/docs/register-domain and https://cloud.google.com/dns . By using those you can leverage your Google account's security (use separate accounts for admin level access on GCP and enforce hardware 2FA), and control…

This ties into a issue I preach everywhere I can: At least three different companies I've been associated with, including one F500, lost control of their domain due to the following process:

Someone in marketing got an email from some contracted SEO consultant, which said "I need your domain transfer codes". Marketing goes to a VP and overrides everyone ops, everyone in security, and basically everyone who would say "no" because tech people just get in the way.

So suddenly, the domain is transferred to Bluehost using their DNS, the MX records that served 8000 mailboxes are pointed at some "cPanel with five free POP3 accounts" service, and the subdomain that ran your SaaS no longer resolves. But your landing page has better SEO.

Re: A practical guide to securing Google Workspace for a startup

#47

Post by technion »

tempnow987 wrote: post #23
julienfr112 wrote: post #21

Try to do the same for Azure Ad + intune + office 365 + ... Hundreds of pages....

Haha.. I tried a bit and failed to get it to hang together with some poking. One user request was to STOP the "windows hello" PIN requirement, and just have a password (+ MFA) for login. Does anyone know how to do this with either standard Office 365 subscriptions, or office 365 + Intune or similar? Would love not to have to do Azure AD outside of the office subscriptions. Microsoft has a fair number of SKU's these d…

Can do!

From the Endpoint Manager (endpoint.microsoft.com) hit "Devices" and then "Windows Enrollment". Click "Windows Hello for Business", and click "Disabled".

Re: A practical guide to securing Google Workspace for a startup

#48

Post by invalidname »

blip54321 wrote: post #45

My advice is to never, ever, ever rely on Google Workspace for a startup. Office 365 is a little bit less usable, but Microsoft can work with businesses. I used Google Workspace for a startup. Startup went idle for a while. Google sent a message to me warning the account would be terminated unless I logged in on some short timeline. GMail filed its own email as spam. Boom. Everything from that startup was gone. I use…

Yep. You can't count on Google to be anything other than an advertising company and even then it's a pretty bad one at that e.g. https://talktotheduck.dev/production-horrors-handling-disast...

Even search which used to be its crowning achievement isn't great for most terms. SEO dominates google completely.

Re: A practical guide to securing Google Workspace for a startup

#49

Post by staticassertion »

blip54321 wrote: post #45

My advice is to never, ever, ever rely on Google Workspace for a startup. Office 365 is a little bit less usable, but Microsoft can work with businesses. I used Google Workspace for a startup. Startup went idle for a while. Google sent a message to me warning the account would be terminated unless I logged in on some short timeline. GMail filed its own email as spam. Boom. Everything from that startup was gone. I use…

As a Gsuite customer, I do mostly agree. I'll say I'm very pleased with GSuite, but I also think that Google is about as bad as it gets with regards to customer service, and I would never put customer data into Google Cloud since I would never risk losing that data due to their idiotic, inane systems deciding to ban me, and no support channel for getting it back.

Re: A practical guide to securing Google Workspace for a startup

#50

Post by staticassertion »

rob-olmos wrote: post #29

FYI to setup an alert like "Out of domain email forwarding" -- you have to go to Reporting > Login. If you go to Rules and click "create rule" it'll take you to Reporting > Admin, which won't have the Login event types.

Great advice. This is such a classic attack.
Post reply on HN