Live data from Hacker News

A practical guide to securing Google Workspace for a startup

fleetdm.com

61–64 of 64 posts

Re: A practical guide to securing Google Workspace for a startup

#61
post #53

My advice is to never, ever, ever rely on Google Workspace for a startup. Office 365 is a little bit less usable, but Microsoft can work with businesses. I used Google Workspace for a startup. Startup went idle for a while. Google sent a message to me warning the account would be terminated unless I logged in on some short timeline. GMail filed its own email as spam. Boom. Everything from that startup was gone. I use…

If your business relies on it, whatever "it" is, then you probably need to pay for it, so that if it has some serious problem, you can call up a human and either beg or yell at them to fix it, depending on the situation. I've always thought it madness to even rely on gmail for a business, who can cancel you whenever.

The problem is if you pay Google for "it," you're still treated as a statistic, same as the non-paying customers. It's deep in the corporate DNA. Google Workspace isn't free, and neither is the rest of GCP.

I've had multi-million dollar engagements with Google, and you're just as vulnerable to this stuff as the free ones. I've had things escalated through one of Eric Schmidt's direct reports, and I was still vulnerable.

And as a footnote, I do subscribe to Google One on my soon-to-be-terminated Workspace account. I'm not sure why Google is terminating a service I paid for.

If you pay Google, you can talk to human beings, perhaps, but they're no more empowered to solve your problem than their web pages.

Microsoft and Amazon have always provided real support. Things get escalated to engineers who fix things if need be. Things also don't get whack-a-moled for no reason; they're aware that bankrupting my business isn't good for their business, even if the short-term ROI on sustaining a legacy API or something is negative.

Re: A practical guide to securing Google Workspace for a startup

#62
post #53

Earlier quoted context omitted.

If your business relies on it, whatever "it" is, then you probably need to pay for it, so that if it has some serious problem, you can call up a human and either beg or yell at them to fix it, depending on the situation. I've always thought it madness to even rely on gmail for a business, who can cancel you whenever.

The problem is if you pay Google for "it," you're still treated as a statistic, same as the non-paying customers. It's deep in the corporate DNA. Google Workspace isn't free, and neither is the rest of GCP. I've had multi-million dollar engagements with Google, and you're just as vulnerable to this stuff as the free ones. I've had things escalated through one of Eric Schmidt's direct reports, and I was still vulnerab…

Oh right. I suppose "paying for it" is necessary, not sufficient. I wouldn't know; I've paid a much smaller company for all my services and such, though they're not super office-y; but website and email related things.

Re: A practical guide to securing Google Workspace for a startup

#63

Thanks for writing this up; this is very helpful. One of my tasks is coming up with security policies for people in the startup I'm the CTO of. One of the less glamorous things I get to do in this job.

That is exactly what it is for! We will be adding more about how we secure Fleet to our handbook, check it again in a few weeks and it should have even more stuff that a startup CTO can use!

Re: A practical guide to securing Google Workspace for a startup

#64
post #54

I’m surprised you disable the google drive feature. We’re not that worried about local files leaking even if the laptop is stolen, given apple’s hardware encryption. On the other hand, the workflow of “manually download file, modify file in app, manually upload file” is clumsy and error prone, often leaving files stranded on the laptop. On the gripping hand, google drive (as it is called again) seems to crash every f…

I would only enable Google Drive local sync on laptops that we know are company owned. The guide didn't cover "Context-aware access". Depending on how you work, it is surprising to see that most people don't even mind that they can't sync files locally, where in other companies it would be completely impossible. I guess it comes down to how much of your work is Google Docs/Sheets vs other file types.
Post reply on HN