Google Workspace security settings every admin should check

Securing your Google environment

Google Workspace is a powerful tool for collaboration, but its openness can be a risk if not managed correctly. For small business owners and admins, understanding google workspace security is the first step in protecting company assets. By configuring a few key settings, you can significantly reduce the risk of a breach without making the system difficult for your team to use. This guide focuses on the high-impact settings that provide the best protection.

Enforce 2-Step Verification (2SV)

Google's version of multi-factor authentication is called 2-Step Verification. It is the single most important setting for google workspace security. As an admin, you should not just encourage it; you should enforce it. You can set a date by which all users must have 2SV enabled, after which they will be locked out until they set it up. Use security keys or the Google Prompt for the best security and user experience.

Manage Third-Party App Access

Many employees use their Google account to sign into other apps and services. While convenient, this creates a risk known as 'OAuth' abuse. If a malicious app is granted access to a user's account, it can read their emails and files even if the user changes their password. To improve google workspace security, you should review and restrict which third-party apps are allowed to access your domain's data and prune those that are unnecessary.

Configure Drive and Docs Sharing

The default settings in Google Drive often allow users to share files with 'anyone with the link.' This is a major data leak risk. Adjust your google workspace security settings to restrict external sharing. You can choose to warn users when they share externally, or you can restrict sharing to only 'trusted domains' such as your verified partners or long-term clients.

• Disable 'Public' sharing for the entire organization to prevent accidental leaks.
• Restrict the creation of shared drives to specific users who understand the security risks.
• Use 'Data Loss Prevention' (DLP) rules to scan for sensitive info like social security numbers.
• Encourage users to set expiration dates on any external sharing links they create.

Protect Gmail from Phishing and Spoofing

Email is the most common entry point for cyberattacks against small businesses. To enhance your google workspace security, ensure you have correctly configured SPF, DKIM, and DMARC records. These technical settings prove that an email coming from your domain is actually from you, which prevents attackers from spoofing your address and helps your emails reach their intended destination without being marked as spam.

1. Verify your SPF record in your DNS settings to authorize your mail servers.
2. Enable DKIM signing in the Gmail Admin console to add a digital signature to your mail.
3. Implement a DMARC policy to instruct other servers on how to handle unverified mail.
4. Turn on 'enhanced pre-delivery scanning' for attachments to catch malware early.

Audit Administrator Roles for Safety

A 'Super Admin' has total control over your Google Workspace environment. You should have at least two Super Admins for redundancy, but no more than three or four. Most administrative tasks can be handled by 'Delegated Admins' who only have the permissions they need for their specific jobs. This 'Least Privilege' approach is a core principle of google workspace security and protects you from a single compromised account destroying the company.

• Enforce 2-Step Verification for all users in the organization.
• Review and prune the list of Super Admins to the bare minimum.
• Restrict external sharing in Google Drive to trusted parties.
• Audit third-party apps with access to your corporate data.
• Verify SPF, DKIM, and DMARC settings for Gmail to prevent spoofing.