Attacks/Breaches
8/14/2012
09:38 AM
50%
50%

9 Google Apps Security Secrets For Business

After journalist's life hack, is your business protected against nosy rivals and even hacktivists? It's time to strengthen your Google security plan.

In the wake of the hack of technology journalist Mat Honan, many users of cloud-based services are running scared.

Forget Twitter-hacking attackers named "Phobia" who managed to compromise a well-known technology journalist's Google credentials and Twitter account. What about competitive intelligence experts who might want to hack rivals' Gmail accounts to siphon away corporate secrets? Or hacktivists seeking a reprise of the Anonymous attack against HBGary, which copied and then deleted the firm's Gmail accounts?

To help stop "life hack," competitive intelligence, or hacktivist attacks that come gunning for corporate data, all Google Apps for Business users--and especially corporate administrators--should pursue the following nine security strategies:

1. Create a Google security plan: Anyone who uses Google for business should begin by detailing all related security processes and procedures, with an eye toward spotting potential weak points--especially single points of failure--and having a data breach response plan. As an example of what can happen without this type of plan, take the February, 2011 hack of HBGary's email by the hacktivist group Anonymous. Briefly, HBGary had threatened to reveal the identities of many group members. In retaliation, members of Anonymous used a stolen password to hack into HBGary's company-wide Gmail account, from which it copied and then deleted every email it found. According to HBGary CEO Greg Hoglund, he saw the attack unfolding, but wasn't able to convince the Google help desk of his own identity, in time to prevent all of the company's emails from being copied.

2. Use two-factor authentication: Anyone who possesses just a Google account username and password can access that account and everything it sees, including documents and spreadsheets, unless Google's two-factor authentication system is enabled. Accordingly, enabling it is a no-brainer for every business user.

In the case of the Honan hack, for example, "much of the story is about Amazon or Apple's security practices, but I would still advise everyone to turn on Google's two-factor authentication to make your Gmail account safer and less likely to get hacked," said Matt Cutts, the head of Google's Web spam team, in a personal blog post.

Likewise, Gartner analyst John Pescatore said HBGary was at least partially to blame for the unauthorized access to--and deletion of--its Gmail accounts, because the security technology company wasn't using Google's two-factor authentication system.

3. Configure two-factor for external email accounts: Google's Cutts also noted that while Google's two-factor authentication system is designed for browsers, POP and IMAP email clients can be given unique passwords for checking Gmail. Using such passwords makes it more difficult for an attacker who's compromised an employee's Gmail credentials to surreptitiously and remotely listen in to all email communications.

4. Extend Google authenticator, where applicable: Likewise, Google's two-factor authentication will work with additional sites, including LastPass, WordPress, Amazon Web Services, Drupal, and DreamHost, said Cutts. In the case of WordPress, for example, an administrator can set the blogging software to require two-factor authentication for specific user accounts.

5. Delete users after they depart: As part of your company's Google Apps for Business security plan, ensure that processes are in place to immediately change the passwords of departing users--or better yet, to remove their accounts entirely. That helps prevent former employees from taking sensitive information or customer lists with them.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
robert.bsn.ie
50%
50%
robert.bsn.ie,
User Rank: Apprentice
8/31/2012 | 4:24:26 PM
re: 9 Google Apps Security Secrets For Business
Probably the easiest security measure to take if you have a Google Apps Domain is download a Free Audit Tool for Google Apps from the marketplace. Most loss occurs from the inside. Audit helps prevent that.
seanacampbell
50%
50%
seanacampbell,
User Rank: Apprentice
8/16/2012 | 4:25:47 PM
re: 9 Google Apps Security Secrets For Business
Competitive Intelligence experts do not "hack" email accounts. Competitive Intelligence is an ethical, legal practice. See the Strategic and Competitive Intelligence Professionals (SCIP.org) Code of Ethics for more on this point.

Corporate Espionage is what the author is referring to in the article, not the ethical practice of gathering Competitive Intelligence on one's industry and potential and current competitors.

Thanks,

Sean Campbell
Principal - Cascade Insights
www.cascadeinsights.com
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!