Attacks/Breaches
8/14/2012
09:38 AM
50%
50%

9 Google Apps Security Secrets For Business

After journalist's life hack, is your business protected against nosy rivals and even hacktivists? It's time to strengthen your Google security plan.

In the wake of the hack of technology journalist Mat Honan, many users of cloud-based services are running scared.

Forget Twitter-hacking attackers named "Phobia" who managed to compromise a well-known technology journalist's Google credentials and Twitter account. What about competitive intelligence experts who might want to hack rivals' Gmail accounts to siphon away corporate secrets? Or hacktivists seeking a reprise of the Anonymous attack against HBGary, which copied and then deleted the firm's Gmail accounts?

To help stop "life hack," competitive intelligence, or hacktivist attacks that come gunning for corporate data, all Google Apps for Business users--and especially corporate administrators--should pursue the following nine security strategies:

1. Create a Google security plan: Anyone who uses Google for business should begin by detailing all related security processes and procedures, with an eye toward spotting potential weak points--especially single points of failure--and having a data breach response plan. As an example of what can happen without this type of plan, take the February, 2011 hack of HBGary's email by the hacktivist group Anonymous. Briefly, HBGary had threatened to reveal the identities of many group members. In retaliation, members of Anonymous used a stolen password to hack into HBGary's company-wide Gmail account, from which it copied and then deleted every email it found. According to HBGary CEO Greg Hoglund, he saw the attack unfolding, but wasn't able to convince the Google help desk of his own identity, in time to prevent all of the company's emails from being copied.

2. Use two-factor authentication: Anyone who possesses just a Google account username and password can access that account and everything it sees, including documents and spreadsheets, unless Google's two-factor authentication system is enabled. Accordingly, enabling it is a no-brainer for every business user.

In the case of the Honan hack, for example, "much of the story is about Amazon or Apple's security practices, but I would still advise everyone to turn on Google's two-factor authentication to make your Gmail account safer and less likely to get hacked," said Matt Cutts, the head of Google's Web spam team, in a personal blog post.

Likewise, Gartner analyst John Pescatore said HBGary was at least partially to blame for the unauthorized access to--and deletion of--its Gmail accounts, because the security technology company wasn't using Google's two-factor authentication system.

3. Configure two-factor for external email accounts: Google's Cutts also noted that while Google's two-factor authentication system is designed for browsers, POP and IMAP email clients can be given unique passwords for checking Gmail. Using such passwords makes it more difficult for an attacker who's compromised an employee's Gmail credentials to surreptitiously and remotely listen in to all email communications.

4. Extend Google authenticator, where applicable: Likewise, Google's two-factor authentication will work with additional sites, including LastPass, WordPress, Amazon Web Services, Drupal, and DreamHost, said Cutts. In the case of WordPress, for example, an administrator can set the blogging software to require two-factor authentication for specific user accounts.

5. Delete users after they depart: As part of your company's Google Apps for Business security plan, ensure that processes are in place to immediately change the passwords of departing users--or better yet, to remove their accounts entirely. That helps prevent former employees from taking sensitive information or customer lists with them.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
robert.bsn.ie
50%
50%
robert.bsn.ie,
User Rank: Apprentice
8/31/2012 | 4:24:26 PM
re: 9 Google Apps Security Secrets For Business
Probably the easiest security measure to take if you have a Google Apps Domain is download a Free Audit Tool for Google Apps from the marketplace. Most loss occurs from the inside. Audit helps prevent that.
seanacampbell
50%
50%
seanacampbell,
User Rank: Apprentice
8/16/2012 | 4:25:47 PM
re: 9 Google Apps Security Secrets For Business
Competitive Intelligence experts do not "hack" email accounts. Competitive Intelligence is an ethical, legal practice. See the Strategic and Competitive Intelligence Professionals (SCIP.org) Code of Ethics for more on this point.

Corporate Espionage is what the author is referring to in the article, not the ethical practice of gathering Competitive Intelligence on one's industry and potential and current competitors.

Thanks,

Sean Campbell
Principal - Cascade Insights
www.cascadeinsights.com
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4293
Published: 2015-07-30
The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented (1) IPv4 or (2) IPv6 packets that trigger ATTN-3-SYNC_TIMEOUT errors after reassembly failures, aka Bug ID CSCuo37957.

CVE-2014-7912
Published: 2015-07-29
The get_option function in dhcp.c in dhcpcd before 6.2.0, as used in dhcpcd 5.x in Android before 5.1 and other products, does not validate the relationship between length fields and the amount of data, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory c...

CVE-2014-7913
Published: 2015-07-29
The print_option function in dhcp-common.c in dhcpcd through 6.9.1, as used in dhcp.c in dhcpcd 5.x in Android before 5.1 and other products, misinterprets the return value of the snprintf function, which allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corru...

CVE-2015-2977
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors.

CVE-2015-2978
Published: 2015-07-29
Webservice-DIC yoyaku_v41 allows remote attackers to bypass authentication and complete a conference-room reservation via unspecified vectors, as demonstrated by an "unintentional reservation."

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!