WEBVTT
00:00:22.769 --> 00:00:23.890
Hello, everyone.
00:00:23.890 --> 00:00:31.890
Thank you for joining us at the Community IT webinar, Securing Google Workspace for Nonprofits with Steve Longenecker.
00:00:32.369 --> 00:00:37.329
Google Workspace is one of the most widely used platforms in the nonprofit sector.
00:00:37.329 --> 00:00:42.769
And the free nonprofit tier gives organizations a really powerful set of tools.
00:00:42.769 --> 00:00:44.609
But how secure is it?
00:00:44.609 --> 00:01:04.530
Steve is going to walk through the security settings and practices that are available to nonprofits in the free Google Workspace tier and share guidance on when it makes sense to consider upgrading to a paid tier for more advanced security features or using some third-party tools depending on your nonprofit's risk profile.
00:01:04.769 --> 00:01:06.450
My name is Carolyn Woodard.
00:01:06.450 --> 00:01:10.049
I am the outreach director for community IT and the moderator today.
00:01:10.049 --> 00:01:15.170
I'm very happy to hear from our expert, but first I want to go over our learning objectives.
00:01:15.170 --> 00:01:16.370
So
00:01:16.370 --> 00:01:19.090
Today we're going to focus on these themes.
00:01:19.090 --> 00:01:23.489
So is Google Workspace inherently secure or insecure?
00:01:23.489 --> 00:01:30.609
What is Google Workspace's Workspace's nonprofit tier and what securities does that include?
00:01:30.609 --> 00:01:34.530
What are the biggest risks nonprofits face in Google Workspace?
00:01:34.530 --> 00:01:37.969
And what actions can you take now to reduce those risks?
00:01:37.969 --> 00:01:41.009
And when should you look beyond the nonprofit tier?
00:01:41.009 --> 00:01:43.009
And what should be your first steps?
00:01:43.009 --> 00:01:46.530
And now I would like to let Steve introduce himself.
00:01:47.409 --> 00:01:52.689
Hi, I'm Steve Longenecker and I'm the director of IT Consulting at Community IT.
00:01:52.689 --> 00:01:56.769
I am coming to you from sunny, beautiful Washington, D.C.
00:01:56.769 --> 00:01:58.049
Today.
00:01:58.049 --> 00:02:04.769
I'm a longtime resident of Washington, D.C., which is, I guess, Community IT's hometown.
00:02:04.769 --> 00:02:13.090
But I am a Google Workspace - I can't remember what they changed the name of the certification when I recertified.
00:02:13.090 --> 00:02:17.090
I'm not sure it's called engineer anymore, but I'm a workspace administrator or something.
00:02:17.170 --> 00:02:19.650
I'm a certified Google Workspace Administrator.
00:02:19.650 --> 00:02:27.569
And um and I've been working with our clients that have Google um as their as their primary uh productivity platform for a long time.
00:02:27.569 --> 00:02:29.810
So I'm looking forward to having this discussion with everyone.
00:02:30.289 --> 00:02:39.650
I'm so glad that you're with us, Steve, because I know in our office when we have Google questions, you're one of our um great fountains of wisdom.
00:02:39.650 --> 00:02:47.810
So very happy to hear what the best practices are for security on Google Workspace, because I think that is a question that people ask a lot.
00:02:47.810 --> 00:02:48.210
Um,
00:02:48.210 --> 00:02:52.849
Before we begin, if you're not familiar with community IT, I'm going to tell you a little bit more about us.
00:02:52.849 --> 00:02:57.250
We are a 100% employee-owned managed services provider.
00:02:57.250 --> 00:03:02.449
We provide outsourced IT support and we work exclusively with nonprofit organizations.
00:03:02.449 --> 00:03:08.129
Our mission is to help nonprofits accomplish their missions through the effective use of technology.
00:03:08.129 --> 00:03:12.449
We are big fans of what well-managed IT can do for your nonprofit.
00:03:12.609 --> 00:03:17.409
We serve nonprofits across the United States, although we did start in DC, as Steve said.
00:03:17.409 --> 00:03:19.409
We've been doing this for 25 years.
00:03:19.409 --> 00:03:21.810
It's our 25th anniversary this year.
00:03:22.049 --> 00:03:30.930
We are technology experts and are consistently given the MSP 501 recognition for being a top MSP, which is an honor I can announce.
00:03:30.930 --> 00:03:34.370
We just received again last week for 2026.
00:03:34.370 --> 00:03:39.490
So we don't have the logo yet that says 2026 on it, but we did, we're on the list again.
00:03:39.490 --> 00:03:45.169
And we believe that we're one of the only MSPs on the list that serves nonprofits exclusively.
00:03:45.169 --> 00:03:45.650
So
00:03:45.650 --> 00:03:50.769
I want to remind everyone that for the sake of these presentations, we're vendor agnostic.
00:03:50.769 --> 00:03:55.490
We only make recommendations to our clients and only based on their specific business needs.
00:03:55.490 --> 00:04:01.889
And we never try to get a client into a product because we get an incentive or a benefit from that.
00:04:01.889 --> 00:04:05.409
We do consider ourselves a best of breed IT provider.
00:04:05.409 --> 00:04:11.409
So it's our job to know the landscapes, the tools that are available, reputable, and widely used.
00:04:11.409 --> 00:04:18.530
And we make recommendations on that basis for our clients based on their business needs, their priorities, and their budget.
00:04:18.930 --> 00:04:21.329
We did get a lot of good questions at registration.
00:04:21.329 --> 00:04:23.889
So we're going to try and answer as many as we can today.
00:04:23.889 --> 00:04:25.170
We only have an hour.
00:04:25.170 --> 00:04:35.410
So anything we can't get to, please join us and Steve today after the webinar on our Reddit channel at r slash nonprofit IT Management.
00:04:35.410 --> 00:04:39.889
We're going to continue answering some questions over there for about 30 minutes after this webinar.
00:04:39.889 --> 00:04:49.089
And then if you have more questions that didn't come up or didn't think about them, just pop them in that thread and we'll be checking in for the next couple of weeks to see what we can answer.
00:04:49.329 --> 00:04:50.449
A little bit more about us.
00:04:50.449 --> 00:04:54.850
Our mission is to create value for the nonprofit sector through well-managed IT.
00:04:54.850 --> 00:05:03.329
We also identify four key values as employee owners that define our company: trust, knowledge, service, and balance.
00:05:03.329 --> 00:05:20.370
We seek always to treat people with respect and fairness, to empower our staff, clients, and sector to understand and use technology effectively, to be helpful with our talents, and we recognize that the health of our communities is vital to our well-being and that work is only a part of our lives.
00:05:21.490 --> 00:05:25.649
So now we are going to jump into our first poll.
00:05:25.649 --> 00:05:26.610
All right.
00:05:26.610 --> 00:05:29.969
So the first poll is attention.
00:05:29.969 --> 00:05:34.610
How much attention does IT security get at your organization?
00:05:34.610 --> 00:05:37.730
And your answers, possible answers, are too much.
00:05:37.730 --> 00:05:42.449
It makes it hard to do our jobs, and we have to log in every time we want to do something else.
00:05:42.449 --> 00:05:44.529
Number two is just right.
00:05:44.529 --> 00:05:48.689
My organization takes security seriously and our actions show it.
00:05:48.689 --> 00:05:50.689
Number three is not enough.
00:05:50.689 --> 00:05:54.370
We say it is important, but I worry we have holes in our approach.
00:05:54.370 --> 00:05:57.730
And number four is none, and that scares me.
00:05:57.730 --> 00:06:00.449
And number five is not applicable.
00:06:00.689 --> 00:06:06.129
And you are anonymous in this poll, so um you can feel free to be honest.
00:06:06.129 --> 00:06:11.810
And if you're here because you are concerned about cybersecurity, you're in the right place.
00:06:11.810 --> 00:06:12.689
And
00:06:12.689 --> 00:06:14.129
Steve, can you see that?
00:06:14.449 --> 00:06:15.009
I can.
00:06:15.329 --> 00:06:15.649
All right.
00:06:15.649 --> 00:06:17.969
Could you let us know what the answers were?
00:06:18.370 --> 00:06:19.649
Yes, I will do that.
00:06:19.649 --> 00:06:30.930
So uh uh we had 40 people uh voting, um, and just two, five percent um uh chose that too much um option.
00:06:30.930 --> 00:06:36.529
I did want to put that on there because I do think it is possible to give too much attention to security.
00:06:36.529 --> 00:06:42.370
So uh it it can happen for sure, where it just gets it just makes it impossible.
00:06:42.370 --> 00:06:47.490
But I'm I'm really pleased that we had um a good third of the people saying just write.
00:06:47.490 --> 00:06:49.170
Um that's wonderful.
00:06:49.170 --> 00:06:54.850
And then uh about half were were concerned that um not enough is being done.
00:06:54.850 --> 00:06:57.810
Maybe, maybe it's uh a good game is being talked.
00:06:57.810 --> 00:07:02.610
And then uh five people said none at all.
00:07:02.610 --> 00:07:04.610
And that obviously scares them.
00:07:04.930 --> 00:07:05.730
Yeah, yeah.
00:07:05.730 --> 00:07:15.569
And I think that's one of the things that we run into with Google Workspace is that you can set it up yourself and then you're not sure what you have done for security.
00:07:15.569 --> 00:07:17.409
So um again, no shame.
00:07:17.409 --> 00:07:27.170
Like if that's you, you're in that um boat, you've come to the right place, and we have a ton of cybersecurity resources on our website as well, which I will share in the chat later.
00:07:27.329 --> 00:07:29.810
But right now we're gonna hand it over to Steve.
00:07:29.810 --> 00:07:31.889
You're gonna talk a little bit about that first question.
00:07:31.889 --> 00:07:35.409
Is Google Workspace secure or unsecure?
00:07:35.810 --> 00:07:36.370
Yeah.
00:07:36.370 --> 00:07:46.610
Um, and I think it is important to start with the fact that I would say Google Workspace, the platform, as far as it goes, is very secure.
00:07:46.610 --> 00:07:48.850
Google spends a lot of money on that.
00:07:48.850 --> 00:07:52.209
They make sure that their data centers are secure.
00:07:52.209 --> 00:07:54.930
Um, there's encryption in transit and at rest.
00:07:54.930 --> 00:07:56.769
They have great uptime.
00:07:56.769 --> 00:08:06.689
Compared to like back in the day when you might have had uh a Microsoft small business server in a nonprofit's IT closet, uh, this is a lot better now.
00:08:06.689 --> 00:08:16.370
There's just a lot less chance of things going dramatically wrong, which is what security is really all about than there used to be.
00:08:16.769 --> 00:08:50.290
That said, I will say that Google is a little different than Microsoft in that, at least for people who are running in Windows, um, Windows is part of the Microsoft uh family, like that Microsoft makes Windows, they make Microsoft 365, um, and they are sort of Microsoft sort of specializes in having this stack where everything from identity to file security to email security to device device security is sort of covered in one integrated place.
00:08:50.290 --> 00:08:57.409
And that that can be very helpful, particularly for smaller nonprofits that can't invest in sort of a best of breed approach.
00:08:57.409 --> 00:08:57.970
Um,
00:08:57.970 --> 00:09:04.289
Google is, I think, quite secure when it comes to email files, the things that are in Google Workspace.
00:09:04.289 --> 00:09:19.889
And it's not that you can't do any device management in Google Workspace, but we don't really see it that often, um, unless it unless we're talking about managing Chromebooks, in which case, uh, Google is very strong at managing Chromebooks in Google Workspace, and uh that's a very secure solution often.
00:09:20.210 --> 00:09:29.970
But the other thing about Google Workspace Security is that even though Google does a good job of like making its platform secure, it is a partnership.
00:09:29.970 --> 00:09:37.730
And so that's where we sometimes see insecurities emerge in is on the is on the other side, the the customer side.
00:09:37.730 --> 00:09:52.929
If you're not enforcing good password policies, if you're not um doing your part uh with configurations and so on, which is what this whole you know webinar is about, then uh it's not gonna be secure.
00:09:53.330 --> 00:10:02.370
So actually, there's this analogy that I have in my notes, I should say, you know, think of it as like Google providing a very secure building, but they don't get to control the key.
00:10:02.370 --> 00:10:06.850
The key they give the key to you, and it's you that are like in charge of the key.
00:10:06.850 --> 00:10:10.769
And if you're opening the door for strangers, that's a problem.
00:10:11.490 --> 00:10:14.049
Yeah, what is Google going to be able to do about it?
00:10:14.049 --> 00:10:15.330
Exactly.
00:10:15.330 --> 00:10:32.129
Um, so we wanted to show um this nonprofit tier, and um, I'm hopeful that everyone on the webinar like knows that there's uh nonprofits sign up for Google Workspace and there's you know special pricing and all of the discount there.
00:10:32.129 --> 00:10:33.090
Um and
00:10:33.090 --> 00:10:44.370
Steve, we were gonna just kind of briefly - I was surprised, not knowing very much about it, how many security features are included in that nonprofit tier.
00:10:44.769 --> 00:10:45.090
Yeah.
00:10:45.090 --> 00:10:49.169
The nonprofit tier is really exceptionally generous.
00:10:49.169 --> 00:10:59.889
Um, and it's a reason that I think a lot of of especially uh newer and and um smaller nonprofits start out in Google.
00:10:59.889 --> 00:11:01.409
It's pretty easy to set up.
00:11:01.409 --> 00:11:05.730
They make a lot of the tooling um pretty intuitive.
00:11:05.730 --> 00:11:11.250
They have really great and and sort of easy to understand documentation for administrators.
00:11:11.250 --> 00:11:16.129
And yeah, it's a it's a solid and and it's the nonprofit tier is free.
00:11:16.129 --> 00:11:26.450
You know, it's not like discounted, it's free, which is it's just an amazing um option that uh we, you know, we appreciate.
00:11:26.450 --> 00:11:28.289
Um, so yeah, this slide,
00:11:28.289 --> 00:11:37.889
I'm not gonna read all the different things, but like the number of things that Google includes in that free tier is is uh really impressive.
00:11:37.889 --> 00:11:46.129
And as we'll talk about later, um some of the things that I would say are the next layers that you need, probably you wouldn't pay Google for.
00:11:46.129 --> 00:11:48.929
They'd be more third-party um layers.
00:11:48.929 --> 00:11:50.370
And we'll we'll talk about that.
00:11:50.370 --> 00:11:53.409
But it is a nice collection of things.
00:11:53.570 --> 00:11:55.570
Now, there is is everything included?
00:11:55.570 --> 00:11:59.090
No, but that's kind of the way all of these platforms work.
00:11:59.090 --> 00:12:06.529
You know, they tend to have tiers and they want, they want, they're happy to move you up up the the chain for more functionality.
00:12:06.850 --> 00:12:11.169
Yeah, but it's good to know that at that nonprofit level, you you get a lot.
00:12:11.169 --> 00:12:11.809
Um,
00:12:11.809 --> 00:12:15.409
I want to move on and um talk a little bit more about definitions.
00:12:15.409 --> 00:12:21.809
So um, we find a lot of people, I myself am not like very technology oriented.
00:12:21.809 --> 00:12:27.649
And so when you're dealing with technology at your nonprofit, you may feel like you don't know the lingo.
00:12:27.649 --> 00:12:32.529
You might be dealing with an IT provider who uses a lot of lingo without explaining it.
00:12:32.529 --> 00:12:36.850
Um, we wanted to go over some common terms and demystify what we can.
00:12:37.090 --> 00:12:41.730
We don't have time to go over everything that's on this slide, but I'm gonna put it all in the transcript.
00:12:41.730 --> 00:12:54.210
So you'll get a link that links back to the transcript, and we'll put the little, you know, definitions in under these other cybersecurity terminology that you might uh not know totally.
00:12:54.210 --> 00:12:55.809
Um so, but
00:12:55.809 --> 00:13:02.850
I wanted to talk about a few at the top because, like especially this top one, the MFA and 2SV, that confuses me.
00:13:02.850 --> 00:13:05.330
So, Steve, could you talk a little bit about that?
00:13:05.809 --> 00:13:06.049
Sure.
00:13:06.049 --> 00:13:11.889
And I appreciate Carolyn that you've started adding this definition slide to these to these decks.
00:13:11.889 --> 00:13:15.730
Um I've been doing these webinars uh with you and even before you for a long time.
00:13:15.730 --> 00:13:25.889
And I think it's a really nice addition to the template, if you will, because yeah, I think we I forget as someone who's deep and deeply immersed in this stuff sometimes that definitions help.
00:13:26.049 --> 00:13:36.289
So MFA, which stands for multi-factor authentication, is the idea that um uh in addition to maybe your password, you are doing something else.
00:13:36.289 --> 00:13:40.289
That's where the multi comes from, doing something else to confirm your identity.
00:13:40.289 --> 00:13:50.929
And most typically, you might be using your phone, which you've registered ahead of time with the system to like approve your login on your phone.
00:13:51.090 --> 00:13:58.129
Some the other things that we see sometimes are these little uh FIDO keys, they're called, or YubiKey is the main brand.
00:13:58.129 --> 00:14:06.289
It's an actual physical key that you plug into the USB port on your computer or or or your phone, and it's like another, like you push that button.
00:14:06.289 --> 00:14:12.450
And since that that key is registered ahead of time, you can't get in with just your password.
00:14:12.450 --> 00:14:14.929
You have to have this second factor to get in.
00:14:15.009 --> 00:14:29.490
And it really has cut down on account breaches because passwords with computers are pretty easy to like, not pretty easy, but they are they are hackable because there's, you know, even if it's a 10-character password, you can just try all the different passwords with a computer program and get in.
00:14:29.490 --> 00:14:35.169
Or use people tend sometimes use easy to guess passwords, or they reuse passwords.
00:14:35.169 --> 00:14:38.610
So this multi-factor authentication helps a lot.
00:14:38.929 --> 00:14:41.090
2SV is just Google's language for that.
00:14:41.090 --> 00:14:43.570
So it stands for two-step verification.
00:14:43.570 --> 00:14:45.970
It is literally MFA with a different name.
00:14:45.970 --> 00:14:55.490
And I'm not quite sure why Google went its own way and didn't want to just call it MFA like everything else, every other uh platform provider has called it.
00:14:55.490 --> 00:15:05.730
But when you see 2SV, that just isn't to me an indication that you're dealing with Google and they're just using their term for MFA or multi-factor authentication.
00:15:05.970 --> 00:15:07.570
I'll go through the other ones real quick.
00:15:07.570 --> 00:15:16.370
Spoofing is a place where people can be vulnerable to uh security attacks.
00:15:16.370 --> 00:15:22.769
It's when an email uh appears to come from someone that it's not coming from, right?
00:15:22.769 --> 00:15:24.210
That could be internal.
00:15:24.210 --> 00:15:28.610
Uh I I get emails that appear to be from my my boss Johanny.
00:15:28.610 --> 00:15:32.450
It has her name, it has her email address, but it is not from her.
00:15:32.450 --> 00:15:39.490
And if I click on the links in that, I'm probably going to be leading to bad outcomes because someone is spoofing her account.
00:15:39.649 --> 00:15:45.330
There are things that we that you can do configuration-wise to reduce the likelihood of that.
00:15:45.330 --> 00:15:54.049
Um, one of the places that that can be done is using the next uh term here for for uh definitions, which is DNS.
00:15:54.289 --> 00:15:57.649
DNS is the it's a very old protocol.
00:15:57.649 --> 00:16:07.649
It's the internet's uh way of like resolving um friendly names to IP addresses, to names that machines understand.
00:16:07.649 --> 00:16:23.090
So when you go to www.communityit.com, you're going to a friendly name, but the the domain name server, uh the DNS servers out on the internet need to know that wwwcommunityit.com goes to this specific server with this specific address.
00:16:23.330 --> 00:16:42.769
That that system's been expanded to have all sorts of rules that are because because it's a place where an organization can sort of publish some stuff about their systems that is considered authoritative and and um safe.
00:16:43.009 --> 00:17:00.049
So if in my DNS records, I say the only people that are allowed to send email from um the domain name communityid.com are Microsoft 365 and uh MailChimp.
00:17:00.049 --> 00:17:04.610
Those are the only two systems that are allowed to send that, or from Google and MailChimp.
00:17:04.610 --> 00:17:09.250
And the and the email from Google needs to be secured with this encryption key.
00:17:09.250 --> 00:17:15.809
You know, those things can be done with DNS, and that is what's used now to reduce that spoofing.
00:17:15.809 --> 00:17:16.769
So that's it.
00:17:16.930 --> 00:17:17.570
So it protects you.
00:17:17.570 --> 00:17:18.289
You can set it up.
00:17:18.289 --> 00:17:19.009
It protects you
00:17:19.009 --> 00:17:19.410
To protect you.
00:17:19.410 --> 00:17:20.370
Yeah, yeah.
00:17:20.610 --> 00:17:25.970
And email is one is still remains one of the vectors, which, of course, Google Workspace has email.
00:17:25.970 --> 00:17:32.770
So it remains one of the vectors by which a lot of we see a lot of attacks and breaches because it is such an old protocol.
00:17:32.770 --> 00:17:35.730
Email has been around for 50 years.
00:17:35.730 --> 00:17:42.850
And um and so as a result of that, it's vulnerable to to new fangled things.
00:17:42.850 --> 00:17:47.170
And so some of these DNS fixes are like responses to that.
00:17:47.170 --> 00:17:48.690
Okay, I got to speed things up.
00:17:48.850 --> 00:17:54.290
Admin console, that's just the term for the um web page that you log into.
00:17:54.290 --> 00:17:56.770
It's at admin.google.com.
00:17:56.770 --> 00:18:02.610
Everybody has the same address, but once you log in it, they take you to your admin console.
00:18:02.610 --> 00:18:05.090
And it's where you configure the settings.
00:18:05.090 --> 00:18:12.690
Uh, it's also where you uh set up new users or get rid of our offboard old users, set up Google Shared Drives.
00:18:12.690 --> 00:18:18.690
All the things that you do in Google Workspace are done in the admin console as far as administration goes in the admin console.
00:18:18.690 --> 00:18:19.090
Um,
00:18:19.090 --> 00:18:23.650
Google Shared Drives are uh repositories for documents.
00:18:23.650 --> 00:18:39.810
Um traditionally, not traditionally, in the at the beginning of time when Google first sort of ran rolled out their suite of services with email and so forth, they just used what what I now call MyDrives, where each person had their own drive.
00:18:39.810 --> 00:18:46.930
And if they wanted to share folders with other people or documents with other people to collaborate, they would do that from their My Drive.
00:18:47.090 --> 00:18:51.490
And some years later, at some point, Google rolled out these shared drives.
00:18:51.490 --> 00:19:00.850
And shared drives are much, much more organizational owned and less owned by individuals.
00:19:00.850 --> 00:19:07.090
And so there's more opportunities for good governance and structure and security.
00:19:07.250 --> 00:19:18.050
And so we talk about Google Shared Drives in the context of security because it's it's basically a richer, better way of uh collaborating and storing documents in Google Workspace.
00:19:18.130 --> 00:19:19.970
And then finally, user account offboarding.
00:19:19.970 --> 00:19:32.850
User is uh active in your organization, they're a staff person, they've been working for you for a few years, then they they leave uh the job, they get another job, or whatever, that they're no longer working for you.
00:19:32.850 --> 00:19:39.330
How do you unwind their presence in your Google workspace?
00:19:39.330 --> 00:19:41.090
That's called user account offboarding.
00:19:41.090 --> 00:19:51.410
And then that that is a process that is a weak spot in a lot of workspace administration, and as a result, it is a place where security is sometimes compromised.
00:19:51.810 --> 00:20:05.010
The offboarding might apply to volunteers as well if you give them an email for your organization, and then you're not keeping track of who's not volunteering for you anymore, then they have you know this account that's still open.
00:20:05.010 --> 00:20:07.410
So it's important to keep track of.
00:20:07.570 --> 00:20:12.210
So, what are the biggest risks specific to Google Workspace at nonprofits?
00:20:12.210 --> 00:20:22.530
Because some of those, you know, like not offboarding a staff person who may be disgruntled, like that could happen in any platform, but specific to Google Workspace, um, what are we looking at?
00:20:22.930 --> 00:20:31.410
Yeah, so to the point of the offboarding, I think it's more just that's the last one on the on the list here, but I'll I will, since you just brought it up, I'll bring it up.
00:20:31.650 --> 00:20:45.810
I think people know that if they're if they're firing a disgruntled employee, that they're going to do whether they have a formal procedure that they follow rigorously or not, they're going to reset the password, maybe suspend the user.
00:20:45.970 --> 00:20:51.170
Google is complicated by the fact that if you suspend the user, their email stops working.
00:20:51.170 --> 00:21:00.130
So it's not good in some ways, Google's processes don't make offboarding as easy as some other platforms might, because you want to suspend the user because that makes sense, right?
00:21:00.130 --> 00:21:03.810
But then all of a sudden, you might want them to still be able to receive email.
00:21:03.810 --> 00:21:10.050
You just want that email to like be read by somebody else in your organization, not obviously by the person who's no longer there.
00:21:10.050 --> 00:21:12.210
But the email address might still be valuable.
00:21:12.210 --> 00:21:17.490
Like if it's, you know, someone who's still that email address is still getting, let's say they're a program manager.
00:21:17.490 --> 00:21:20.610
They might still be getting emails from your external stakeholders.
00:21:20.610 --> 00:21:22.610
You just need their manager to read the emails.
00:21:22.610 --> 00:21:26.450
And that that can all be done, but that's what the offboarding procedure is about.
00:21:26.450 --> 00:21:26.930
No,
00:21:26.930 --> 00:21:30.690
I think the risk is more not I'm firing a disgruntled employee.
00:21:30.690 --> 00:21:34.690
The problem is we don't have a great policy for offboarding users.
00:21:34.690 --> 00:21:41.810
And so we have all these user accounts, and we don't know what the passwords are anymore.
00:21:41.810 --> 00:21:48.930
And so it's just an opportunity for someone to like try to wheedle their way in through some sort of dictionary attack or something.
00:21:48.930 --> 00:21:49.410
Um,
00:21:49.410 --> 00:22:02.610
It might not be the highest risk thing if you have good MFA, 2 SV in Google's case, enforcement and so on, but it's still like would be it is you want to part of security is reducing your threat landscape as much as possible.
00:22:02.770 --> 00:22:07.170
So anytime you have unused accounts just lying around, that's an opportunity.
00:22:07.170 --> 00:22:11.090
It may not be a likely opportunity, but you want to try to reduce that.
00:22:11.570 --> 00:22:20.530
The first one on the list is not specific to Google, but it is definitely worth putting on any list when you're talking about the biggest risks, um, which is just phishing and credential theft.
00:22:20.530 --> 00:22:21.890
So, yeah, maybe the title.
00:22:21.890 --> 00:22:26.610
Of the slide could have just been biggest risks to Google Workspace at nonprofits.
00:22:26.610 --> 00:22:29.730
It is a big risk, but it's not specific to Google Workspace.
00:22:29.890 --> 00:22:41.330
Then, also not specific to Google Workspace, but true for Google Workspace users, you definitely want to have that 2SV system set up, configured, and you want to have it enforced.
00:22:41.490 --> 00:22:46.930
One of the areas that that can be tricky is I'm bouncing around and I apologize for that.
00:22:46.930 --> 00:23:01.650
But the second to last one on this list, shared and generic accounts, that's where 2SV sometimes runs aground because it's very clear if I'm logging in as me that I'm the only one who should be able to, on my phone, say yes, that's me, let me in.
00:23:01.650 --> 00:23:14.530
But if I'm also sharing an account called info at or um donations at or whatever, then um maybe there's four of us sharing that password.
00:23:14.530 --> 00:23:17.330
And how do we do the 2SV for that?
00:23:17.330 --> 00:23:21.010
Because all four of us need to have it set up on our phones.
00:23:21.010 --> 00:23:24.370
It's not that it's impossible to do, but it's very unwieldy.
00:23:24.530 --> 00:23:33.010
So we help our clients work around those things by using um like Google groups for like those kinds of email addresses.
00:23:33.010 --> 00:23:49.410
So you don't have a user account called donations at nonprofit.org, but instead you might have a Google group called donations at Google at nonprofit.org and use configure it, and then the members of that group can read those emails and respond to them.
00:23:49.410 --> 00:23:50.130
Um, but
00:23:50.130 --> 00:24:15.570
Shared and generic accounts can be problems because when there's a one-to-one correspondence, this human being has this user account, it's very easy to sort of keep the security and they quickly notice if somebody, if they, if their account's doing weird things, they're going to raise their hand and say, hey, I don't know why, but like, you know, all my friends say that I'm getting that I'm emailing them.
00:24:15.570 --> 00:24:17.010
I'm not emailing them, what's going on?
00:24:17.010 --> 00:24:19.650
And then so we investigate and we solve that problem.
00:24:19.810 --> 00:24:30.450
But if it's a generic account that people only log into occasionally and someone gets into that somehow, then maybe no one even notices for a week or two, you know, because it's not managed very well.
00:24:30.450 --> 00:24:32.690
And then the, yeah, the 2SV and so on.
00:24:33.010 --> 00:24:38.370
Wire fraud and business email compromise is sort of uh part of that phishing credential theft.
00:24:38.370 --> 00:24:40.290
It's actually kind of of the same idea.
00:24:40.290 --> 00:24:52.770
But we do see that is one of the things that we still see is is that at and I think it has to do with in many ways, it's not specific to Google Workspace, but it might be specific to nonprofits.
00:24:52.770 --> 00:25:07.810
Nonprofits frequently have um I don't want to say this in a in a way that's insulting to anybody, but like maybe looser like processes for handling money sometimes.
00:25:07.810 --> 00:25:09.010
It might be more informal.
00:25:09.010 --> 00:25:25.890
So, like for an executive director to say to someone, hey, I need to take care of this situation because this donor is asking for it, that might be more likely to happen at a small nonprofit than it might be to happen at a bank, where there's very rigorous like processes that everybody knows to go through.
00:25:25.970 --> 00:25:46.050
And so we have seen wire fraud, um, and that's a generic term for like banking, you know, like talking, you know, or or buying what are the gift cards, you know, those kinds of things happen and we and we see that a fair amount, um, less than we used to because people are getting more sophisticated about it, but it still happens.
00:25:46.290 --> 00:25:48.130
And then this Google Drive files.
00:25:48.130 --> 00:25:50.050
So this goes back to the shared drives.
00:25:50.050 --> 00:25:59.010
It's good to use shared drives, but it is also important when you use shared drives that you structure the and the configuration uh appropriately.
00:25:59.010 --> 00:26:02.690
Do you want to allow external sharing from that particular Google Drive?
00:26:02.690 --> 00:26:05.010
Um, who are the members of it?
00:26:05.010 --> 00:26:07.170
Um, all of those kinds of things.
00:26:07.170 --> 00:26:14.210
Oh, and then the last one, sorry, I'm man, and I'm I'm running out of your, I'm I'm getting off your schedule, Carolyn.
00:26:14.210 --> 00:26:14.450
But
00:26:14.450 --> 00:26:23.730
The unmanaged personal accounts, that's not super common unless you have a relatively new account where maybe you weren't using Google Workspace before and now you are.
00:26:23.730 --> 00:26:39.810
Um, but people can sign up for um like Google Drive as a per as a as a regular consumer, as a person, not as a member of your enterprise, of your organization, and use their, you know, your organization's domain name, like their email address.
00:26:39.810 --> 00:26:41.730
And if you weren't in Google at the time.
00:26:41.730 --> 00:26:54.770
So so it is possible that there are personal, they're potentially Gmail accounts or Google accounts that are associated with your domain name, but they're not actually in your Google workspace.
00:26:54.770 --> 00:26:58.930
And there's a place in the in the admin portal where you can you can see who that list is.
00:26:58.930 --> 00:27:04.690
Oftentimes it's long ago, long-departed employees, and it's probably not a risk.
00:27:04.770 --> 00:27:11.170
Um from early on, maybe when you were setting it up, they had their own email like on your board when you were setting up.
00:27:11.490 --> 00:27:11.890
That's right.
00:27:11.890 --> 00:27:12.450
Um,
00:27:12.450 --> 00:27:20.050
I feel like I want to mention here that um if you need help doing some of the things in the admin portal, Google does have a knowledge base.
00:27:20.050 --> 00:27:22.290
You can look up questions of like, how do I find this?
00:27:22.290 --> 00:27:23.410
Where do I do that?
00:27:23.890 --> 00:27:37.330
Yeah, you know, and I always give Microsoft credit for like owning Windows and like Microsoft 365 and Microsoft Office, the desktop suite, you know, Word Excel, and how useful that is uh at for that world.
00:27:37.570 --> 00:27:40.050
One of the nice things about Google is they own Google.
00:27:40.050 --> 00:27:43.090
So Googling a question, actually, I don't know.
00:27:43.090 --> 00:27:47.890
I find that it works really well, and I like uh Google's knowledge base articles.
00:27:47.890 --> 00:27:48.930
We call them KBs.
00:27:48.930 --> 00:27:49.570
We
00:27:49.570 --> 00:27:59.170
I like their knowledge base articles more than I like Microsoft's for a um non X non-uh professional IT person.
00:27:59.170 --> 00:28:12.210
So if you're managing your IT um for your nonprofit and you and that's not your main job or it's not what you were trained in, but you're doing the best you can, I think you're gonna get good mileage out of Google's KBs.
00:28:12.210 --> 00:28:13.010
Um, and
00:28:13.010 --> 00:28:17.330
And you can be, in that case, I think, thankful that you're not doing the same thing in Microsoft.
00:28:17.330 --> 00:28:21.890
I think Microsoft is okay, but they tend to be more technical, harder to read.
00:28:21.890 --> 00:28:26.530
Uh you need to bring more background to it than you do to Google.
00:28:26.530 --> 00:28:32.530
Google is is a little bit more um uh uh try to keep things tries to keep things simple.
00:28:33.010 --> 00:28:35.170
It's very consumer oriented.
00:28:35.170 --> 00:28:35.810
Yeah.
00:28:35.810 --> 00:28:41.890
We have one quick question on can you transfer or forward a suspended account in Google Workspace to
00:28:41.890 --> 00:28:42.210
You can.
00:28:42.370 --> 00:28:45.330
So that's what I was talking about, how you can see those accounts.
00:28:45.330 --> 00:28:50.610
But the trick, not true, you can.
00:28:50.610 --> 00:28:52.290
Um you can, yes.
00:28:52.290 --> 00:28:55.570
For for the ones that are long, long, long departed.
00:28:55.570 --> 00:29:05.250
I don't know whether you need you might need to like um it might be tricky because that the email may or may not work, but yes, you can do that.
00:29:05.250 --> 00:29:07.170
Yes, yes, that's a short answer.
00:29:07.730 --> 00:29:08.050
Okay.
00:29:08.220 --> 00:29:11.170
Um, all right, we're gonna, yes, we're gonna move along a little bit.
00:29:11.170 --> 00:29:11.810
Um, so
00:29:11.810 --> 00:29:14.290
What can you do right now to protect your organization?
00:29:14.290 --> 00:29:15.490
First and next steps.
00:29:15.490 --> 00:29:17.330
I think we've talked a little bit about some of these.
00:29:17.330 --> 00:29:18.850
If you want to kind of run down.
00:29:19.410 --> 00:29:19.890
Yeah.
00:29:19.890 --> 00:29:23.090
So yes, let's just start with the easy one.
00:29:23.090 --> 00:29:25.570
Make sure that 2SV is turned on.
00:29:25.570 --> 00:29:36.450
Uh, and that's by default turned on, but it's not by default enforced, I don't think, for at least for older, older um workspace tenants that have been established for a while.
00:29:36.450 --> 00:29:38.050
So you need to turn it on.
00:29:38.050 --> 00:29:39.890
It's a little uh
00:29:39.890 --> 00:29:43.330
Google is a little is different from Microsoft in this regard.
00:29:43.330 --> 00:29:53.890
With Microsoft, you enable it or it's enabled, and you tell everybody to go ahead and get it set up and you warn them that you're going to be enforcing it on Friday, so everybody needs to get it done by Friday, yada, yada, yada.
00:29:53.890 --> 00:29:55.730
And then on Friday you enforce it.
00:29:55.730 --> 00:30:01.730
And the next time they try to log on, they can't get on until they set up MFA.
00:30:01.730 --> 00:30:04.290
So they're fine, they're forced to.
00:30:04.290 --> 00:30:15.970
And that is still a change management concern because if they're like logging on right before a meeting, that's a really important meeting, and now they are like losing five minutes because they're setting up MFA.
00:30:15.970 --> 00:30:17.650
So, you know, it's still a concern.
00:30:17.650 --> 00:30:18.050
But
00:30:18.050 --> 00:30:26.930
Google's much more challenging in terms of change management in that with Google, if you have not set it up and it gets enforced, you just can't log in.
00:30:26.930 --> 00:30:32.850
At that point, you need to open a ticket with the help desk or the the administrator, whoever that is.
00:30:32.850 --> 00:30:39.570
And they need to like work with you to to to, you know, because you can't, you need to do it ahead of time.
00:30:39.570 --> 00:30:41.170
But it should still be done.
00:30:41.170 --> 00:30:42.210
So it is important.
00:30:42.210 --> 00:30:44.050
It is possible to make exceptions.
00:30:44.050 --> 00:30:50.130
So if it just absolutely has to have an exception for a user account that can be done.
00:30:50.370 --> 00:30:54.610
But the the recommendation is that you enforce MFA or 2SV for everyone.
00:30:54.850 --> 00:31:02.690
Auditing account your accounts refers to sort of this offboarding and um and also like who has administrative privileges.
00:31:02.690 --> 00:31:14.690
We have seen um clients where it seemed like it was the easiest thing in the world was just to make almost everybody a super admin, or you know, or or you know, all the executive super admins.
00:31:14.690 --> 00:31:21.490
And that's that's a risk because if an if an account is breached, that person, you know, has too much power in that situation.
00:31:21.490 --> 00:31:23.890
So look at that, look at those, what the accounts are.
00:31:23.890 --> 00:31:28.770
Are there are there accounts that you can deprecate, um, so forth.
00:31:28.770 --> 00:31:29.330
Uh the
00:31:29.330 --> 00:31:52.690
Google Drive sharing settings is um, we talked about already, I won't, I won't go into it again, but there are settings for Google Drives, things like how who can share, what can, you know, who can who things can be shared to, um, whether other who the who the what there's yeah, anyway, you can you can you want to look at those things and then and use Google share drives.
00:31:52.690 --> 00:31:54.770
That is a I think a security concern.
00:31:54.770 --> 00:32:01.810
If you are just using my drives and sharing folders from my drives, that's really something that you want to, it's hard to correct.
00:32:01.810 --> 00:32:15.250
And we do have a blog post about how it's challenging to correct once it's once it's um out there already, but it's worth putting on your map on your map that we do want to get this corrected at some point and figure out um how to do that.
00:32:15.250 --> 00:32:17.170
So use Google Shared Drives.
00:32:17.170 --> 00:32:17.650
Um
00:32:17.650 --> 00:32:21.330
Login alerts are a nice touch that's available at the free tier.
00:32:21.330 --> 00:32:39.090
So if um uh if you do have super admins, you could have it set so that every time the super a super admin logs in, the other the other someone, you know, there's alerts being sent out to the other super admins or to the other um uh contacts for the account.
00:32:39.090 --> 00:32:40.770
Um that's helpful.
00:32:41.090 --> 00:32:45.330
Training staff is re that that is really helpful.
00:32:45.330 --> 00:33:00.450
Explaining how um phishing works and um helping people understand that email is a threat, that that uh chats and texts are a threat, you know, that this is not just email anymore.
00:33:00.450 --> 00:33:02.450
Those are all things that we can do.
00:33:02.450 --> 00:33:03.170
Um
00:33:03.170 --> 00:33:26.610
We talked about offboarding and we talked about the the DNS policy to reduce uh email spoofing, and I won't go into it now, but it's things like DMARC, DKIM, these are things that you can do just to so that you can't stop uh spoofing external if an external like an your staff are getting emails from other organizations, they might be spoofed.
00:33:26.610 --> 00:33:27.570
That you can't control.
00:33:27.570 --> 00:33:33.890
You can only control your own, but it's really good for your your own staff fooled by emails that appear to be from from within your organization.
00:33:33.890 --> 00:33:34.850
That's one thing.
00:33:34.850 --> 00:33:39.890
Also, not to have the reputational damage of not it's not a breach.
00:33:39.890 --> 00:33:52.690
No one's actually sending email from your from your Google workspace, but that appears to be from your Google workspace, and because you haven't done enough to turn up the dial on what the the spoofing protection is.
00:33:53.170 --> 00:33:55.490
Yeah, and I know I'm sorry, I was just looking for it quickly.
00:33:55.490 --> 00:34:01.570
I know we have a blog post on the DMARC and DKIM, but I'll have to find it and share it maybe in the transcript also.
00:34:01.570 --> 00:34:02.370
Um
00:34:02.370 --> 00:34:04.210
We have one more quick question.
00:34:04.210 --> 00:34:09.730
Uh, is it possible to disable downloading or printing documents in Google Workspace?
00:34:10.369 --> 00:34:13.170
Uh yes, I believe that it is.
00:34:13.170 --> 00:34:18.849
Um I don't know if it's possible at the free tier.
00:34:18.849 --> 00:34:20.449
I'm sorry they don't have that at my fingertips.
00:34:20.849 --> 00:34:24.849
We can provide, we'll we'll answer it over on um Reddit and we'll provide it in the transcript.
00:34:24.849 --> 00:34:26.530
We'll make sure we have that right answer.
00:00:22.769 --> 00:00:23.890
Hello, everyone.
00:00:23.890 --> 00:00:31.890
Thank you for joining us at the Community IT webinar, Securing Google Workspace for Nonprofits with Steve Longenecker.
00:00:32.369 --> 00:00:37.329
Google Workspace is one of the most widely used platforms in the nonprofit sector.
00:00:37.329 --> 00:00:42.769
And the free nonprofit tier gives organizations a really powerful set of tools.
00:00:42.769 --> 00:00:44.609
But how secure is it?
00:00:44.609 --> 00:01:04.530
Steve is going to walk through the security settings and practices that are available to nonprofits in the free Google Workspace tier and share guidance on when it makes sense to consider upgrading to a paid tier for more advanced security features or using some third-party tools depending on your nonprofit's risk profile.
00:01:04.769 --> 00:01:06.450
My name is Carolyn Woodard.
00:01:06.450 --> 00:01:10.049
I am the outreach director for community IT and the moderator today.
00:01:10.049 --> 00:01:15.170
I'm very happy to hear from our expert, but first I want to go over our learning objectives.
00:01:15.170 --> 00:01:16.370
So
00:01:16.370 --> 00:01:19.090
Today we're going to focus on these themes.
00:01:19.090 --> 00:01:23.489
So is Google Workspace inherently secure or insecure?
00:01:23.489 --> 00:01:30.609
What is Google Workspace's Workspace's nonprofit tier and what securities does that include?
00:01:30.609 --> 00:01:34.530
What are the biggest risks nonprofits face in Google Workspace?
00:01:34.530 --> 00:01:37.969
And what actions can you take now to reduce those risks?
00:01:37.969 --> 00:01:41.009
And when should you look beyond the nonprofit tier?
00:01:41.009 --> 00:01:43.009
And what should be your first steps?
00:01:43.009 --> 00:01:46.530
And now I would like to let Steve introduce himself.
00:01:47.409 --> 00:01:52.689
Hi, I'm Steve Longenecker and I'm the director of IT Consulting at Community IT.
00:01:52.689 --> 00:01:56.769
I am coming to you from sunny, beautiful Washington, D.C.
00:01:56.769 --> 00:01:58.049
Today.
00:01:58.049 --> 00:02:04.769
I'm a longtime resident of Washington, D.C., which is, I guess, Community IT's hometown.
00:02:04.769 --> 00:02:13.090
But I am a Google Workspace - I can't remember what they changed the name of the certification when I recertified.
00:02:13.090 --> 00:02:17.090
I'm not sure it's called engineer anymore, but I'm a workspace administrator or something.
00:02:17.170 --> 00:02:19.650
I'm a certified Google Workspace Administrator.
00:02:19.650 --> 00:02:27.569
And um and I've been working with our clients that have Google um as their as their primary uh productivity platform for a long time.
00:02:27.569 --> 00:02:29.810
So I'm looking forward to having this discussion with everyone.
00:02:30.289 --> 00:02:39.650
I'm so glad that you're with us, Steve, because I know in our office when we have Google questions, you're one of our um great fountains of wisdom.
00:02:39.650 --> 00:02:47.810
So very happy to hear what the best practices are for security on Google Workspace, because I think that is a question that people ask a lot.
00:02:47.810 --> 00:02:48.210
Um,
00:02:48.210 --> 00:02:52.849
Before we begin, if you're not familiar with community IT, I'm going to tell you a little bit more about us.
00:02:52.849 --> 00:02:57.250
We are a 100% employee-owned managed services provider.
00:02:57.250 --> 00:03:02.449
We provide outsourced IT support and we work exclusively with nonprofit organizations.
00:03:02.449 --> 00:03:08.129
Our mission is to help nonprofits accomplish their missions through the effective use of technology.
00:03:08.129 --> 00:03:12.449
We are big fans of what well-managed IT can do for your nonprofit.
00:03:12.609 --> 00:03:17.409
We serve nonprofits across the United States, although we did start in DC, as Steve said.
00:03:17.409 --> 00:03:19.409
We've been doing this for 25 years.
00:03:19.409 --> 00:03:21.810
It's our 25th anniversary this year.
00:03:22.049 --> 00:03:30.930
We are technology experts and are consistently given the MSP 501 recognition for being a top MSP, which is an honor I can announce.
00:03:30.930 --> 00:03:34.370
We just received again last week for 2026.
00:03:34.370 --> 00:03:39.490
So we don't have the logo yet that says 2026 on it, but we did, we're on the list again.
00:03:39.490 --> 00:03:45.169
And we believe that we're one of the only MSPs on the list that serves nonprofits exclusively.
00:03:45.169 --> 00:03:45.650
So
00:03:45.650 --> 00:03:50.769
I want to remind everyone that for the sake of these presentations, we're vendor agnostic.
00:03:50.769 --> 00:03:55.490
We only make recommendations to our clients and only based on their specific business needs.
00:03:55.490 --> 00:04:01.889
And we never try to get a client into a product because we get an incentive or a benefit from that.
00:04:01.889 --> 00:04:05.409
We do consider ourselves a best of breed IT provider.
00:04:05.409 --> 00:04:11.409
So it's our job to know the landscapes, the tools that are available, reputable, and widely used.
00:04:11.409 --> 00:04:18.530
And we make recommendations on that basis for our clients based on their business needs, their priorities, and their budget.
00:04:18.930 --> 00:04:21.329
We did get a lot of good questions at registration.
00:04:21.329 --> 00:04:23.889
So we're going to try and answer as many as we can today.
00:04:23.889 --> 00:04:25.170
We only have an hour.
00:04:25.170 --> 00:04:35.410
So anything we can't get to, please join us and Steve today after the webinar on our Reddit channel at r slash nonprofit IT Management.
00:04:35.410 --> 00:04:39.889
We're going to continue answering some questions over there for about 30 minutes after this webinar.
00:04:39.889 --> 00:04:49.089
And then if you have more questions that didn't come up or didn't think about them, just pop them in that thread and we'll be checking in for the next couple of weeks to see what we can answer.
00:04:49.329 --> 00:04:50.449
A little bit more about us.
00:04:50.449 --> 00:04:54.850
Our mission is to create value for the nonprofit sector through well-managed IT.
00:04:54.850 --> 00:05:03.329
We also identify four key values as employee owners that define our company: trust, knowledge, service, and balance.
00:05:03.329 --> 00:05:20.370
We seek always to treat people with respect and fairness, to empower our staff, clients, and sector to understand and use technology effectively, to be helpful with our talents, and we recognize that the health of our communities is vital to our well-being and that work is only a part of our lives.
00:05:21.490 --> 00:05:25.649
So now we are going to jump into our first poll.
00:05:25.649 --> 00:05:26.610
All right.
00:05:26.610 --> 00:05:29.969
So the first poll is attention.
00:05:29.969 --> 00:05:34.610
How much attention does IT security get at your organization?
00:05:34.610 --> 00:05:37.730
And your answers, possible answers, are too much.
00:05:37.730 --> 00:05:42.449
It makes it hard to do our jobs, and we have to log in every time we want to do something else.
00:05:42.449 --> 00:05:44.529
Number two is just right.
00:05:44.529 --> 00:05:48.689
My organization takes security seriously and our actions show it.
00:05:48.689 --> 00:05:50.689
Number three is not enough.
00:05:50.689 --> 00:05:54.370
We say it is important, but I worry we have holes in our approach.
00:05:54.370 --> 00:05:57.730
And number four is none, and that scares me.
00:05:57.730 --> 00:06:00.449
And number five is not applicable.
00:06:00.689 --> 00:06:06.129
And you are anonymous in this poll, so um you can feel free to be honest.
00:06:06.129 --> 00:06:11.810
And if you're here because you are concerned about cybersecurity, you're in the right place.
00:06:11.810 --> 00:06:12.689
And
00:06:12.689 --> 00:06:14.129
Steve, can you see that?
00:06:14.449 --> 00:06:15.009
I can.
00:06:15.329 --> 00:06:15.649
All right.
00:06:15.649 --> 00:06:17.969
Could you let us know what the answers were?
00:06:18.370 --> 00:06:19.649
Yes, I will do that.
00:06:19.649 --> 00:06:30.930
So uh uh we had 40 people uh voting, um, and just two, five percent um uh chose that too much um option.
00:06:30.930 --> 00:06:36.529
I did want to put that on there because I do think it is possible to give too much attention to security.
00:06:36.529 --> 00:06:42.370
So uh it it can happen for sure, where it just gets it just makes it impossible.
00:06:42.370 --> 00:06:47.490
But I'm I'm really pleased that we had um a good third of the people saying just write.
00:06:47.490 --> 00:06:49.170
Um that's wonderful.
00:06:49.170 --> 00:06:54.850
And then uh about half were were concerned that um not enough is being done.
00:06:54.850 --> 00:06:57.810
Maybe, maybe it's uh a good game is being talked.
00:06:57.810 --> 00:07:02.610
And then uh five people said none at all.
00:07:02.610 --> 00:07:04.610
And that obviously scares them.
00:07:04.930 --> 00:07:05.730
Yeah, yeah.
00:07:05.730 --> 00:07:15.569
And I think that's one of the things that we run into with Google Workspace is that you can set it up yourself and then you're not sure what you have done for security.
00:07:15.569 --> 00:07:17.409
So um again, no shame.
00:07:17.409 --> 00:07:27.170
Like if that's you, you're in that um boat, you've come to the right place, and we have a ton of cybersecurity resources on our website as well, which I will share in the chat later.
00:07:27.329 --> 00:07:29.810
But right now we're gonna hand it over to Steve.
00:07:29.810 --> 00:07:31.889
You're gonna talk a little bit about that first question.
00:07:31.889 --> 00:07:35.409
Is Google Workspace secure or unsecure?
00:07:35.810 --> 00:07:36.370
Yeah.
00:07:36.370 --> 00:07:46.610
Um, and I think it is important to start with the fact that I would say Google Workspace, the platform, as far as it goes, is very secure.
00:07:46.610 --> 00:07:48.850
Google spends a lot of money on that.
00:07:48.850 --> 00:07:52.209
They make sure that their data centers are secure.
00:07:52.209 --> 00:07:54.930
Um, there's encryption in transit and at rest.
00:07:54.930 --> 00:07:56.769
They have great uptime.
00:07:56.769 --> 00:08:06.689
Compared to like back in the day when you might have had uh a Microsoft small business server in a nonprofit's IT closet, uh, this is a lot better now.
00:08:06.689 --> 00:08:16.370
There's just a lot less chance of things going dramatically wrong, which is what security is really all about than there used to be.
00:08:16.769 --> 00:08:50.290
That said, I will say that Google is a little different than Microsoft in that, at least for people who are running in Windows, um, Windows is part of the Microsoft uh family, like that Microsoft makes Windows, they make Microsoft 365, um, and they are sort of Microsoft sort of specializes in having this stack where everything from identity to file security to email security to device device security is sort of covered in one integrated place.
00:08:50.290 --> 00:08:57.409
And that that can be very helpful, particularly for smaller nonprofits that can't invest in sort of a best of breed approach.
00:08:57.409 --> 00:08:57.970
Um,
00:08:57.970 --> 00:09:04.289
Google is, I think, quite secure when it comes to email files, the things that are in Google Workspace.
00:09:04.289 --> 00:09:19.889
And it's not that you can't do any device management in Google Workspace, but we don't really see it that often, um, unless it unless we're talking about managing Chromebooks, in which case, uh, Google is very strong at managing Chromebooks in Google Workspace, and uh that's a very secure solution often.
00:09:20.210 --> 00:09:29.970
But the other thing about Google Workspace Security is that even though Google does a good job of like making its platform secure, it is a partnership.
00:09:29.970 --> 00:09:37.730
And so that's where we sometimes see insecurities emerge in is on the is on the other side, the the customer side.
00:09:37.730 --> 00:09:52.929
If you're not enforcing good password policies, if you're not um doing your part uh with configurations and so on, which is what this whole you know webinar is about, then uh it's not gonna be secure.
00:09:53.330 --> 00:10:02.370
So actually, there's this analogy that I have in my notes, I should say, you know, think of it as like Google providing a very secure building, but they don't get to control the key.
00:10:02.370 --> 00:10:06.850
The key they give the key to you, and it's you that are like in charge of the key.
00:10:06.850 --> 00:10:10.769
And if you're opening the door for strangers, that's a problem.
00:10:11.490 --> 00:10:14.049
Yeah, what is Google going to be able to do about it?
00:10:14.049 --> 00:10:15.330
Exactly.
00:10:15.330 --> 00:10:32.129
Um, so we wanted to show um this nonprofit tier, and um, I'm hopeful that everyone on the webinar like knows that there's uh nonprofits sign up for Google Workspace and there's you know special pricing and all of the discount there.
00:10:32.129 --> 00:10:33.090
Um and
00:10:33.090 --> 00:10:44.370
Steve, we were gonna just kind of briefly - I was surprised, not knowing very much about it, how many security features are included in that nonprofit tier.
00:10:44.769 --> 00:10:45.090
Yeah.
00:10:45.090 --> 00:10:49.169
The nonprofit tier is really exceptionally generous.
00:10:49.169 --> 00:10:59.889
Um, and it's a reason that I think a lot of of especially uh newer and and um smaller nonprofits start out in Google.
00:10:59.889 --> 00:11:01.409
It's pretty easy to set up.
00:11:01.409 --> 00:11:05.730
They make a lot of the tooling um pretty intuitive.
00:11:05.730 --> 00:11:11.250
They have really great and and sort of easy to understand documentation for administrators.
00:11:11.250 --> 00:11:16.129
And yeah, it's a it's a solid and and it's the nonprofit tier is free.
00:11:16.129 --> 00:11:26.450
You know, it's not like discounted, it's free, which is it's just an amazing um option that uh we, you know, we appreciate.
00:11:26.450 --> 00:11:28.289
Um, so yeah, this slide,
00:11:28.289 --> 00:11:37.889
I'm not gonna read all the different things, but like the number of things that Google includes in that free tier is is uh really impressive.
00:11:37.889 --> 00:11:46.129
And as we'll talk about later, um some of the things that I would say are the next layers that you need, probably you wouldn't pay Google for.
00:11:46.129 --> 00:11:48.929
They'd be more third-party um layers.
00:11:48.929 --> 00:11:50.370
And we'll we'll talk about that.
00:11:50.370 --> 00:11:53.409
But it is a nice collection of things.
00:11:53.570 --> 00:11:55.570
Now, there is is everything included?
00:11:55.570 --> 00:11:59.090
No, but that's kind of the way all of these platforms work.
00:11:59.090 --> 00:12:06.529
You know, they tend to have tiers and they want, they want, they're happy to move you up up the the chain for more functionality.
00:12:06.850 --> 00:12:11.169
Yeah, but it's good to know that at that nonprofit level, you you get a lot.
00:12:11.169 --> 00:12:11.809
Um,
00:12:11.809 --> 00:12:15.409
I want to move on and um talk a little bit more about definitions.
00:12:15.409 --> 00:12:21.809
So um, we find a lot of people, I myself am not like very technology oriented.
00:12:21.809 --> 00:12:27.649
And so when you're dealing with technology at your nonprofit, you may feel like you don't know the lingo.
00:12:27.649 --> 00:12:32.529
You might be dealing with an IT provider who uses a lot of lingo without explaining it.
00:12:32.529 --> 00:12:36.850
Um, we wanted to go over some common terms and demystify what we can.
00:12:37.090 --> 00:12:41.730
We don't have time to go over everything that's on this slide, but I'm gonna put it all in the transcript.
00:12:41.730 --> 00:12:54.210
So you'll get a link that links back to the transcript, and we'll put the little, you know, definitions in under these other cybersecurity terminology that you might uh not know totally.
00:12:54.210 --> 00:12:55.809
Um so, but
00:12:55.809 --> 00:13:02.850
I wanted to talk about a few at the top because, like especially this top one, the MFA and 2SV, that confuses me.
00:13:02.850 --> 00:13:05.330
So, Steve, could you talk a little bit about that?
00:13:05.809 --> 00:13:06.049
Sure.
00:13:06.049 --> 00:13:11.889
And I appreciate Carolyn that you've started adding this definition slide to these to these decks.
00:13:11.889 --> 00:13:15.730
Um I've been doing these webinars uh with you and even before you for a long time.
00:13:15.730 --> 00:13:25.889
And I think it's a really nice addition to the template, if you will, because yeah, I think we I forget as someone who's deep and deeply immersed in this stuff sometimes that definitions help.
00:13:26.049 --> 00:13:36.289
So MFA, which stands for multi-factor authentication, is the idea that um uh in addition to maybe your password, you are doing something else.
00:13:36.289 --> 00:13:40.289
That's where the multi comes from, doing something else to confirm your identity.
00:13:40.289 --> 00:13:50.929
And most typically, you might be using your phone, which you've registered ahead of time with the system to like approve your login on your phone.
00:13:51.090 --> 00:13:58.129
Some the other things that we see sometimes are these little uh FIDO keys, they're called, or YubiKey is the main brand.
00:13:58.129 --> 00:14:06.289
It's an actual physical key that you plug into the USB port on your computer or or or your phone, and it's like another, like you push that button.
00:14:06.289 --> 00:14:12.450
And since that that key is registered ahead of time, you can't get in with just your password.
00:14:12.450 --> 00:14:14.929
You have to have this second factor to get in.
00:14:15.009 --> 00:14:29.490
And it really has cut down on account breaches because passwords with computers are pretty easy to like, not pretty easy, but they are they are hackable because there's, you know, even if it's a 10-character password, you can just try all the different passwords with a computer program and get in.
00:14:29.490 --> 00:14:35.169
Or use people tend sometimes use easy to guess passwords, or they reuse passwords.
00:14:35.169 --> 00:14:38.610
So this multi-factor authentication helps a lot.
00:14:38.929 --> 00:14:41.090
2SV is just Google's language for that.
00:14:41.090 --> 00:14:43.570
So it stands for two-step verification.
00:14:43.570 --> 00:14:45.970
It is literally MFA with a different name.
00:14:45.970 --> 00:14:55.490
And I'm not quite sure why Google went its own way and didn't want to just call it MFA like everything else, every other uh platform provider has called it.
00:14:55.490 --> 00:15:05.730
But when you see 2SV, that just isn't to me an indication that you're dealing with Google and they're just using their term for MFA or multi-factor authentication.
00:15:05.970 --> 00:15:07.570
I'll go through the other ones real quick.
00:15:07.570 --> 00:15:16.370
Spoofing is a place where people can be vulnerable to uh security attacks.
00:15:16.370 --> 00:15:22.769
It's when an email uh appears to come from someone that it's not coming from, right?
00:15:22.769 --> 00:15:24.210
That could be internal.
00:15:24.210 --> 00:15:28.610
Uh I I get emails that appear to be from my my boss Johanny.
00:15:28.610 --> 00:15:32.450
It has her name, it has her email address, but it is not from her.
00:15:32.450 --> 00:15:39.490
And if I click on the links in that, I'm probably going to be leading to bad outcomes because someone is spoofing her account.
00:15:39.649 --> 00:15:45.330
There are things that we that you can do configuration-wise to reduce the likelihood of that.
00:15:45.330 --> 00:15:54.049
Um, one of the places that that can be done is using the next uh term here for for uh definitions, which is DNS.
00:15:54.289 --> 00:15:57.649
DNS is the it's a very old protocol.
00:15:57.649 --> 00:16:07.649
It's the internet's uh way of like resolving um friendly names to IP addresses, to names that machines understand.
00:16:07.649 --> 00:16:23.090
So when you go to www.communityit.com, you're going to a friendly name, but the the domain name server, uh the DNS servers out on the internet need to know that wwwcommunityit.com goes to this specific server with this specific address.
00:16:23.330 --> 00:16:42.769
That that system's been expanded to have all sorts of rules that are because because it's a place where an organization can sort of publish some stuff about their systems that is considered authoritative and and um safe.
00:16:43.009 --> 00:17:00.049
So if in my DNS records, I say the only people that are allowed to send email from um the domain name communityid.com are Microsoft 365 and uh MailChimp.
00:17:00.049 --> 00:17:04.610
Those are the only two systems that are allowed to send that, or from Google and MailChimp.
00:17:04.610 --> 00:17:09.250
And the and the email from Google needs to be secured with this encryption key.
00:17:09.250 --> 00:17:15.809
You know, those things can be done with DNS, and that is what's used now to reduce that spoofing.
00:17:15.809 --> 00:17:16.769
So that's it.
00:17:16.930 --> 00:17:17.570
So it protects you.
00:17:17.570 --> 00:17:18.289
You can set it up.
00:17:18.289 --> 00:17:19.009
It protects you
00:17:19.009 --> 00:17:19.410
To protect you.
00:17:19.410 --> 00:17:20.370
Yeah, yeah.
00:17:20.610 --> 00:17:25.970
And email is one is still remains one of the vectors, which, of course, Google Workspace has email.
00:17:25.970 --> 00:17:32.770
So it remains one of the vectors by which a lot of we see a lot of attacks and breaches because it is such an old protocol.
00:17:32.770 --> 00:17:35.730
Email has been around for 50 years.
00:17:35.730 --> 00:17:42.850
And um and so as a result of that, it's vulnerable to to new fangled things.
00:17:42.850 --> 00:17:47.170
And so some of these DNS fixes are like responses to that.
00:17:47.170 --> 00:17:48.690
Okay, I got to speed things up.
00:17:48.850 --> 00:17:54.290
Admin console, that's just the term for the um web page that you log into.
00:17:54.290 --> 00:17:56.770
It's at admin.google.com.
00:17:56.770 --> 00:18:02.610
Everybody has the same address, but once you log in it, they take you to your admin console.
00:18:02.610 --> 00:18:05.090
And it's where you configure the settings.
00:18:05.090 --> 00:18:12.690
Uh, it's also where you uh set up new users or get rid of our offboard old users, set up Google Shared Drives.
00:18:12.690 --> 00:18:18.690
All the things that you do in Google Workspace are done in the admin console as far as administration goes in the admin console.
00:18:18.690 --> 00:18:19.090
Um,
00:18:19.090 --> 00:18:23.650
Google Shared Drives are uh repositories for documents.
00:18:23.650 --> 00:18:39.810
Um traditionally, not traditionally, in the at the beginning of time when Google first sort of ran rolled out their suite of services with email and so forth, they just used what what I now call MyDrives, where each person had their own drive.
00:18:39.810 --> 00:18:46.930
And if they wanted to share folders with other people or documents with other people to collaborate, they would do that from their My Drive.
00:18:47.090 --> 00:18:51.490
And some years later, at some point, Google rolled out these shared drives.
00:18:51.490 --> 00:19:00.850
And shared drives are much, much more organizational owned and less owned by individuals.
00:19:00.850 --> 00:19:07.090
And so there's more opportunities for good governance and structure and security.
00:19:07.250 --> 00:19:18.050
And so we talk about Google Shared Drives in the context of security because it's it's basically a richer, better way of uh collaborating and storing documents in Google Workspace.
00:19:18.130 --> 00:19:19.970
And then finally, user account offboarding.
00:19:19.970 --> 00:19:32.850
User is uh active in your organization, they're a staff person, they've been working for you for a few years, then they they leave uh the job, they get another job, or whatever, that they're no longer working for you.
00:19:32.850 --> 00:19:39.330
How do you unwind their presence in your Google workspace?
00:19:39.330 --> 00:19:41.090
That's called user account offboarding.
00:19:41.090 --> 00:19:51.410
And then that that is a process that is a weak spot in a lot of workspace administration, and as a result, it is a place where security is sometimes compromised.
00:19:51.810 --> 00:20:05.010
The offboarding might apply to volunteers as well if you give them an email for your organization, and then you're not keeping track of who's not volunteering for you anymore, then they have you know this account that's still open.
00:20:05.010 --> 00:20:07.410
So it's important to keep track of.
00:20:07.570 --> 00:20:12.210
So, what are the biggest risks specific to Google Workspace at nonprofits?
00:20:12.210 --> 00:20:22.530
Because some of those, you know, like not offboarding a staff person who may be disgruntled, like that could happen in any platform, but specific to Google Workspace, um, what are we looking at?
00:20:22.930 --> 00:20:31.410
Yeah, so to the point of the offboarding, I think it's more just that's the last one on the on the list here, but I'll I will, since you just brought it up, I'll bring it up.
00:20:31.650 --> 00:20:45.810
I think people know that if they're if they're firing a disgruntled employee, that they're going to do whether they have a formal procedure that they follow rigorously or not, they're going to reset the password, maybe suspend the user.
00:20:45.970 --> 00:20:51.170
Google is complicated by the fact that if you suspend the user, their email stops working.
00:20:51.170 --> 00:21:00.130
So it's not good in some ways, Google's processes don't make offboarding as easy as some other platforms might, because you want to suspend the user because that makes sense, right?
00:21:00.130 --> 00:21:03.810
But then all of a sudden, you might want them to still be able to receive email.
00:21:03.810 --> 00:21:10.050
You just want that email to like be read by somebody else in your organization, not obviously by the person who's no longer there.
00:21:10.050 --> 00:21:12.210
But the email address might still be valuable.
00:21:12.210 --> 00:21:17.490
Like if it's, you know, someone who's still that email address is still getting, let's say they're a program manager.
00:21:17.490 --> 00:21:20.610
They might still be getting emails from your external stakeholders.
00:21:20.610 --> 00:21:22.610
You just need their manager to read the emails.
00:21:22.610 --> 00:21:26.450
And that that can all be done, but that's what the offboarding procedure is about.
00:21:26.450 --> 00:21:26.930
No,
00:21:26.930 --> 00:21:30.690
I think the risk is more not I'm firing a disgruntled employee.
00:21:30.690 --> 00:21:34.690
The problem is we don't have a great policy for offboarding users.
00:21:34.690 --> 00:21:41.810
And so we have all these user accounts, and we don't know what the passwords are anymore.
00:21:41.810 --> 00:21:48.930
And so it's just an opportunity for someone to like try to wheedle their way in through some sort of dictionary attack or something.
00:21:48.930 --> 00:21:49.410
Um,
00:21:49.410 --> 00:22:02.610
It might not be the highest risk thing if you have good MFA, 2 SV in Google's case, enforcement and so on, but it's still like would be it is you want to part of security is reducing your threat landscape as much as possible.
00:22:02.770 --> 00:22:07.170
So anytime you have unused accounts just lying around, that's an opportunity.
00:22:07.170 --> 00:22:11.090
It may not be a likely opportunity, but you want to try to reduce that.
00:22:11.570 --> 00:22:20.530
The first one on the list is not specific to Google, but it is definitely worth putting on any list when you're talking about the biggest risks, um, which is just phishing and credential theft.
00:22:20.530 --> 00:22:21.890
So, yeah, maybe the title.
00:22:21.890 --> 00:22:26.610
Of the slide could have just been biggest risks to Google Workspace at nonprofits.
00:22:26.610 --> 00:22:29.730
It is a big risk, but it's not specific to Google Workspace.
00:22:29.890 --> 00:22:41.330
Then, also not specific to Google Workspace, but true for Google Workspace users, you definitely want to have that 2SV system set up, configured, and you want to have it enforced.
00:22:41.490 --> 00:22:46.930
One of the areas that that can be tricky is I'm bouncing around and I apologize for that.
00:22:46.930 --> 00:23:01.650
But the second to last one on this list, shared and generic accounts, that's where 2SV sometimes runs aground because it's very clear if I'm logging in as me that I'm the only one who should be able to, on my phone, say yes, that's me, let me in.
00:23:01.650 --> 00:23:14.530
But if I'm also sharing an account called info at or um donations at or whatever, then um maybe there's four of us sharing that password.
00:23:14.530 --> 00:23:17.330
And how do we do the 2SV for that?
00:23:17.330 --> 00:23:21.010
Because all four of us need to have it set up on our phones.
00:23:21.010 --> 00:23:24.370
It's not that it's impossible to do, but it's very unwieldy.
00:23:24.530 --> 00:23:33.010
So we help our clients work around those things by using um like Google groups for like those kinds of email addresses.
00:23:33.010 --> 00:23:49.410
So you don't have a user account called donations at nonprofit.org, but instead you might have a Google group called donations at Google at nonprofit.org and use configure it, and then the members of that group can read those emails and respond to them.
00:23:49.410 --> 00:23:50.130
Um, but
00:23:50.130 --> 00:24:15.570
Shared and generic accounts can be problems because when there's a one-to-one correspondence, this human being has this user account, it's very easy to sort of keep the security and they quickly notice if somebody, if they, if their account's doing weird things, they're going to raise their hand and say, hey, I don't know why, but like, you know, all my friends say that I'm getting that I'm emailing them.
00:24:15.570 --> 00:24:17.010
I'm not emailing them, what's going on?
00:24:17.010 --> 00:24:19.650
And then so we investigate and we solve that problem.
00:24:19.810 --> 00:24:30.450
But if it's a generic account that people only log into occasionally and someone gets into that somehow, then maybe no one even notices for a week or two, you know, because it's not managed very well.
00:24:30.450 --> 00:24:32.690
And then the, yeah, the 2SV and so on.
00:24:33.010 --> 00:24:38.370
Wire fraud and business email compromise is sort of uh part of that phishing credential theft.
00:24:38.370 --> 00:24:40.290
It's actually kind of of the same idea.
00:24:40.290 --> 00:24:52.770
But we do see that is one of the things that we still see is is that at and I think it has to do with in many ways, it's not specific to Google Workspace, but it might be specific to nonprofits.
00:24:52.770 --> 00:25:07.810
Nonprofits frequently have um I don't want to say this in a in a way that's insulting to anybody, but like maybe looser like processes for handling money sometimes.
00:25:07.810 --> 00:25:09.010
It might be more informal.
00:25:09.010 --> 00:25:25.890
So, like for an executive director to say to someone, hey, I need to take care of this situation because this donor is asking for it, that might be more likely to happen at a small nonprofit than it might be to happen at a bank, where there's very rigorous like processes that everybody knows to go through.
00:25:25.970 --> 00:25:46.050
And so we have seen wire fraud, um, and that's a generic term for like banking, you know, like talking, you know, or or buying what are the gift cards, you know, those kinds of things happen and we and we see that a fair amount, um, less than we used to because people are getting more sophisticated about it, but it still happens.
00:25:46.290 --> 00:25:48.130
And then this Google Drive files.
00:25:48.130 --> 00:25:50.050
So this goes back to the shared drives.
00:25:50.050 --> 00:25:59.010
It's good to use shared drives, but it is also important when you use shared drives that you structure the and the configuration uh appropriately.
00:25:59.010 --> 00:26:02.690
Do you want to allow external sharing from that particular Google Drive?
00:26:02.690 --> 00:26:05.010
Um, who are the members of it?
00:26:05.010 --> 00:26:07.170
Um, all of those kinds of things.
00:26:07.170 --> 00:26:14.210
Oh, and then the last one, sorry, I'm man, and I'm I'm running out of your, I'm I'm getting off your schedule, Carolyn.
00:26:14.210 --> 00:26:14.450
But
00:26:14.450 --> 00:26:23.730
The unmanaged personal accounts, that's not super common unless you have a relatively new account where maybe you weren't using Google Workspace before and now you are.
00:26:23.730 --> 00:26:39.810
Um, but people can sign up for um like Google Drive as a per as a as a regular consumer, as a person, not as a member of your enterprise, of your organization, and use their, you know, your organization's domain name, like their email address.
00:26:39.810 --> 00:26:41.730
And if you weren't in Google at the time.
00:26:41.730 --> 00:26:54.770
So so it is possible that there are personal, they're potentially Gmail accounts or Google accounts that are associated with your domain name, but they're not actually in your Google workspace.
00:26:54.770 --> 00:26:58.930
And there's a place in the in the admin portal where you can you can see who that list is.
00:26:58.930 --> 00:27:04.690
Oftentimes it's long ago, long-departed employees, and it's probably not a risk.
00:27:04.770 --> 00:27:11.170
Um from early on, maybe when you were setting it up, they had their own email like on your board when you were setting up.
00:27:11.490 --> 00:27:11.890
That's right.
00:27:11.890 --> 00:27:12.450
Um,
00:27:12.450 --> 00:27:20.050
I feel like I want to mention here that um if you need help doing some of the things in the admin portal, Google does have a knowledge base.
00:27:20.050 --> 00:27:22.290
You can look up questions of like, how do I find this?
00:27:22.290 --> 00:27:23.410
Where do I do that?
00:27:23.890 --> 00:27:37.330
Yeah, you know, and I always give Microsoft credit for like owning Windows and like Microsoft 365 and Microsoft Office, the desktop suite, you know, Word Excel, and how useful that is uh at for that world.
00:27:37.570 --> 00:27:40.050
One of the nice things about Google is they own Google.
00:27:40.050 --> 00:27:43.090
So Googling a question, actually, I don't know.
00:27:43.090 --> 00:27:47.890
I find that it works really well, and I like uh Google's knowledge base articles.
00:27:47.890 --> 00:27:48.930
We call them KBs.
00:27:48.930 --> 00:27:49.570
We
00:27:49.570 --> 00:27:59.170
I like their knowledge base articles more than I like Microsoft's for a um non X non-uh professional IT person.
00:27:59.170 --> 00:28:12.210
So if you're managing your IT um for your nonprofit and you and that's not your main job or it's not what you were trained in, but you're doing the best you can, I think you're gonna get good mileage out of Google's KBs.
00:28:12.210 --> 00:28:13.010
Um, and
00:28:13.010 --> 00:28:17.330
And you can be, in that case, I think, thankful that you're not doing the same thing in Microsoft.
00:28:17.330 --> 00:28:21.890
I think Microsoft is okay, but they tend to be more technical, harder to read.
00:28:21.890 --> 00:28:26.530
Uh you need to bring more background to it than you do to Google.
00:28:26.530 --> 00:28:32.530
Google is is a little bit more um uh uh try to keep things tries to keep things simple.
00:28:33.010 --> 00:28:35.170
It's very consumer oriented.
00:28:35.170 --> 00:28:35.810
Yeah.
00:28:35.810 --> 00:28:41.890
We have one quick question on can you transfer or forward a suspended account in Google Workspace to
00:28:41.890 --> 00:28:42.210
You can.
00:28:42.370 --> 00:28:45.330
So that's what I was talking about, how you can see those accounts.
00:28:45.330 --> 00:28:50.610
But the trick, not true, you can.
00:28:50.610 --> 00:28:52.290
Um you can, yes.
00:28:52.290 --> 00:28:55.570
For for the ones that are long, long, long departed.
00:28:55.570 --> 00:29:05.250
I don't know whether you need you might need to like um it might be tricky because that the email may or may not work, but yes, you can do that.
00:29:05.250 --> 00:29:07.170
Yes, yes, that's a short answer.
00:29:07.730 --> 00:29:08.050
Okay.
00:29:08.220 --> 00:29:11.170
Um, all right, we're gonna, yes, we're gonna move along a little bit.
00:29:11.170 --> 00:29:11.810
Um, so
00:29:11.810 --> 00:29:14.290
What can you do right now to protect your organization?
00:29:14.290 --> 00:29:15.490
First and next steps.
00:29:15.490 --> 00:29:17.330
I think we've talked a little bit about some of these.
00:29:17.330 --> 00:29:18.850
If you want to kind of run down.
00:29:19.410 --> 00:29:19.890
Yeah.
00:29:19.890 --> 00:29:23.090
So yes, let's just start with the easy one.
00:29:23.090 --> 00:29:25.570
Make sure that 2SV is turned on.
00:29:25.570 --> 00:29:36.450
Uh, and that's by default turned on, but it's not by default enforced, I don't think, for at least for older, older um workspace tenants that have been established for a while.
00:29:36.450 --> 00:29:38.050
So you need to turn it on.
00:29:38.050 --> 00:29:39.890
It's a little uh
00:29:39.890 --> 00:29:43.330
Google is a little is different from Microsoft in this regard.
00:29:43.330 --> 00:29:53.890
With Microsoft, you enable it or it's enabled, and you tell everybody to go ahead and get it set up and you warn them that you're going to be enforcing it on Friday, so everybody needs to get it done by Friday, yada, yada, yada.
00:29:53.890 --> 00:29:55.730
And then on Friday you enforce it.
00:29:55.730 --> 00:30:01.730
And the next time they try to log on, they can't get on until they set up MFA.
00:30:01.730 --> 00:30:04.290
So they're fine, they're forced to.
00:30:04.290 --> 00:30:15.970
And that is still a change management concern because if they're like logging on right before a meeting, that's a really important meeting, and now they are like losing five minutes because they're setting up MFA.
00:30:15.970 --> 00:30:17.650
So, you know, it's still a concern.
00:30:17.650 --> 00:30:18.050
But
00:30:18.050 --> 00:30:26.930
Google's much more challenging in terms of change management in that with Google, if you have not set it up and it gets enforced, you just can't log in.
00:30:26.930 --> 00:30:32.850
At that point, you need to open a ticket with the help desk or the the administrator, whoever that is.
00:30:32.850 --> 00:30:39.570
And they need to like work with you to to to, you know, because you can't, you need to do it ahead of time.
00:30:39.570 --> 00:30:41.170
But it should still be done.
00:30:41.170 --> 00:30:42.210
So it is important.
00:30:42.210 --> 00:30:44.050
It is possible to make exceptions.
00:30:44.050 --> 00:30:50.130
So if it just absolutely has to have an exception for a user account that can be done.
00:30:50.370 --> 00:30:54.610
But the the recommendation is that you enforce MFA or 2SV for everyone.
00:30:54.850 --> 00:31:02.690
Auditing account your accounts refers to sort of this offboarding and um and also like who has administrative privileges.
00:31:02.690 --> 00:31:14.690
We have seen um clients where it seemed like it was the easiest thing in the world was just to make almost everybody a super admin, or you know, or or you know, all the executive super admins.
00:31:14.690 --> 00:31:21.490
And that's that's a risk because if an if an account is breached, that person, you know, has too much power in that situation.
00:31:21.490 --> 00:31:23.890
So look at that, look at those, what the accounts are.
00:31:23.890 --> 00:31:28.770
Are there are there accounts that you can deprecate, um, so forth.
00:31:28.770 --> 00:31:29.330
Uh the
00:31:29.330 --> 00:31:52.690
Google Drive sharing settings is um, we talked about already, I won't, I won't go into it again, but there are settings for Google Drives, things like how who can share, what can, you know, who can who things can be shared to, um, whether other who the who the what there's yeah, anyway, you can you can you want to look at those things and then and use Google share drives.
00:31:52.690 --> 00:31:54.770
That is a I think a security concern.
00:31:54.770 --> 00:32:01.810
If you are just using my drives and sharing folders from my drives, that's really something that you want to, it's hard to correct.
00:32:01.810 --> 00:32:15.250
And we do have a blog post about how it's challenging to correct once it's once it's um out there already, but it's worth putting on your map on your map that we do want to get this corrected at some point and figure out um how to do that.
00:32:15.250 --> 00:32:17.170
So use Google Shared Drives.
00:32:17.170 --> 00:32:17.650
Um
00:32:17.650 --> 00:32:21.330
Login alerts are a nice touch that's available at the free tier.
00:32:21.330 --> 00:32:39.090
So if um uh if you do have super admins, you could have it set so that every time the super a super admin logs in, the other the other someone, you know, there's alerts being sent out to the other super admins or to the other um uh contacts for the account.
00:32:39.090 --> 00:32:40.770
Um that's helpful.
00:32:41.090 --> 00:32:45.330
Training staff is re that that is really helpful.
00:32:45.330 --> 00:33:00.450
Explaining how um phishing works and um helping people understand that email is a threat, that that uh chats and texts are a threat, you know, that this is not just email anymore.
00:33:00.450 --> 00:33:02.450
Those are all things that we can do.
00:33:02.450 --> 00:33:03.170
Um
00:33:03.170 --> 00:33:26.610
We talked about offboarding and we talked about the the DNS policy to reduce uh email spoofing, and I won't go into it now, but it's things like DMARC, DKIM, these are things that you can do just to so that you can't stop uh spoofing external if an external like an your staff are getting emails from other organizations, they might be spoofed.
00:33:26.610 --> 00:33:27.570
That you can't control.
00:33:27.570 --> 00:33:33.890
You can only control your own, but it's really good for your your own staff fooled by emails that appear to be from from within your organization.
00:33:33.890 --> 00:33:34.850
That's one thing.
00:33:34.850 --> 00:33:39.890
Also, not to have the reputational damage of not it's not a breach.
00:33:39.890 --> 00:33:52.690
No one's actually sending email from your from your Google workspace, but that appears to be from your Google workspace, and because you haven't done enough to turn up the dial on what the the spoofing protection is.
00:33:53.170 --> 00:33:55.490
Yeah, and I know I'm sorry, I was just looking for it quickly.
00:33:55.490 --> 00:34:01.570
I know we have a blog post on the DMARC and DKIM, but I'll have to find it and share it maybe in the transcript also.
00:34:01.570 --> 00:34:02.370
Um
00:34:02.370 --> 00:34:04.210
We have one more quick question.
00:34:04.210 --> 00:34:09.730
Uh, is it possible to disable downloading or printing documents in Google Workspace?
00:34:10.369 --> 00:34:13.170
Uh yes, I believe that it is.
00:34:13.170 --> 00:34:18.849
Um I don't know if it's possible at the free tier.
00:34:18.849 --> 00:34:20.449
I'm sorry they don't have that at my fingertips.
00:34:20.849 --> 00:34:24.849
We can provide, we'll we'll answer it over on um Reddit and we'll provide it in the transcript.
00:34:24.849 --> 00:34:26.530
We'll make sure we have that right answer.
