WEBVTT
00:00:22.369 --> 00:00:23.410
Hello everyone.
00:00:23.410 --> 00:00:31.409
Thank you for joining us at the Community IT webinar, Securing Google Workspace for Nonprofits with Steve Longenecker.
00:00:31.409 --> 00:00:33.329
My name is Carolyn Woodard.
00:00:33.329 --> 00:00:36.689
I am the outreach director for community IT and the moderator today.
00:00:37.009 --> 00:00:41.329
I'm Steve Longenecker, and I'm the director of IT Consulting at Community IT.
00:00:41.810 --> 00:00:52.049
All right, now I want to move on to our next quiz / poll, which is which security risk hits closest to home at your organization?
00:00:52.049 --> 00:00:56.209
And this one is multiple choice, so you can choose all that apply.
00:00:56.209 --> 00:01:00.129
And the first option is weak or shared passwords.
00:01:00.129 --> 00:01:02.450
Staff clicking on phishing links.
00:01:02.450 --> 00:01:04.289
You may already have had that.
00:01:04.289 --> 00:01:07.810
Oversharing files in Google Drive.
00:01:07.810 --> 00:01:13.730
And by that, Steve, we mean like when you say this link is everyone can use this link.
00:01:14.450 --> 00:01:14.769
Maybe.
00:01:14.769 --> 00:01:22.609
I mean that might be one risk, or that um uh uh files that are shouldn't be shared externally or shared externally.
00:01:22.609 --> 00:01:26.929
I mean there's a lot of different ways that you can overshare that you can overshare.
00:01:26.929 --> 00:01:36.929
Um I I do think um, you know, anonymous links can be can be a risk um depending on who where where they're posted and how they're used.
00:01:37.409 --> 00:01:37.729
All right.
00:01:37.729 --> 00:01:41.170
Um former employee accounts are still active.
00:01:41.170 --> 00:01:44.849
Uh not sure where our gaps is, that's a valid answer.
00:01:44.849 --> 00:02:01.250
Um, if you have something other and you don't mind putting it in chat, uh we'd love to hear if there's something that we didn't um capture here that you are worried about at your organization and not applicable if this is, you know, you have perfect security.
00:02:01.250 --> 00:02:03.649
So um someone yeah,
00:02:03.649 --> 00:02:05.250
Someone put in chat.
00:02:05.250 --> 00:02:05.489
Yeah.
00:02:05.489 --> 00:02:11.330
The staff insist on using personal email uh and not taking security seriously.
00:02:11.330 --> 00:02:27.090
That is um, you know, you can try doing more of the training and um uh you know trying to bring everyone along on the security journey of why it's so important and what the risks are, but it takes prioritization and it can be really hard.
00:02:27.090 --> 00:02:31.969
And especially if it's somebody that's very set in their ways, um, that can be hard.
00:02:31.969 --> 00:02:32.849
Um
00:02:32.849 --> 00:02:36.849
Someone put in the chat forwarding an org email to a personal account.
00:02:36.849 --> 00:02:40.129
I'd love to hear a little elaboration on that because I'm not sure.
00:02:40.289 --> 00:02:50.129
Um I think what they there is it's it's sort of a uh some detail on the first person's concern about insisting when using personal accounts.
00:02:50.129 --> 00:02:50.849
Personal email.
00:02:50.849 --> 00:02:56.210
So you can you can set up an automatic forwarding on your organizational email.
00:02:56.210 --> 00:03:03.969
Therefore, you don't have to really worry about your organizational email because you can just get it in your in your Gmail or Hotmail or AOL account or whatever.
00:03:03.969 --> 00:03:04.609
Yeah.
00:03:05.810 --> 00:03:08.849
Uh someone says conducting work on their phone.
00:03:08.849 --> 00:03:11.169
People conducting work on their phone.
00:03:11.169 --> 00:03:13.329
And um yeah, the
00:03:13.329 --> 00:03:21.729
The person who said forwarding the org email to a personal account, if you're in higher education, it creates compliance issues, I'm sure, like healthcare as well.
00:03:21.729 --> 00:03:24.769
So, okay, I'm going to end the poll.
00:03:24.769 --> 00:03:29.329
Uh we've had pretty good participation and um share it,
00:03:29.329 --> 00:03:29.810
Steve.
00:03:29.810 --> 00:03:31.009
Can you see that?
00:03:31.490 --> 00:03:31.889
Yes.
00:03:31.889 --> 00:03:37.969
Uh so I'm gonna read it not in order of the list, but just in the order of uh most popularity.
00:03:38.129 --> 00:03:44.129
So the the most popular was the staff clicking on phishing links, was uh chosen by 50% of our staff.
00:03:44.129 --> 00:03:48.370
Of course, you can choose more than one thing, so um, this isn't gonna add up to 100, I don't think.
00:03:48.370 --> 00:03:49.729
But uh that makes sense.
00:03:49.729 --> 00:03:59.650
And it is like one of the places where not only maybe is it like a likely thing, but it's also like the risk is high in terms of what the payoff could be.
00:03:59.650 --> 00:04:02.370
It could be really bad news if it happens.
00:04:02.370 --> 00:04:02.849
Uh,
00:04:02.849 --> 00:04:08.689
And then we had uh weak or shared passwords and oversharing of files in Google Drive.
00:04:08.689 --> 00:04:12.129
That was chosen by a third of our respondents.
00:04:12.129 --> 00:04:15.329
Um, both of them were chosen by a third of our respondents.
00:04:15.329 --> 00:04:15.889
Um,
00:04:15.889 --> 00:04:21.650
Former employee accounts are still active, was chosen by 16, I'm sorry, by 16%.
00:04:21.970 --> 00:04:26.689
And then we had about a third, 29%, saying they're not sure where the gaps are.
00:04:26.850 --> 00:04:30.530
And then we we did get some others that were chatted there.
00:04:30.930 --> 00:04:31.329
Yeah.
00:04:31.329 --> 00:04:33.730
And that's, I mean, that's fair, right?
00:04:33.730 --> 00:04:37.009
That you don't know what you don't know about what might be unsecure.
00:04:37.009 --> 00:04:39.889
So hopefully this webinar is helping you with that.
00:04:39.889 --> 00:04:40.290
Um,
00:04:40.290 --> 00:04:42.930
So our next question is what if you want more?
00:04:42.930 --> 00:04:49.250
Um, do you need to move to the paid tier of Google Workspace to get those extra features?
00:04:50.529 --> 00:04:53.569
So the Google Workspace does have extra features.
00:04:53.569 --> 00:05:03.329
And we we in that uh earlier slide, we had some of the ones um listed that are like uh paid tier only, things like data loss prevention and e-discovery and so forth.
00:05:03.329 --> 00:05:08.370
And and you may need those, and we have um a slide coming up to speak to that.
00:05:08.610 --> 00:05:23.170
But I did want to highlight that in in our view, um the next layers that you would probably want to add may not even be available or best available from Google Workspace, even at the very top tiers.
00:05:23.329 --> 00:05:49.730
So, for example, one of the things that that our uh CTO and security expert Matt Eshelman views as like a fundamental component of good layered security as a formal security awareness training program where there's accountability and data collected, and you know, we this is not just an informal training, you know, at a staff meeting ad hoc.
00:05:49.730 --> 00:05:51.490
And if you missed that staff meeting, you missed it.
00:05:51.490 --> 00:05:53.490
Like this is like a formal training program.
00:05:53.730 --> 00:05:56.050
That's not something that I'm aware Google offers.
00:05:56.050 --> 00:06:02.610
Like we offer that to our clients through a system called KnowBe4, and I like it a lot.
00:06:02.610 --> 00:06:03.569
I think it's a good system.
00:06:03.569 --> 00:06:04.209
There's many.
00:06:04.209 --> 00:06:09.409
I I don't, I'm not endorsing know before above the other ones, but that's a third-party system.
00:06:09.409 --> 00:06:15.889
And I would say before I started thinking about the higher tiers of Google, I'd want to have that.
00:06:15.889 --> 00:06:16.930
Um,
00:06:16.930 --> 00:06:21.730
Similarly, backups are an overlooked part of security.
00:06:21.730 --> 00:06:41.250
But when things go wrong, you can be really glad, like if there was a breach and someone deleted a bunch of stuff uh as part of a breach, or you know, the classic um uh thing where uh all your files are encrypted ransomware, and you can't you can't um recover your files without paying the ransom.
00:06:41.250 --> 00:06:44.610
If you have a backup, you don't need to recover the files because you have a backup.
00:06:44.610 --> 00:06:53.649
I would say that we would say that backups from a third party are part of the the value of good backups is not to rely on Google for that.
00:06:53.649 --> 00:06:54.050
Um
00:06:54.050 --> 00:07:04.370
Google does have retention schemes, and at the higher tier, you can you can put some e-discovery like protections on on files being backed up.
00:07:04.370 --> 00:07:07.810
But in a perfect world, you're not relying on Google at all.
00:07:07.810 --> 00:07:09.730
You have it in a completely separate platform.
00:07:09.730 --> 00:07:12.610
So that would be another third-party service that you could buy.
00:07:12.610 --> 00:07:13.409
Um
00:07:13.409 --> 00:07:28.689
Google does a great job with their native email protection, but if you want like we would say it's worth getting um a third-party backup, advanced email protection, sorry, an advanced email protection from a third party.
00:07:28.689 --> 00:07:29.170
Um,
00:07:29.170 --> 00:07:41.329
And then finally, you can configure in at the higher tiers of Google essentially the same things that a managed cloud detection and response can do.
00:07:41.329 --> 00:07:46.129
Things like uh we talked about uh log one alerts.
00:07:46.129 --> 00:07:47.649
You can configure those.
00:07:47.649 --> 00:07:56.850
You can you can get into the weeds and say, hey, if someone tries to log in to this account from a country other than the United States, we want to lock them out.
00:07:56.850 --> 00:08:03.969
And you know, you can do you can set up all of these rules, and that is available in a higher tier of Google Workspace.
00:08:04.290 --> 00:08:12.529
But to me, it makes more sense to use, like, and this is a service that, again, we would offer to our clients, but it's not saying you need to buy it from us.
00:08:12.529 --> 00:08:14.610
I mean, there's lots of places that would sell this.
00:08:14.610 --> 00:08:23.490
But a managed cloud detection and response layer on top of Google Workspace where someone else is doing all of that for you probably makes more sense.
00:08:23.490 --> 00:08:27.810
You might pay $5 per user per month or or $6 per user per month.
00:08:27.810 --> 00:08:39.730
You know, something, not nothing, but having that uh layer from a third party might might uh be better than than bumping up um your your Google workspace tier.
00:08:40.450 --> 00:08:43.090
But sometimes you might be interested in that.
00:08:43.090 --> 00:08:45.409
And we laid out a couple of cases, so you want to have a lot of different things.
00:08:45.409 --> 00:08:45.730
Yeah.
00:08:45.730 --> 00:08:46.290
Yeah.
00:08:46.450 --> 00:08:51.090
So this is the acknowledgement that that the free tier doesn't work for everybody, right?
00:08:51.090 --> 00:09:03.090
So um if you're a nonprofit that handles a lot of financial data or or healthcare data, you might be might be benef benefiting from bumping up a tier.
00:09:03.090 --> 00:09:14.370
Um if you if you need to do a lot of e-discovery or legal hold holds, that's something that comes in with a product in the platform called Google Vault.
00:09:14.370 --> 00:09:20.929
I think you can actually buy it separately, but it's also included, I think it starts at the Google for Business Plus level.
00:09:20.929 --> 00:09:22.210
Um and it's really nice.
00:09:22.210 --> 00:09:27.009
Um, but you can, but that is that is not something that you get out of the free tier.
00:09:27.009 --> 00:09:27.809
Um,
00:09:27.809 --> 00:09:39.409
And then the other thing that we would say is that if you do a lot of third-party app integrations with APIs and so on, the free tier doesn't really do a great job of providing the management hooks for that.
00:09:39.409 --> 00:09:44.450
Like it allows you to set them up, but then you don't really have a lot of insight into them.
00:09:44.450 --> 00:09:51.490
And so if you're doing it a lot, and this is the I think the people that are in these situations probably know they're in these situations.
00:09:51.490 --> 00:10:06.850
So I don't necessarily think this is like the slide that's the take-home message, and that everyone's gonna like, oh, thank goodness Steve mentioned that since we're, you know, getting sued all the time, we should probably have, you know, a higher tier of Google.
00:10:06.850 --> 00:10:12.450
Like, you know that already, but um, but it is acknowledging that the free tier is not gonna, it's not a one-size-fits-all.
00:10:12.450 --> 00:10:15.009
There are times when you need to be up a up a couple levels.
00:10:15.409 --> 00:10:16.049
But you can be.
00:10:16.049 --> 00:10:16.850
I mean, that's the thing.
00:10:16.850 --> 00:10:21.889
I think a lot of clients come to us thinking that, well, now I'm at this level of sophistication.
00:10:21.889 --> 00:10:26.689
I have to get off of Google Workspace and find something more serious and more secure.
00:10:26.689 --> 00:10:33.090
And there are giant corporations, big companies, big nonprofits, health systems, with Google Workspace.
00:10:33.090 --> 00:10:34.689
So that's right, it can work for you.
00:10:34.689 --> 00:10:34.929
Yeah.
00:10:35.250 --> 00:10:36.289
Absolutely, absolutely.
00:10:36.289 --> 00:10:42.850
And and the nonprofit discount, it's it's it it you don't you still don't pay the retail price for these products, right?
00:10:42.850 --> 00:10:53.889
So, like if if a if an enterprise license is, you know, $30 per user per month, and I'm just I don't have that number in my head, but if that's what it is, you might only be paying $100 again.
00:10:53.889 --> 00:10:57.809
Don't hold me to those prices, but you get a significant discount.
00:10:57.809 --> 00:11:00.610
Um you just don't get it for free anymore.
00:11:01.009 --> 00:11:09.490
So there's a couple of questions in chat, but I'm gonna save them for our QA slide, which is coming up so that we can get over this uh workspace, Google workspace security best practices.
00:11:09.490 --> 00:11:15.250
And some of this is pretty, I don't know, common sense, but um I want to make sure that we wrap it up.
00:11:15.889 --> 00:11:21.970
Yeah, it's good to have this, you know, opportunity to just take talk about the take-home messages.
00:11:21.970 --> 00:11:24.370
Um yeah,
00:11:24.370 --> 00:11:47.649
Starting out with the fact that, as we said at the very beginning, um Google does a great job of securing their infrastructure, but you need to do your part to make sure that your configurations and settings and that your people are contributing to security, um, whether that's through uh, you know, you're doing trainings for them and uh checking checking uh their the security, the the configurations and so forth.
00:11:47.649 --> 00:11:50.210
Um but the the nonprofit tier is good.
00:11:50.210 --> 00:11:53.009
Um do start with something.
00:11:53.169 --> 00:11:59.570
And I would say, you know, MFA2SV, if if that's not done, just make that your top priority.
00:11:59.570 --> 00:12:00.370
Um
00:12:00.370 --> 00:12:03.570
Training can be one of your top priorities as well.
00:12:03.570 --> 00:12:04.289
Um
00:12:04.289 --> 00:12:17.970
And then consider these third-party tools as the next layer before you start talking about like whether you need to go to business plus or enterprise for most um nonprofits, I would say.
00:12:18.210 --> 00:12:37.649
And then, yes, there are times when uh the free tier is not sufficient and and some layers of of third-party tools don't make as I mean, you might still have those, but you at the end of the day are gonna be valuing what let's say Google Enterprise provides.
00:12:38.610 --> 00:12:41.889
Um I want to make sure we get to some QA.
00:12:41.889 --> 00:12:44.689
Um, so I'm gonna go through this slide a little bit quickly.
00:12:44.689 --> 00:12:57.409
This is a slide that we use on our regular cybersecurity webinars that we do, which if you need that information, uh all of our previous webinars are under uh webinars on our website, communityit.com.
00:12:57.409 --> 00:12:59.889
So you can find all of the videos there.
00:12:59.889 --> 00:13:01.490
Um but I thought it was interesting.
00:13:01.649 --> 00:13:05.809
This is kind of our generic what you should do to protect your organization slide.
00:13:05.809 --> 00:13:10.289
And it really uh lines up very nicely with what you should do in Google Workspace.
00:13:10.289 --> 00:13:12.769
There's just a couple of extra little quirks and turns in there.
00:13:12.769 --> 00:13:23.970
So I'm so happy, Steve, that you could um help us, you know, dive in a little bit on some of those things that we need to make sure to be aware of if you're using Google Workspace.
00:13:24.210 --> 00:13:31.009
I'm gonna put these resources in the chat so that you all have them.
00:13:31.009 --> 00:13:39.649
Um, here's some resources on our our website and uh some that are specific to Google as well, um, where you can find more support, more information.
00:13:39.730 --> 00:13:48.689
As I said, Google is so consumer oriented and they don't assume that everyone that's using Google Workspace is an admin and it you know has a tech background.
00:13:48.689 --> 00:13:56.289
So they have a lot of very accessible information if you're looking for more, you know, how to do some of the things on the admin console.
00:13:56.289 --> 00:14:01.730
Um, so you can have those uh all those resources are in chat.
00:14:01.730 --> 00:14:01.970
So
00:14:01.970 --> 00:14:04.689
I'm gonna move right on to the QA.
00:14:04.689 --> 00:14:09.330
And um, Steve, we have a couple in chat and a couple in QA.
00:14:09.330 --> 00:14:11.970
So let me um just go back quickly.
00:14:11.970 --> 00:14:13.330
And um,
00:14:13.330 --> 00:14:30.529
Here was one on how can you or how can you prevent organizational Google Drive documents from automatically saving to or appearing in a user's personal Google Drive if they access company links while logged on to their personal Google account.
00:14:30.529 --> 00:14:31.730
Is that possible?
00:14:31.730 --> 00:14:45.169
I mean, it seems like if you have an organization account, you download that document, you can then upload it to your personal account, unless there's a policy against that.
00:14:45.889 --> 00:15:04.929
When you are for the most part, the model, and it's not just for Google, it's you know, with most models, when you have given someone access to a file, you're you are giving them access to the file and you're relying on them to, you know, then that's maybe where training and um uh privacy policy.
00:15:04.929 --> 00:15:20.929
Uh accountability, not accountability, uh training and and people being good stewards, you know, trying to appeal to the that whole nonprofit um ethos that like you need to do this for the good of the mission, you know, follow the rules kind of thing.
00:15:21.250 --> 00:15:23.970
I mean you could take a screenshot of it, you know, if you're looking at it.
00:15:24.929 --> 00:15:25.649
Yeah, yeah.
00:15:26.129 --> 00:15:30.529
And we can, if there's a deeper answer, we can give that over on Reddit.
00:15:30.529 --> 00:15:31.169
Um
00:15:31.169 --> 00:15:32.689
There was another question here.
00:15:32.689 --> 00:15:37.570
Is there a way in Google Workspace admin to check if users have a weak password?
00:15:37.889 --> 00:15:38.610
That's a good question.
00:15:38.610 --> 00:15:40.129
Yeah, I think that there is.
00:15:40.129 --> 00:15:44.370
Um I haven't looked at that for a while, but I'm pretty sure that you can uh
00:15:44.370 --> 00:15:47.009
It'll give you just not what their password is, but a reading.
00:15:47.330 --> 00:15:56.450
It doesn't not tell you the password, no, but it can it can apprise you of of and you can also see in the in the admin portal who has a configured 2SV and who has not.
00:15:56.450 --> 00:16:05.250
Um and that's that's kind of an important part of enforcing it is you need to know kind of, okay, when I turn on enforcement, who am I gonna lock out?
00:16:05.250 --> 00:16:07.730
Okay and you can and you can see that, yeah.
00:16:08.370 --> 00:16:09.490
Um here's a question.
00:16:09.490 --> 00:16:13.330
How can we promote file and information security through Google Mail?
00:16:13.330 --> 00:16:20.850
I'm aware that sharing confidential information in an unsecured Gmail as an attachment can have security concerns.
00:16:21.490 --> 00:16:22.689
It can, yes.
00:16:22.689 --> 00:16:25.649
And uh, you know, I think training is one of the things.
00:16:25.970 --> 00:16:31.090
There is all sorts of at the higher tiers, you can do a lot of the that's called a data loss protection.
00:16:31.090 --> 00:16:37.730
You can you can set rules around some of this stuff, like you know, preventing things from being attached to emails and so on.
00:16:37.970 --> 00:16:59.250
But honestly, it's like to some extent, um you can't you people need to do things because they've been ex they've been convinced that it is, you know, they need to do follow that it's that it's important for the good of the organization to follow these rules.
00:16:59.250 --> 00:16:59.809
Um
00:16:59.809 --> 00:17:14.610
I do think though that another angle on and this might go back to the uh original poll where a couple people, two people I guess, said that maybe their organization took security so seriously that it prevented them from doing their jobs.
00:17:14.610 --> 00:17:34.050
So, in some ways, that question about hey, you know, what if if people are emailing, like emailing an attachment in a Gmail may not be as secure as like sharing a link of the file or sharing it in some more secure manner.
00:17:34.050 --> 00:17:40.770
Well, then we need to make sure that our users are able and trained on how to do those more secure ways.
00:17:40.770 --> 00:17:52.210
Like if they're emailing attachments because they believe that's the best way for them to get their job done and they want to get their job done, that the motivation there is the right motivation.
00:17:52.290 --> 00:17:58.850
So we need to figure out as IT administrators, okay, but that's not that's not very secure.
00:17:58.850 --> 00:17:59.890
So what can we do?
00:17:59.890 --> 00:18:04.130
What alternatives do we have that you can still get your job done?
00:18:04.130 --> 00:18:19.490
So maybe, you know, Google shared drives, save the files there and allow this one shared drive to have members, you know, that are not in your organization, but they're like the outside consultants.
00:18:19.570 --> 00:18:35.490
So maybe there's a finance shared drive and the finance uh, you know, the outsourced accountant is a member of that shared drive, and therefore your um your internal finance person isn't constantly emailing sensitive financial documents to these consultants.
00:18:35.490 --> 00:18:43.970
Instead, the consultants just go right to that shared drive where the stuff is, you know, uh securely um saved.
00:18:44.530 --> 00:18:47.010
Yeah, no, that sounds like good advice.
00:18:47.010 --> 00:18:47.410
Um
00:18:47.410 --> 00:18:51.490
We have time for one more, and then there's so many more questions in the chat.
00:18:51.490 --> 00:18:55.010
So we're definitely gonna have those over on Reddit after this.
00:18:55.010 --> 00:19:09.250
Um and you can always get in touch with me as well, you know, through the website or you know, on LinkedIn, uh, or you know, however you want to get in touch with me if you have another question or your question wasn't answered and you really need the answer.
00:19:09.250 --> 00:19:09.810
Um,
00:19:09.810 --> 00:19:12.930
Sorry to the person who wanted to talk about workspace in Gemini.
00:19:12.930 --> 00:19:19.330
Uh we are gonna have um a uh webinar in the fall that's about cybersecurity.
00:19:19.330 --> 00:19:26.850
We will talking, be talking a lot about AI then, and we did a webinar on cybersecurity and AI specifically in February.
00:19:26.850 --> 00:19:28.850
So you might want to go back and check that one.
00:19:28.850 --> 00:19:32.770
Um I know that we mentioned Gemini, but we didn't get deep into it.
00:19:32.770 --> 00:19:33.490
Um but
00:19:33.490 --> 00:19:35.170
I thought this question was interesting.
00:19:35.170 --> 00:19:40.610
Um do you recommend using Google Drive app or using the web browser?
00:19:41.730 --> 00:19:51.250
Um so quickly on the Gemini thing, I would encourage the person who asked that question, and we can answer it in the Reddit channel later, but you know, go ahead and and Google it.
00:19:51.250 --> 00:20:00.930
There's a lot of good stuff that you can do to control Gemini to some extent, um, including, you know, disabling it if that's what you need to do.
00:20:00.930 --> 00:20:02.130
Um
00:20:02.130 --> 00:20:10.130
The question about the Google Drive app, I do think I I mean it depends like a lot of a good consulting answer is it depends, right?
00:20:10.130 --> 00:20:39.090
I do think that if you have, you know, typical nonprofit operational requirements and security requirements, the Google Drive app on your on a PC, if you are taking steps to make sure that the PC is secured, maybe you have device management on the PC, it's a company-owned PC, um, you have good hygiene on the PC and everything, then um, it can be really nice and very convenient for the person to have the Google Drive app.
00:20:39.090 --> 00:20:40.050
Um
00:20:40.050 --> 00:21:00.690
If you're using Google Docs and Sheets, like you're not using Office uh versions of the of those, you're not using Word or Excel, but you're using Google Docs and Google Sheets, then the at some point the browser becomes just as convenient anyway, and probably you don't need to have uh the drive app.
00:21:00.690 --> 00:21:02.450
But I I if
00:21:02.450 --> 00:21:23.810
If I were helping a small nonprofit get set up, I would probably go ahead and deploy the Google Drive for the convenience of the users so that again, I'm not trying to make life difficult for my users, because if I make life difficult for my users, that's when they start doing crazy things to get around me to do their jobs.
00:21:23.810 --> 00:21:26.050
And I understand that they're just trying to do their jobs.
00:21:26.050 --> 00:21:34.210
So instead, I want to um give them the tools so that they can do their jobs within my restrictions.
00:21:34.210 --> 00:21:36.610
Um, and you know, we find that balance.
00:21:37.410 --> 00:21:44.610
I'm sorry to hurry you along, um, but in the interest of time, if there are people who can stay over a minute or so, um we might go over a minute.
00:21:44.610 --> 00:21:45.650
I apologize.
00:21:45.650 --> 00:21:48.530
Um I went quickly through our learning objectives.
00:21:48.530 --> 00:21:50.770
I think you hit them all just wonderfully, Steve.
00:21:50.770 --> 00:21:51.970
Thank you so much.
00:21:52.210 --> 00:21:57.730
I want to make sure to let people know that next month I'll be going back to AI topics.
00:21:57.730 --> 00:22:05.410
We'll be welcoming some experts to talk about where you go with AI at your nonprofit if you're past the experimenting phase.
00:22:05.410 --> 00:22:11.410
So, how do you get to an AI that is genuinely embedded in what your organization does and how you work?
00:22:11.410 --> 00:22:19.090
And we're gonna learn about an AI maturity model that they use at PTKO Consulting to help their clients implement AI intentionally.
00:22:19.250 --> 00:22:26.930
So, if you're new on your AI journey, we have a lot of other resources on our site about getting started, looking at ethical frameworks, creating AI policy.
00:22:26.930 --> 00:22:29.410
We have a download that you can use, a template.
00:22:29.410 --> 00:22:29.730
And
00:22:29.730 --> 00:22:35.410
I'm really excited about this upcoming webinar because there are a lot of webinars out there around the early stages.
00:22:35.410 --> 00:22:40.050
And we do have clients who have been using AI for over a year and want to know these next steps.
00:22:40.050 --> 00:22:42.130
Like, how do you take that next step?
00:22:42.290 --> 00:22:46.450
So, our guests, Mimi and George, are going to share what best practices are out there.
00:22:46.450 --> 00:22:48.050
This is an evolving space.
00:22:48.050 --> 00:22:52.450
There aren't people, you know, nonprofits who have been using AI for very much longer than that.
00:22:52.450 --> 00:22:57.090
But if that is where you are on your AI journey, please join us again next month.
00:22:57.090 --> 00:22:58.130
That's at 3 p.m.
00:22:58.130 --> 00:23:01.410
Eastern Noon Pacific on Wednesday, July 15th.
00:23:01.410 --> 00:23:04.130
I just shared the registration page in the chat.
00:23:04.130 --> 00:23:07.010
It's on our website at community it.com.
00:23:07.250 --> 00:23:13.490
Please don't forget as you exit today to take our short survey, it's six questions, six easy questions.
00:23:13.490 --> 00:23:18.690
Uh, one lucky winner chosen at random receives a $25 gift certificate, and it really helps us.
00:23:18.770 --> 00:23:24.130
And then join us on Reddit, r slash nonprofit IT management for more QA.
00:23:24.130 --> 00:23:26.530
As I said, we had a bunch of questions in the queue.
00:23:26.530 --> 00:23:27.890
I'm sorry we couldn't get to all of them.
00:23:27.890 --> 00:23:29.410
There's some really good ones in there.
00:23:29.410 --> 00:23:41.250
So uh Steve is gonna come over on Reddit for another um, you know, 15, 20 minutes to answer some of those questions, and we will see you here next month, I hope, uh, with our next monthly webinar.
00:23:41.410 --> 00:23:43.650
So thank you everyone for joining us.
00:23:43.650 --> 00:23:45.730
Uh, your your time is a gift.
00:23:45.730 --> 00:23:48.130
You spent an hour with us, we really appreciate it.
00:23:48.130 --> 00:23:54.690
Steve, thank you so much for sharing all your expertise and wisdom about Google Workspace.
00:23:54.690 --> 00:23:59.730
Uh, it's so easy to get into, but it's not super easy to make sure you're doing everything right.
00:23:59.730 --> 00:24:02.130
So we really appreciate your time today.
00:24:02.690 --> 00:24:07.090
Uh thank you, and thanks to all the people that were chatting and helping answer questions.
00:24:07.090 --> 00:24:09.010
Uh, I love the community spirit.
00:24:09.010 --> 00:24:10.610
Um, that was really great to see.
00:24:10.930 --> 00:24:11.890
No, it was really great.
00:24:11.890 --> 00:24:15.250
So thank you again, everyone, and we will see you over on Reddit.
00:00:22.369 --> 00:00:23.410
Hello everyone.
00:00:23.410 --> 00:00:31.409
Thank you for joining us at the Community IT webinar, Securing Google Workspace for Nonprofits with Steve Longenecker.
00:00:31.409 --> 00:00:33.329
My name is Carolyn Woodard.
00:00:33.329 --> 00:00:36.689
I am the outreach director for community IT and the moderator today.
00:00:37.009 --> 00:00:41.329
I'm Steve Longenecker, and I'm the director of IT Consulting at Community IT.
00:00:41.810 --> 00:00:52.049
All right, now I want to move on to our next quiz / poll, which is which security risk hits closest to home at your organization?
00:00:52.049 --> 00:00:56.209
And this one is multiple choice, so you can choose all that apply.
00:00:56.209 --> 00:01:00.129
And the first option is weak or shared passwords.
00:01:00.129 --> 00:01:02.450
Staff clicking on phishing links.
00:01:02.450 --> 00:01:04.289
You may already have had that.
00:01:04.289 --> 00:01:07.810
Oversharing files in Google Drive.
00:01:07.810 --> 00:01:13.730
And by that, Steve, we mean like when you say this link is everyone can use this link.
00:01:14.450 --> 00:01:14.769
Maybe.
00:01:14.769 --> 00:01:22.609
I mean that might be one risk, or that um uh uh files that are shouldn't be shared externally or shared externally.
00:01:22.609 --> 00:01:26.929
I mean there's a lot of different ways that you can overshare that you can overshare.
00:01:26.929 --> 00:01:36.929
Um I I do think um, you know, anonymous links can be can be a risk um depending on who where where they're posted and how they're used.
00:01:37.409 --> 00:01:37.729
All right.
00:01:37.729 --> 00:01:41.170
Um former employee accounts are still active.
00:01:41.170 --> 00:01:44.849
Uh not sure where our gaps is, that's a valid answer.
00:01:44.849 --> 00:02:01.250
Um, if you have something other and you don't mind putting it in chat, uh we'd love to hear if there's something that we didn't um capture here that you are worried about at your organization and not applicable if this is, you know, you have perfect security.
00:02:01.250 --> 00:02:03.649
So um someone yeah,
00:02:03.649 --> 00:02:05.250
Someone put in chat.
00:02:05.250 --> 00:02:05.489
Yeah.
00:02:05.489 --> 00:02:11.330
The staff insist on using personal email uh and not taking security seriously.
00:02:11.330 --> 00:02:27.090
That is um, you know, you can try doing more of the training and um uh you know trying to bring everyone along on the security journey of why it's so important and what the risks are, but it takes prioritization and it can be really hard.
00:02:27.090 --> 00:02:31.969
And especially if it's somebody that's very set in their ways, um, that can be hard.
00:02:31.969 --> 00:02:32.849
Um
00:02:32.849 --> 00:02:36.849
Someone put in the chat forwarding an org email to a personal account.
00:02:36.849 --> 00:02:40.129
I'd love to hear a little elaboration on that because I'm not sure.
00:02:40.289 --> 00:02:50.129
Um I think what they there is it's it's sort of a uh some detail on the first person's concern about insisting when using personal accounts.
00:02:50.129 --> 00:02:50.849
Personal email.
00:02:50.849 --> 00:02:56.210
So you can you can set up an automatic forwarding on your organizational email.
00:02:56.210 --> 00:03:03.969
Therefore, you don't have to really worry about your organizational email because you can just get it in your in your Gmail or Hotmail or AOL account or whatever.
00:03:03.969 --> 00:03:04.609
Yeah.
00:03:05.810 --> 00:03:08.849
Uh someone says conducting work on their phone.
00:03:08.849 --> 00:03:11.169
People conducting work on their phone.
00:03:11.169 --> 00:03:13.329
And um yeah, the
00:03:13.329 --> 00:03:21.729
The person who said forwarding the org email to a personal account, if you're in higher education, it creates compliance issues, I'm sure, like healthcare as well.
00:03:21.729 --> 00:03:24.769
So, okay, I'm going to end the poll.
00:03:24.769 --> 00:03:29.329
Uh we've had pretty good participation and um share it,
00:03:29.329 --> 00:03:29.810
Steve.
00:03:29.810 --> 00:03:31.009
Can you see that?
00:03:31.490 --> 00:03:31.889
Yes.
00:03:31.889 --> 00:03:37.969
Uh so I'm gonna read it not in order of the list, but just in the order of uh most popularity.
00:03:38.129 --> 00:03:44.129
So the the most popular was the staff clicking on phishing links, was uh chosen by 50% of our staff.
00:03:44.129 --> 00:03:48.370
Of course, you can choose more than one thing, so um, this isn't gonna add up to 100, I don't think.
00:03:48.370 --> 00:03:49.729
But uh that makes sense.
00:03:49.729 --> 00:03:59.650
And it is like one of the places where not only maybe is it like a likely thing, but it's also like the risk is high in terms of what the payoff could be.
00:03:59.650 --> 00:04:02.370
It could be really bad news if it happens.
00:04:02.370 --> 00:04:02.849
Uh,
00:04:02.849 --> 00:04:08.689
And then we had uh weak or shared passwords and oversharing of files in Google Drive.
00:04:08.689 --> 00:04:12.129
That was chosen by a third of our respondents.
00:04:12.129 --> 00:04:15.329
Um, both of them were chosen by a third of our respondents.
00:04:15.329 --> 00:04:15.889
Um,
00:04:15.889 --> 00:04:21.650
Former employee accounts are still active, was chosen by 16, I'm sorry, by 16%.
00:04:21.970 --> 00:04:26.689
And then we had about a third, 29%, saying they're not sure where the gaps are.
00:04:26.850 --> 00:04:30.530
And then we we did get some others that were chatted there.
00:04:30.930 --> 00:04:31.329
Yeah.
00:04:31.329 --> 00:04:33.730
And that's, I mean, that's fair, right?
00:04:33.730 --> 00:04:37.009
That you don't know what you don't know about what might be unsecure.
00:04:37.009 --> 00:04:39.889
So hopefully this webinar is helping you with that.
00:04:39.889 --> 00:04:40.290
Um,
00:04:40.290 --> 00:04:42.930
So our next question is what if you want more?
00:04:42.930 --> 00:04:49.250
Um, do you need to move to the paid tier of Google Workspace to get those extra features?
00:04:50.529 --> 00:04:53.569
So the Google Workspace does have extra features.
00:04:53.569 --> 00:05:03.329
And we we in that uh earlier slide, we had some of the ones um listed that are like uh paid tier only, things like data loss prevention and e-discovery and so forth.
00:05:03.329 --> 00:05:08.370
And and you may need those, and we have um a slide coming up to speak to that.
00:05:08.610 --> 00:05:23.170
But I did want to highlight that in in our view, um the next layers that you would probably want to add may not even be available or best available from Google Workspace, even at the very top tiers.
00:05:23.329 --> 00:05:49.730
So, for example, one of the things that that our uh CTO and security expert Matt Eshelman views as like a fundamental component of good layered security as a formal security awareness training program where there's accountability and data collected, and you know, we this is not just an informal training, you know, at a staff meeting ad hoc.
00:05:49.730 --> 00:05:51.490
And if you missed that staff meeting, you missed it.
00:05:51.490 --> 00:05:53.490
Like this is like a formal training program.
00:05:53.730 --> 00:05:56.050
That's not something that I'm aware Google offers.
00:05:56.050 --> 00:06:02.610
Like we offer that to our clients through a system called KnowBe4, and I like it a lot.
00:06:02.610 --> 00:06:03.569
I think it's a good system.
00:06:03.569 --> 00:06:04.209
There's many.
00:06:04.209 --> 00:06:09.409
I I don't, I'm not endorsing know before above the other ones, but that's a third-party system.
00:06:09.409 --> 00:06:15.889
And I would say before I started thinking about the higher tiers of Google, I'd want to have that.
00:06:15.889 --> 00:06:16.930
Um,
00:06:16.930 --> 00:06:21.730
Similarly, backups are an overlooked part of security.
00:06:21.730 --> 00:06:41.250
But when things go wrong, you can be really glad, like if there was a breach and someone deleted a bunch of stuff uh as part of a breach, or you know, the classic um uh thing where uh all your files are encrypted ransomware, and you can't you can't um recover your files without paying the ransom.
00:06:41.250 --> 00:06:44.610
If you have a backup, you don't need to recover the files because you have a backup.
00:06:44.610 --> 00:06:53.649
I would say that we would say that backups from a third party are part of the the value of good backups is not to rely on Google for that.
00:06:53.649 --> 00:06:54.050
Um
00:06:54.050 --> 00:07:04.370
Google does have retention schemes, and at the higher tier, you can you can put some e-discovery like protections on on files being backed up.
00:07:04.370 --> 00:07:07.810
But in a perfect world, you're not relying on Google at all.
00:07:07.810 --> 00:07:09.730
You have it in a completely separate platform.
00:07:09.730 --> 00:07:12.610
So that would be another third-party service that you could buy.
00:07:12.610 --> 00:07:13.409
Um
00:07:13.409 --> 00:07:28.689
Google does a great job with their native email protection, but if you want like we would say it's worth getting um a third-party backup, advanced email protection, sorry, an advanced email protection from a third party.
00:07:28.689 --> 00:07:29.170
Um,
00:07:29.170 --> 00:07:41.329
And then finally, you can configure in at the higher tiers of Google essentially the same things that a managed cloud detection and response can do.
00:07:41.329 --> 00:07:46.129
Things like uh we talked about uh log one alerts.
00:07:46.129 --> 00:07:47.649
You can configure those.
00:07:47.649 --> 00:07:56.850
You can you can get into the weeds and say, hey, if someone tries to log in to this account from a country other than the United States, we want to lock them out.
00:07:56.850 --> 00:08:03.969
And you know, you can do you can set up all of these rules, and that is available in a higher tier of Google Workspace.
00:08:04.290 --> 00:08:12.529
But to me, it makes more sense to use, like, and this is a service that, again, we would offer to our clients, but it's not saying you need to buy it from us.
00:08:12.529 --> 00:08:14.610
I mean, there's lots of places that would sell this.
00:08:14.610 --> 00:08:23.490
But a managed cloud detection and response layer on top of Google Workspace where someone else is doing all of that for you probably makes more sense.
00:08:23.490 --> 00:08:27.810
You might pay $5 per user per month or or $6 per user per month.
00:08:27.810 --> 00:08:39.730
You know, something, not nothing, but having that uh layer from a third party might might uh be better than than bumping up um your your Google workspace tier.
00:08:40.450 --> 00:08:43.090
But sometimes you might be interested in that.
00:08:43.090 --> 00:08:45.409
And we laid out a couple of cases, so you want to have a lot of different things.
00:08:45.409 --> 00:08:45.730
Yeah.
00:08:45.730 --> 00:08:46.290
Yeah.
00:08:46.450 --> 00:08:51.090
So this is the acknowledgement that that the free tier doesn't work for everybody, right?
00:08:51.090 --> 00:09:03.090
So um if you're a nonprofit that handles a lot of financial data or or healthcare data, you might be might be benef benefiting from bumping up a tier.
00:09:03.090 --> 00:09:14.370
Um if you if you need to do a lot of e-discovery or legal hold holds, that's something that comes in with a product in the platform called Google Vault.
00:09:14.370 --> 00:09:20.929
I think you can actually buy it separately, but it's also included, I think it starts at the Google for Business Plus level.
00:09:20.929 --> 00:09:22.210
Um and it's really nice.
00:09:22.210 --> 00:09:27.009
Um, but you can, but that is that is not something that you get out of the free tier.
00:09:27.009 --> 00:09:27.809
Um,
00:09:27.809 --> 00:09:39.409
And then the other thing that we would say is that if you do a lot of third-party app integrations with APIs and so on, the free tier doesn't really do a great job of providing the management hooks for that.
00:09:39.409 --> 00:09:44.450
Like it allows you to set them up, but then you don't really have a lot of insight into them.
00:09:44.450 --> 00:09:51.490
And so if you're doing it a lot, and this is the I think the people that are in these situations probably know they're in these situations.
00:09:51.490 --> 00:10:06.850
So I don't necessarily think this is like the slide that's the take-home message, and that everyone's gonna like, oh, thank goodness Steve mentioned that since we're, you know, getting sued all the time, we should probably have, you know, a higher tier of Google.
00:10:06.850 --> 00:10:12.450
Like, you know that already, but um, but it is acknowledging that the free tier is not gonna, it's not a one-size-fits-all.
00:10:12.450 --> 00:10:15.009
There are times when you need to be up a up a couple levels.
00:10:15.409 --> 00:10:16.049
But you can be.
00:10:16.049 --> 00:10:16.850
I mean, that's the thing.
00:10:16.850 --> 00:10:21.889
I think a lot of clients come to us thinking that, well, now I'm at this level of sophistication.
00:10:21.889 --> 00:10:26.689
I have to get off of Google Workspace and find something more serious and more secure.
00:10:26.689 --> 00:10:33.090
And there are giant corporations, big companies, big nonprofits, health systems, with Google Workspace.
00:10:33.090 --> 00:10:34.689
So that's right, it can work for you.
00:10:34.689 --> 00:10:34.929
Yeah.
00:10:35.250 --> 00:10:36.289
Absolutely, absolutely.
00:10:36.289 --> 00:10:42.850
And and the nonprofit discount, it's it's it it you don't you still don't pay the retail price for these products, right?
00:10:42.850 --> 00:10:53.889
So, like if if a if an enterprise license is, you know, $30 per user per month, and I'm just I don't have that number in my head, but if that's what it is, you might only be paying $100 again.
00:10:53.889 --> 00:10:57.809
Don't hold me to those prices, but you get a significant discount.
00:10:57.809 --> 00:11:00.610
Um you just don't get it for free anymore.
00:11:01.009 --> 00:11:09.490
So there's a couple of questions in chat, but I'm gonna save them for our QA slide, which is coming up so that we can get over this uh workspace, Google workspace security best practices.
00:11:09.490 --> 00:11:15.250
And some of this is pretty, I don't know, common sense, but um I want to make sure that we wrap it up.
00:11:15.889 --> 00:11:21.970
Yeah, it's good to have this, you know, opportunity to just take talk about the take-home messages.
00:11:21.970 --> 00:11:24.370
Um yeah,
00:11:24.370 --> 00:11:47.649
Starting out with the fact that, as we said at the very beginning, um Google does a great job of securing their infrastructure, but you need to do your part to make sure that your configurations and settings and that your people are contributing to security, um, whether that's through uh, you know, you're doing trainings for them and uh checking checking uh their the security, the the configurations and so forth.
00:11:47.649 --> 00:11:50.210
Um but the the nonprofit tier is good.
00:11:50.210 --> 00:11:53.009
Um do start with something.
00:11:53.169 --> 00:11:59.570
And I would say, you know, MFA2SV, if if that's not done, just make that your top priority.
00:11:59.570 --> 00:12:00.370
Um
00:12:00.370 --> 00:12:03.570
Training can be one of your top priorities as well.
00:12:03.570 --> 00:12:04.289
Um
00:12:04.289 --> 00:12:17.970
And then consider these third-party tools as the next layer before you start talking about like whether you need to go to business plus or enterprise for most um nonprofits, I would say.
00:12:18.210 --> 00:12:37.649
And then, yes, there are times when uh the free tier is not sufficient and and some layers of of third-party tools don't make as I mean, you might still have those, but you at the end of the day are gonna be valuing what let's say Google Enterprise provides.
00:12:38.610 --> 00:12:41.889
Um I want to make sure we get to some QA.
00:12:41.889 --> 00:12:44.689
Um, so I'm gonna go through this slide a little bit quickly.
00:12:44.689 --> 00:12:57.409
This is a slide that we use on our regular cybersecurity webinars that we do, which if you need that information, uh all of our previous webinars are under uh webinars on our website, communityit.com.
00:12:57.409 --> 00:12:59.889
So you can find all of the videos there.
00:12:59.889 --> 00:13:01.490
Um but I thought it was interesting.
00:13:01.649 --> 00:13:05.809
This is kind of our generic what you should do to protect your organization slide.
00:13:05.809 --> 00:13:10.289
And it really uh lines up very nicely with what you should do in Google Workspace.
00:13:10.289 --> 00:13:12.769
There's just a couple of extra little quirks and turns in there.
00:13:12.769 --> 00:13:23.970
So I'm so happy, Steve, that you could um help us, you know, dive in a little bit on some of those things that we need to make sure to be aware of if you're using Google Workspace.
00:13:24.210 --> 00:13:31.009
I'm gonna put these resources in the chat so that you all have them.
00:13:31.009 --> 00:13:39.649
Um, here's some resources on our our website and uh some that are specific to Google as well, um, where you can find more support, more information.
00:13:39.730 --> 00:13:48.689
As I said, Google is so consumer oriented and they don't assume that everyone that's using Google Workspace is an admin and it you know has a tech background.
00:13:48.689 --> 00:13:56.289
So they have a lot of very accessible information if you're looking for more, you know, how to do some of the things on the admin console.
00:13:56.289 --> 00:14:01.730
Um, so you can have those uh all those resources are in chat.
00:14:01.730 --> 00:14:01.970
So
00:14:01.970 --> 00:14:04.689
I'm gonna move right on to the QA.
00:14:04.689 --> 00:14:09.330
And um, Steve, we have a couple in chat and a couple in QA.
00:14:09.330 --> 00:14:11.970
So let me um just go back quickly.
00:14:11.970 --> 00:14:13.330
And um,
00:14:13.330 --> 00:14:30.529
Here was one on how can you or how can you prevent organizational Google Drive documents from automatically saving to or appearing in a user's personal Google Drive if they access company links while logged on to their personal Google account.
00:14:30.529 --> 00:14:31.730
Is that possible?
00:14:31.730 --> 00:14:45.169
I mean, it seems like if you have an organization account, you download that document, you can then upload it to your personal account, unless there's a policy against that.
00:14:45.889 --> 00:15:04.929
When you are for the most part, the model, and it's not just for Google, it's you know, with most models, when you have given someone access to a file, you're you are giving them access to the file and you're relying on them to, you know, then that's maybe where training and um uh privacy policy.
00:15:04.929 --> 00:15:20.929
Uh accountability, not accountability, uh training and and people being good stewards, you know, trying to appeal to the that whole nonprofit um ethos that like you need to do this for the good of the mission, you know, follow the rules kind of thing.
00:15:21.250 --> 00:15:23.970
I mean you could take a screenshot of it, you know, if you're looking at it.
00:15:24.929 --> 00:15:25.649
Yeah, yeah.
00:15:26.129 --> 00:15:30.529
And we can, if there's a deeper answer, we can give that over on Reddit.
00:15:30.529 --> 00:15:31.169
Um
00:15:31.169 --> 00:15:32.689
There was another question here.
00:15:32.689 --> 00:15:37.570
Is there a way in Google Workspace admin to check if users have a weak password?
00:15:37.889 --> 00:15:38.610
That's a good question.
00:15:38.610 --> 00:15:40.129
Yeah, I think that there is.
00:15:40.129 --> 00:15:44.370
Um I haven't looked at that for a while, but I'm pretty sure that you can uh
00:15:44.370 --> 00:15:47.009
It'll give you just not what their password is, but a reading.
00:15:47.330 --> 00:15:56.450
It doesn't not tell you the password, no, but it can it can apprise you of of and you can also see in the in the admin portal who has a configured 2SV and who has not.
00:15:56.450 --> 00:16:05.250
Um and that's that's kind of an important part of enforcing it is you need to know kind of, okay, when I turn on enforcement, who am I gonna lock out?
00:16:05.250 --> 00:16:07.730
Okay and you can and you can see that, yeah.
00:16:08.370 --> 00:16:09.490
Um here's a question.
00:16:09.490 --> 00:16:13.330
How can we promote file and information security through Google Mail?
00:16:13.330 --> 00:16:20.850
I'm aware that sharing confidential information in an unsecured Gmail as an attachment can have security concerns.
00:16:21.490 --> 00:16:22.689
It can, yes.
00:16:22.689 --> 00:16:25.649
And uh, you know, I think training is one of the things.
00:16:25.970 --> 00:16:31.090
There is all sorts of at the higher tiers, you can do a lot of the that's called a data loss protection.
00:16:31.090 --> 00:16:37.730
You can you can set rules around some of this stuff, like you know, preventing things from being attached to emails and so on.
00:16:37.970 --> 00:16:59.250
But honestly, it's like to some extent, um you can't you people need to do things because they've been ex they've been convinced that it is, you know, they need to do follow that it's that it's important for the good of the organization to follow these rules.
00:16:59.250 --> 00:16:59.809
Um
00:16:59.809 --> 00:17:14.610
I do think though that another angle on and this might go back to the uh original poll where a couple people, two people I guess, said that maybe their organization took security so seriously that it prevented them from doing their jobs.
00:17:14.610 --> 00:17:34.050
So, in some ways, that question about hey, you know, what if if people are emailing, like emailing an attachment in a Gmail may not be as secure as like sharing a link of the file or sharing it in some more secure manner.
00:17:34.050 --> 00:17:40.770
Well, then we need to make sure that our users are able and trained on how to do those more secure ways.
00:17:40.770 --> 00:17:52.210
Like if they're emailing attachments because they believe that's the best way for them to get their job done and they want to get their job done, that the motivation there is the right motivation.
00:17:52.290 --> 00:17:58.850
So we need to figure out as IT administrators, okay, but that's not that's not very secure.
00:17:58.850 --> 00:17:59.890
So what can we do?
00:17:59.890 --> 00:18:04.130
What alternatives do we have that you can still get your job done?
00:18:04.130 --> 00:18:19.490
So maybe, you know, Google shared drives, save the files there and allow this one shared drive to have members, you know, that are not in your organization, but they're like the outside consultants.
00:18:19.570 --> 00:18:35.490
So maybe there's a finance shared drive and the finance uh, you know, the outsourced accountant is a member of that shared drive, and therefore your um your internal finance person isn't constantly emailing sensitive financial documents to these consultants.
00:18:35.490 --> 00:18:43.970
Instead, the consultants just go right to that shared drive where the stuff is, you know, uh securely um saved.
00:18:44.530 --> 00:18:47.010
Yeah, no, that sounds like good advice.
00:18:47.010 --> 00:18:47.410
Um
00:18:47.410 --> 00:18:51.490
We have time for one more, and then there's so many more questions in the chat.
00:18:51.490 --> 00:18:55.010
So we're definitely gonna have those over on Reddit after this.
00:18:55.010 --> 00:19:09.250
Um and you can always get in touch with me as well, you know, through the website or you know, on LinkedIn, uh, or you know, however you want to get in touch with me if you have another question or your question wasn't answered and you really need the answer.
00:19:09.250 --> 00:19:09.810
Um,
00:19:09.810 --> 00:19:12.930
Sorry to the person who wanted to talk about workspace in Gemini.
00:19:12.930 --> 00:19:19.330
Uh we are gonna have um a uh webinar in the fall that's about cybersecurity.
00:19:19.330 --> 00:19:26.850
We will talking, be talking a lot about AI then, and we did a webinar on cybersecurity and AI specifically in February.
00:19:26.850 --> 00:19:28.850
So you might want to go back and check that one.
00:19:28.850 --> 00:19:32.770
Um I know that we mentioned Gemini, but we didn't get deep into it.
00:19:32.770 --> 00:19:33.490
Um but
00:19:33.490 --> 00:19:35.170
I thought this question was interesting.
00:19:35.170 --> 00:19:40.610
Um do you recommend using Google Drive app or using the web browser?
00:19:41.730 --> 00:19:51.250
Um so quickly on the Gemini thing, I would encourage the person who asked that question, and we can answer it in the Reddit channel later, but you know, go ahead and and Google it.
00:19:51.250 --> 00:20:00.930
There's a lot of good stuff that you can do to control Gemini to some extent, um, including, you know, disabling it if that's what you need to do.
00:20:00.930 --> 00:20:02.130
Um
00:20:02.130 --> 00:20:10.130
The question about the Google Drive app, I do think I I mean it depends like a lot of a good consulting answer is it depends, right?
00:20:10.130 --> 00:20:39.090
I do think that if you have, you know, typical nonprofit operational requirements and security requirements, the Google Drive app on your on a PC, if you are taking steps to make sure that the PC is secured, maybe you have device management on the PC, it's a company-owned PC, um, you have good hygiene on the PC and everything, then um, it can be really nice and very convenient for the person to have the Google Drive app.
00:20:39.090 --> 00:20:40.050
Um
00:20:40.050 --> 00:21:00.690
If you're using Google Docs and Sheets, like you're not using Office uh versions of the of those, you're not using Word or Excel, but you're using Google Docs and Google Sheets, then the at some point the browser becomes just as convenient anyway, and probably you don't need to have uh the drive app.
00:21:00.690 --> 00:21:02.450
But I I if
00:21:02.450 --> 00:21:23.810
If I were helping a small nonprofit get set up, I would probably go ahead and deploy the Google Drive for the convenience of the users so that again, I'm not trying to make life difficult for my users, because if I make life difficult for my users, that's when they start doing crazy things to get around me to do their jobs.
00:21:23.810 --> 00:21:26.050
And I understand that they're just trying to do their jobs.
00:21:26.050 --> 00:21:34.210
So instead, I want to um give them the tools so that they can do their jobs within my restrictions.
00:21:34.210 --> 00:21:36.610
Um, and you know, we find that balance.
00:21:37.410 --> 00:21:44.610
I'm sorry to hurry you along, um, but in the interest of time, if there are people who can stay over a minute or so, um we might go over a minute.
00:21:44.610 --> 00:21:45.650
I apologize.
00:21:45.650 --> 00:21:48.530
Um I went quickly through our learning objectives.
00:21:48.530 --> 00:21:50.770
I think you hit them all just wonderfully, Steve.
00:21:50.770 --> 00:21:51.970
Thank you so much.
00:21:52.210 --> 00:21:57.730
I want to make sure to let people know that next month I'll be going back to AI topics.
00:21:57.730 --> 00:22:05.410
We'll be welcoming some experts to talk about where you go with AI at your nonprofit if you're past the experimenting phase.
00:22:05.410 --> 00:22:11.410
So, how do you get to an AI that is genuinely embedded in what your organization does and how you work?
00:22:11.410 --> 00:22:19.090
And we're gonna learn about an AI maturity model that they use at PTKO Consulting to help their clients implement AI intentionally.
00:22:19.250 --> 00:22:26.930
So, if you're new on your AI journey, we have a lot of other resources on our site about getting started, looking at ethical frameworks, creating AI policy.
00:22:26.930 --> 00:22:29.410
We have a download that you can use, a template.
00:22:29.410 --> 00:22:29.730
And
00:22:29.730 --> 00:22:35.410
I'm really excited about this upcoming webinar because there are a lot of webinars out there around the early stages.
00:22:35.410 --> 00:22:40.050
And we do have clients who have been using AI for over a year and want to know these next steps.
00:22:40.050 --> 00:22:42.130
Like, how do you take that next step?
00:22:42.290 --> 00:22:46.450
So, our guests, Mimi and George, are going to share what best practices are out there.
00:22:46.450 --> 00:22:48.050
This is an evolving space.
00:22:48.050 --> 00:22:52.450
There aren't people, you know, nonprofits who have been using AI for very much longer than that.
00:22:52.450 --> 00:22:57.090
But if that is where you are on your AI journey, please join us again next month.
00:22:57.090 --> 00:22:58.130
That's at 3 p.m.
00:22:58.130 --> 00:23:01.410
Eastern Noon Pacific on Wednesday, July 15th.
00:23:01.410 --> 00:23:04.130
I just shared the registration page in the chat.
00:23:04.130 --> 00:23:07.010
It's on our website at community it.com.
00:23:07.250 --> 00:23:13.490
Please don't forget as you exit today to take our short survey, it's six questions, six easy questions.
00:23:13.490 --> 00:23:18.690
Uh, one lucky winner chosen at random receives a $25 gift certificate, and it really helps us.
00:23:18.770 --> 00:23:24.130
And then join us on Reddit, r slash nonprofit IT management for more QA.
00:23:24.130 --> 00:23:26.530
As I said, we had a bunch of questions in the queue.
00:23:26.530 --> 00:23:27.890
I'm sorry we couldn't get to all of them.
00:23:27.890 --> 00:23:29.410
There's some really good ones in there.
00:23:29.410 --> 00:23:41.250
So uh Steve is gonna come over on Reddit for another um, you know, 15, 20 minutes to answer some of those questions, and we will see you here next month, I hope, uh, with our next monthly webinar.
00:23:41.410 --> 00:23:43.650
So thank you everyone for joining us.
00:23:43.650 --> 00:23:45.730
Uh, your your time is a gift.
00:23:45.730 --> 00:23:48.130
You spent an hour with us, we really appreciate it.
00:23:48.130 --> 00:23:54.690
Steve, thank you so much for sharing all your expertise and wisdom about Google Workspace.
00:23:54.690 --> 00:23:59.730
Uh, it's so easy to get into, but it's not super easy to make sure you're doing everything right.
00:23:59.730 --> 00:24:02.130
So we really appreciate your time today.
00:24:02.690 --> 00:24:07.090
Uh thank you, and thanks to all the people that were chatting and helping answer questions.
00:24:07.090 --> 00:24:09.010
Uh, I love the community spirit.
00:24:09.010 --> 00:24:10.610
Um, that was really great to see.
00:24:10.930 --> 00:24:11.890
No, it was really great.
00:24:11.890 --> 00:24:15.250
So thank you again, everyone, and we will see you over on Reddit.
