DATA SECURITY STRATEGIES

Implications of Moving to G Suite

10 MIN READ

Cory Ranschau

Manager, Senior, Information Security

Regardless of organization size, geographic location, or industry vertical, business revolves around data—most of which is created using productivity software suites – including word processor, spreadsheet and presentation tools. Microsoft Office—built around the core of Word, Excel and PowerPoint—is the de facto standard for productivity suites. As companies go through digital transformation and migrate to cloud platforms and software-as-a-service (SaaS) applications, though, the push for more data sharing and real-time collaboration has shifted the productivity suite to the cloud as well. Today, Microsoft Office rival Google G Suite is gaining market share in the productivity suite race.

Moving to a cloud-based SaaS model for productivity has a variety of potential benefits. It enables teams and individuals to easily workshop together in real-time on documents, spreadsheets and presentations for better collaboration. Storing the data in the cloud makes it accessible from virtually any device with an internet connection and allows the information to be easily shared with others. There are also benefits in terms of performance, resilience and cost, but there are also some unique concerns organizations need to be aware of when it comes to security and protecting data.

Risks of Cloud Computing and Pitfalls of G Suite

It’s important to understand the productivity and security implications of adopting Google G Suite as your productivity platform. It is objectively less mature than the Microsoft Office suite. G Suite is an evolution of applications and services that Google first launched in 2006, while Microsoft Office has been the standard for productivity suites since it was introduced in 1988.

Google G Suite is also seen as less “enterprise-friendly” than Microsoft Office or Office 365, but this perception is shifting. When Google first began offering its cloud-based productivity suite, most companies still had a traditional on-premises network infrastructure, and they objected to the monthly subscription business model. Large companies preferred the capital expense of purchasing software as opposed to the ongoing operational expense of a monthly payment, and they wanted the servers installed locally on their own networks where they could manage them directly.

Technology and business models have changed significantly since 2006, though. Cloud computing is mainstream, and most businesses have embraced cloud platforms and SaaS applications at this point, making Google G Suite a more acceptable option for businesses of any size.

Common Myths of G Suite Cloud Security

While there are some legitimate concerns to consider when moving to Google G Suite, there are also some myths floating around that are either misguided or completely false.

To Continue Reading…

Share a few pieces of information and we’ll personalize your experience with us

Files in the cloud are not secure. There is a common misperception that data stored in the cloud is less secure than data stored on-premises. The cloud is designed to be accessible from anywhere, which suggests that data is more exposed to theft or compromise. Furthermore, the infrastructure behind the cloud platform is managed by a third-party, which seems riskier than controlling it directly. There are elements of truth to these points, but in general data stored in the cloud is at least as secure—if not more secure—than data stored locally. Google is focused on establishing confidence and building trust, so it strives to ensure the data in G Suite is secure.

Few security controls add risk. Google G Suite offers fewer security controls to configure, which leads some to believe it is less secure. However, more security controls does not equate necessarily with more security. More controls adds complexity and increases the likelihood that something will be missed or misconfigured and leave you exposed to risk. G Suite includes a variety of useful security features, such as two-factor authentication, automatic detection of suspicious activity, phishing attack detection, and more—designed to provide Google G Suite customers with the security they need.

Google is spying on your data. Many people believe that Google is actively scanning and monitoring everything you do on its platform to mine demographic data and marketing analytics. There is a saying that if something is provided to you for free, it’s because you’re the product, not the customer. Google does conduct some scanning and gathering of data from its free services, but that does not apply to paid Google G Suite customers.

Culture of Collaboration

The caveats and pitfalls of using G Suite are minimal compared to the value the productivity suite provides. Google G Suite is designed from the ground up for fostering teamwork and helping people collaborate and work effectively together.

Because G Suite is cloud-based, teams and individuals can collaborate in real-time on the same file from virtually any device, no matter where they are in the world. They can see where others are currently active in the file, and chat with one another to compare notes or discuss changes, and edits are reflected in real-time.

Real-time collaboration streamlines productivity and helps organizations work efficiently, and reduces complexity at the same time. There is only one, centralized file—a single source of content. Rather than sending copies of the file as email attachments to multiple people and then struggling to correlate and merge edits and feedback into the main file, everyone has access to the version that is current and up to date.

Security Benefits of G Suite

We covered some of the risks and security concerns of Google G Suite, but there are also some unique security benefits to using the Google productivity suite. For starters, it expands the variety of devices employees can use to be productive, while reducing your exposure to risk from those devices. You obviously still want to follow security best practices and do what you can to secure each device, but you don’t need to be concerned about your data because it doesn’t live on the device—it is safely in the cloud on Google Drive.

Google G Suite offers fewer security controls than some productivity suites, but as mentioned above, that is an intentional feature. Having fewer security controls available reduces the potential for misconfiguring them. Minimizing the number of features and options also limits the attack surface and offers less potential for vulnerabilities that attackers can exploit to gain access to your data. Organizations that use Chromebook devices are essentially protected by default when using G Suite because of the integration and connections to Google itself.

With a traditional office productivity suite installed locally on employee PCs, the burden is on the IT Security team and the organization to ensure the device is secure and keep the productivity suite applications patched and updated. However, with Google G Suite that burden is on Google and you get the benefit of a productivity suite that is constantly patched and frequently introduces updates and new features.

Making the Case for Google G Suite

Different teams and departments have different needs when it comes to a productivity suite. There are many benefits for using Google G Suite in general, but let’s take a look at some of the specific ways that different teams within the organization can benefit from G Suite.

Google G Suite lightens the load for the IT team in a few ways. First, Google manages the operation, maintenance, and security of the backend infrastructure, so that is one less thing for IT to worry about. As mentioned above, G Suite also limits the overall exposure to risk from a given device because the data is actually stored in the cloud, and it reduces complexity by sharing a single file from the cloud rather than creating and distributing multiple copies of the same file. The Google G Suite administrative controls enable IT to easily configure access and decide who, where and when the tools and data can be accessed.

Human Resources

People who work in HR can benefit from many of the features and capabilities of Google G Suite. You can simplify the employee onboarding process by organizing all of the files and documents new employees need in a folder on Google Drive where they can be easily shared. Google Hangouts—the video conferencing component of Google G Suite—is useful as a virtual classroom for remote workers. It can also be used to record training sessions that employees can reference at their convenience, or for conducting remote interviews. Google Sheets is very useful for keeping track of the candidate pipeline and tracking employees through the onboarding or offboarding lifecycle.

Legal

Google G Suite simplifies compliance with regulatory mandates and industry frameworks like HIPAA (Health Insurance Portability and Accessibility Act), PCI-DSS (Payment Card Industry Data Security Standards), GDPR (General Data Protection Regulation), and others. It also has comprehensive archiving and searching capabilities that enable Legal to quickly identify and retrieve files to streamline legal discovery.

Users

Google G Suite has the tools users need to create documents, spreadsheets and presentations, and empowers them to collaborate together in real-time. Because it is cloud-based, users can log in and use Google G Suite from virtually any web-enabled devices, and storing data in Google Drive means it isn’t tied to a specific device and can be easily accessed.

Getting the Most Out of Google G Suite

Organizations have a lot to gain from moving to Google G Suite, but there are a few things to keep in mind that will help you get the most out of the Google productivity suite.

You should ensure that your organization has processes that fit with the way Google does things, and that you are prepared to take advantage of the various features and benefits. If your users continue to save their files on their local device and send copies out to everyone as email attachments, you will not get the value you expect from Google G Suite.

Educate users on the features and functionality of Google G Suite and emphasize the value of the collaboration culture. Make sure users know how to collaborate on files in real-time, and store data in the cloud, and that they understand both the operational and security benefits of embracing the cloud-based platform.

As you empower users to collaborate and share data in the cloud, you should also make sure you have visibility into where your data is, who has access to it and how it is being used. Insider threats from users compromising data—whether intentional or inadvertent—are a significant concern that needs to be addressed. We found in a recent survey that 73% of employees report having access to data they did not create, 69% can view data they did not contribute to, and nearly 60% can see data from other departments. In and of itself, that is not unusual—especially in a collaboration culture environment—but it does illustrate how much your sensitive data and intellectual property are exposed to risk.

The risks are multiplied when you consider that the same tools used to foster collaboration and help users be more productive are also the primary vectors for moving data from one place to another. Our 2020 Data Exposure Report shows data exfiltration often occurs using personal email, printed documents, or external devices like portable USB thumb drives, but cloud platforms and collaboration services are a significant and growing trend as well.

You want to foster a collaborative environment and ensure your organization gets the full value of Google G Suite without sacrificing data security. Restrictive tools and complex policies conflict with the goals of the collaboration culture, which is why we believe that data security should be defined not by what you can prevent, but by how fast you can detect, investigate and respond to suspicious activity and security incidents.

As you move to Google G Suite and the benefits it has to offer, make sure you have comprehensive visibility of all of your data no matter where it lives. When you know where your data is, who has access to it and when, and you can track what data leaves your environment. You also can fully embrace the cloud-based collaboration culture with peace of mind.

Cory Ranschau

Cory Ranschau, CSSP, GSEC, is the Senior Manager of Information Security for Code42. Cory’s 15+ years of experience in both the IT and Security Infrastructure fields have focussed around delivering scalable, secure infrastructure.