[TITLE MUSIC]
SAM LUGANI: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that customers can solve with G Suite.
My name is Sam, and I lead security product marketing
for G Suite.
Today, we'll be walking through one
of the top questions we get from customers-- what should I do
when I see suspicious activity?
Here I am, logged in to the Alert Center within G Suite,
and I see multiple events.
One of these events is something which says Suspicious Device
Activity.
Now, as I click on this event, it gives me more details
around what's really happening behind the scenes.
So I can see here that there are some related alerts as well.
But it looks like there's been some suspicious activity
on Brittany's device.
And Brittany is an employee within the organization ink-42.
So right from within the Alert Center,
I can click on Investigate Alert, which directly takes me
to this investigation.
And all these queries are pre-fed.
So we can see that Brittany has an Android device.
It's a Pixel 2.
And it looks like there's been some suspicious activity
on this device.
Now, by experience, we know that a lot of such activity
occurs because of malicious and phishing emails.
So what I want to do next is I want
to see if Brittany has received any suspicious emails lately.
So I can pivot from right within the investigation tool,
and I can look at all the different emails
Britney has received.
Now, as you can see, there's a bunch of emails.
Now, next step, I want to see if any one of these emails
was tagged as suspicious by our filters.
And it looks like there's four emails which were tagged
suspicious by our filters.
And these emails have the subject line "time-sensitive--
update your 401(k) account now," and they're coming from someone
whose domain is similar to our domain but not quite the same.
And that's the reason they were tagged as suspicious
by our Gmail filters.
Now, one of the things with classic phishing attacks
is that if such kinds of emails are going out to Brittany,
they're probably going out to other employees
within the organization as well.
So now I can pivot on this subject from right
within the investigation tool, and I can see everyone
within my organization that has received the same email.
And a lot of people have.
Now, I want to do a couple of things here.
One is I want to select all these emails
and proactively delete these emails from users' inboxes.
Next step, I also want to see if any one of these employees
has maybe shared something outside the organization which
they shouldn't have.
So I can pivot on all these users,
and I can see their drive activity.
And I can see, again, if they have
shared stuff outside the organization lately.
So it looks like a bunch of files have been shared.
One of them is our compensation model.
There is competitive analysis, there
is a financial report, and a few other files.
And that is quite concerning.
So I can do a couple of things.
One is I can select all these files,
and I can audit these files' permissions.
Now, all this is happening within the investigation tool.
Now, I see a lot of these files, and I
want to limit and make sure that these files only
remain within the organization.
So I can select all these files.
And I, with a few clicks, can ensure that these organization
files are not shared outside.
I can go one step further, which is I can select all these users
and I can suspend them from within the investigation too.
So we did a couple of things.
We first figured out that there was
a device which was compromised.
Next step, we figured out why this device was compromised.
It was because of an email which was tagged as suspicious by us.
But Brittany probably opened that email.
And as a next step, we figured out
that Brittany was not the only recipient of this email.
It was shared, and it was sent across
multiple different users.
We proactively deleted that email
from those users' inboxes.
We then suspended users.
And again, we looked at any files
which had been shared outside the organization.
And we limited file sharing to only within the organization.
So that's it with the demo.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[TITLE MUSIC]