[MUSIC PLAYING]
CHAD TYLER: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that customers can solve with G Suite.
My name is Chad, and I'm a product manager
at Google Cloud.
Today, we'll be walking through one of the top questions we
get from customers--
how can my admins work together to resolve security incidents?
G Suite is traditionally really good at helping
end users collaborate.
But if you look at how admins work together,
it tends to be really archaic, usually involving
taking screenshots of the product
and sharing them through email or chat.
This is why we're so excited we bringing G Suite style
collaboration to security admins.
I'll walk you through a demo and show you a little bit more
of what that looks like.
All right, so as a security admin,
I've received an alert that one of my users
is sharing files externally.
And so what we want to do is from the Alert Center
where we received this alert, we want
to dive in to figure out what they've been sharing
and how sensitive those files are.
So right from this alert, we can click on investigate alert,
which jumps us into the investigation tool
so we can see in more depth what's happening.
And then when we click on that, it
generates the right query to show us the information related
to the alert.
And then we see the specific log events
that are associated with what that user was doing.
And so we see that they are sharing files that are fairly
sensitive, project differentiation, escalations,
financial performance, two-year vision--
things we probably don't want shared externally.
So what we're going to do is we're
going to select all of these files,
and we're going to come to our audit file permissions
experience.
And from here what we can do is we
can remove the external shares so that these files
are no longer available.
So we'll come to links.
We'll select all of these files, and then we'll
change them to restricted.
So they're no longer available.
And then we'll save that.
So we've remediated this issue.
But what we want to do is we want to share this
with our colleague Robin, who handles account security,
so that she can suspend this user,
as it looks like they're doing things
that they shouldn't be doing.
So we'll come here to the investigation tool's
save investigation option, and we'll type in the date here.
And then we'll call it Attempted Exfiltration,
and we'll save that.
So once we've saved this, what you'll see
is there's now an option to share this investigation.
So we'll click on Share, and we'll
type in our colleague's email address.
And we'll say, can you suspend this user?
And then we'll send that.
And now when we switch to our colleague's view--
so this is from Robin's point of view--
you'll see that she received an email.
And when she clicks on open investigation, what that does
is it opens the same investigation
that we were just working on.
So we can see that the original admin queried.
They saw all these different results,
and then they took an action to block
those files so they weren't shared externally anymore.
Now what we want to do is we want to come to this actor,
and we want to suspend that user.
So we're going to come down and look at their email account.
So we're going to look at their account details.
And then right from here, we can select that,
and we can suspend this user.
So that's really quickly how two admins can work together
to resolve that issue together.
So in that demo, we quickly walked you
through how multiple admins can work together
to resolve a security incident.
I just want to thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]