[MUSIC PLAYING]
SRIRAM KARRA: Welcome to the Google Cloud Security showcase
a special web series, where we'll
focus on security use cases that customers
can solve with Google Cloud.
My name is Sriram, and I'm a product manager
at Google Cloud.
Today, we'll be walking through one of the top questions we
get from customers--
how do I protect my high risk users
with the advanced protection program?
The Advanced Protection Program, or APP for short,
is meant for Google accounts belonging to individuals
who are at high risk of targeted attacks,
people like business leaders, activists, journalists,
staff on political campaign teams, super administrators,
or other users in your organization with access
to sensitive data.
By "targeted attacks," we mean attacks
that are highly customized to individual recipients, almost
handcrafted, if you will, to fool more automatic protections
that may be in force, and also the individuals themselves.
If you are a high-risk user, then this
could even be a phishing email from a government-backed actor.
Google recommends the Advanced Protection Program for users
of this security profile.
The APP was originally launched with support
for consumer Google services.
It is now also available for enterprise accounts.
As of October 2019, it is in open beta.
And as an administrator, you can choose to have APP enabled
for some or all of your users.
In the rest of this presentation,
I'm going to tell you more about what
it means to be in the program, and then follow it up
with a quick demo, so you know how
to get started with enabling APP for your organization
and users.
So let's start by looking at what
it means to be in the Advanced Protection Program.
The APP essentially consists of two pillars.
The first pillar of Advanced Protection Program
is that it is a curated list of strong security policies.
Here we see the four policies that
are included in the APP today.
The first one is that it mandates the use of security
keys for authentication.
Secondly, it restricts the kind of access
that some third-party applications can have
to the user's account data.
Thirdly, accounts in the APP get deeper Gmail scanning.
And finally, if the APP user is also signed into Chrome,
they get additional warnings from Chrome Safe Browsing.
These are just the four policies that we have in the APP today.
The second pillar of APP is that it
is a program that automatically upgrades,
which means that once a user has opted in,
they continue to get the benefit from the latest protections
without any further intervention from users or admins,
when Google adds more protections to keep up
with emergent threats.
Now let's look at a quick demo to understand
how you, as an admin, can enable APP for your organization.
As an admin, the first step you would take
is identify the users who are at high risk of targeted attacks,
and create an organizational unit to contain these users.
Once you've done that, you would navigate
to the Security Settings page in the Admin console.
In the Security Settings page, there
will be a new tab called Advanced Protection
Program, which is in open beta at this time.
You click on that.
In the Advanced Protection Program tab,
when I click on it, you would see a familiar OU tree
on the left-hand side and APP-specific policies
on the right-hand side.
You would select the organizational unit
on which you want to operate.
Here we have selected the root OU,
meaning you want to enable enrollment
for your entire organization.
And then you can enable user enrollment for that OU.
And then you would click Save.
Another way to do it is just select the OU containing
your high-risk users.
And you could enable user enrollment only for that OU.
The choice is yours.
You would also see a setting here called "Allowing users
to generate security codes."
This is required in case some of your users
need to use legacy applications that only work on some older
browsers, where security keys are not natively supported.
Once you allow enrollment, you have
to communicate to your users that they may self-enroll.
Let's look at how end user self-enrollment process works.
This is a user in their Gmail.
They've signed into their Google account.
They first have to navigate to the landing page
for the Advanced Protection Program
at g.co/advancedprotection.
And then click on Get Started.
It's a simple, three-step process
that first requires them to register two new security keys.
At this point, it's important to remember
that even if the user has security keys on their account
already, they will have to present them
again so that the user starts with a clean security slate.
So let's assume that at this point,
you have procured the security keys
and distributed to the users.
So the user would click on a Register Key.
At this point, we're making a sensitive operation.
And so the user is prompted to enter the password again.
Once a user is authenticated, they
would add the first security key.
At this point, I'm going to insert a security key
and tap it.
And then add a second key.
I'll tell you in a moment why we need two keys.
There we go.
The second key is also registered.
The reason we need two keys is if a security key is not
available for sign-in, the user may get locked out,
and they will have to reach out to you, the admin,
to let them into their account.
So having two keys with them allows
them to work around in case one of the keys
is misplaced or lost.
So once both the keys are registered,
they essentially are shown a list
of things of what will happen to their account,
and then they can just complete the enrollment process.
Once they user is enrolled, all their active sessions
are revoked so that they can again
sign in and start their session with a completely
clean security state.
So the user entered the password and is now prompted
for one of the security keys.
It doesn't matter which one.
They just have to insert one of the two security keys
and tap it.
And now they're signed in.
If the user at any time wants to opt out of advance protection,
they can go to their My Account at Google.com page
and then click on Unenroll.
In addition to the user themselves
managing themselves like this, as an admin,
you also have some additional tools
to help the users while they're enrolled
in the advanced protection.
Let's switch back to the Admin console here,
and let us navigate to the user's individual page.
Here in the security section of the user's page,
there will be a new tab that says Advanced Protection
and it's turned on.
Also, you will notice that in the card on the left side,
there's a new label called Advanced Protection to tell you
that this user has enrolled in the Advanced Protection
Program.
If for whatever reason you want to unenroll the user
from Advanced Protection, you can still do that in the admin
console like this, by clicking on Off and then pressing Save.
These are the tools that you have
for managing the user in the Advanced Protection Program.
You will also get audit logs every time
a user enrolls and unenrolls from the program.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]