[MUSIC PLAYING]
NEIL KUMARAN: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that customers can solve with G Suite.
My name is Neil.
And I'm a product manager at Google Cloud.
Today we'll be walking through one of the top questions
we get from customers--
what are some protections against phishing and malware,
and how do I configure them?
First, let's start with the advanced phishing
and malware controls.
You can find these settings by navigating
to the Safety section of the Gmail settings
in the Admin Console.
The controls you'll find in this area
allow you to enable protections for specific types of threats.
Today, there are three categories of controls--
attachments, links and external images,
and spoofing authentication.
For each setting, you can choose whether to enable it
and what action to take on any messages that
match the enabled setting.
For settings that affect particular messages,
you can choose to keep a matching message in the user's
inbox with a warning banner, to move the message directly
to the spam folder, or even to move the message to an admin
quarantine.
These settings can also be enabled for the entire domain
or on a per organizational unit basis.
Now let's take a quick look at a few
of the settings in this area.
Let's start with attachments.
The first setting is protect against encrypted attachments
from untrusted senders.
Encrypted attachments cannot be scanned for malware.
This setting allows you to flag any encrypted messages sent
to your users by entities they haven't communicated
with before.
The next setting is protect against attachments
with scripts from untrusted senders.
Many malware infections happen via malicious scripts
in documents.
To reduce this threat vector, this setting
allows you to flag scripts from untrusted senders.
The final setting here is protect
against anomalous attachment types.
Uncommon and archaic file types are often
used to spread malware.
And attachment types that are commonly seen in one domain
may be incredibly rare in another.
This setting allows you to flag any message that
contains an attachment with a type that's exceedingly
rare for your domain.
Next, let's take a look at two settings in the links
and external images section.
The first setting here is identify links
behind shortened URLs.
Attackers often use URL shorteners
to obfuscate malicious links.
This setting allows G Suite to unwind these URLs
to discover malicious content.
Next, let's look at scan linked images.
This allows for scanning of images
referenced by links to find hidden malicious content.
Finally, let's take a quick look at the spoofing
and authentication section.
There are a number of settings in this section.
But let's take a look at a few.
First, protect against domain spoofing
based on similar domain names.
This setting protects against messages
that come from domains that look visually similar to trusted
ones.
Next, protect against spoofing of employee names.
This setting protects against messages
where the email sender's name is a name in your company
directory, but the email is not from your domain or domain
aliases.
And finally, protect against inbound email
spoofing your domain.
This setting protects against messages
that are unauthenticated and pretending to be
from your domain.
There are a few settings in this section
that we haven't discussed.
And we'd encourage you to take a look at them all.
As you've probably noticed, at the bottom of each section
is a checkbox that says Apply Future Recommended Settings
Automatically.
Enabling this checkbox will allow you to automatically stay
up to date with future settings we
may build, ensuring that your domain stays
optimally protected.
The other feature we wanted to highlight today
was Security Sandbox.
If you're a G Suite Enterprise Edition user,
you'll find this setting in the Advanced Settings page
under Gmail Settings in the Spam, Phishing, and Malware
section.
The Security Sandbox feature is very effective at catching
unknown and zero-day malware.
It detects the presence of unknown malware and attachments
by virtually executing them in a private, secure sandbox
environment and analyzing the side effects on the operating
system to determine malicious behaviors.
The attachments are detonated within a sandbox
the exact same way as they would be if an actual user had
clicked on it.
This is done in a matter of minutes
prior to the delivery of the email
and provides users with an extra layer of security.
You can enable Security Sandbox by simply
enabling this checkbox.
Additionally, you can setup custom rules
for when to run the Security Sandbox by creating a Security
Sandbox rule.
This will allow you to create custom logic like exempting
intradomain traffic from sandboxing or exempting traffic
from a particular IP.
Finally, using content compliance rules,
you can move malware caught by the sandbox
straight to an admin-controlled quarantine.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]