[MUSIC PLAYING]
CHAD TYLER: Welcome to the Google Cloud Security Showcase,
a special web series where we'll focus on security use cases
that customers can solve with G Suite.
My name is Chad, and I'm a product manager
with Google Cloud.
Today, we'll be walking through one of the top questions we
get from customers.
How can I help prevent, detect, and remediate
data exfiltration?
And we'll show you a little bit of how you can do that.
So we're going to start off by showing you how you can prevent
data exfiltration first.
So we're going to start off in the Admin Console
and come to the left-hand menu and go to Rules here.
And this is where you can create Data Loss Prevention
rules, or DLP rules.
And in our scenario, we have a project that is very sensitive
called Project Utopia.
We don't want it to be shared externally.
So what we've done is we've come in,
and we've created a DLP rule that
blocks the sharing of this.
So we'll dig into this a little bit more
and show you how this is set up.
We've named this Project Utopia.
We've said this rule applies to all Google Drive files.
If anything matches the word utopia,
we want this rule to trigger.
And we want it to block external access
or block external sharing from happening.
And so we've created this rule.
And now I want to show you what it looks
like from the end-user view.
So if we come to a file that contains the word utopia, what
we can see here is it's talking about our sensitive project.
But when you look at the Sharing option,
it actually changes what this Sharing icon looks like.
So instead of the normal Sharing icon, you have a shield here,
and if you hover over the button,
it says that the document contains sensitive content.
So that's really important because what we're doing
is we're helping to educate users
and helping them to understand that this
is something that's sensitive.
It's something they shouldn't be sharing.
So beyond just blocking them from sharing,
it also helps to educate the end-users.
Now, if they decide that they want to share this anyway,
let's say we come in here and we say that we want to share this
to anyone on the web, if we try to save that,
we get back an error saying, this cannot be shared
externally.
It's sensitive.
So we reconfirm that, and we block the user from doing this.
One of the really nice things about data loss prevention
rules is that they prevent the sensitive sharing
from happening.
So it's not something you need to go in and clean up.
So that's a great way to prevent data exploitation
from ever happening.
But as admins, we know that we can't identify everything
before the fact.
And so it's also important to have ways
to detect and remediate issues.
So what we're going to do is we're
going to jump into the Investigation Tool, which
is part of the Security Center.
And we're going to show you how you could detect an issue
and remediate that issue.
So we'll come down to Drive Log Events.
And in our scenario, let's say that we have a user that we're
worried about, whether they're thinking
about leaving the company or they have other risk factors.
We're going to use me as a bad example
here and use Chad Tyler.
And let's look for any time that that user has
shared a file that was internal, and they
shared that file externally.
So we'll look for a visibility change.
And we'll search for that.
So the Investigation tool is great to help you quickly
look through what's happening in your organization and filter
things down so you can find the most important events.
And so we get results back here.
And again, we see things that are very sensitive,
files that we probably don't want shared externally.
So we can quickly detect that there's an issue there.
We can select these files and go to Actions, Audit File
Permissions, and then right from here
we can change the sharing on any of these files.
So if, for instance, there's this user that's external
and we don't want them to have access,
we can quickly remove their access.
Or we can act on many files at once
and remove their access from these files.
So we can quickly go and get ourselves
back into a good state so that we no longer
have to worry about that issue or those files being
shared externally anymore.
And so that's a quick view about how you can prevent using DLP
and how you can detect and remediate
using the Investigation tool.
So in that demo, we showed you how
you can prevent data exfiltration using G Suite's
Data Loss Prevention product.
And we also walked you through how
you can detect and remediate data exfiltration
using the Investigation tool within G Suite Security Center.
I just want to thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]