Google Workspace (formerly G Suite) powers millions of businesses worldwide, including a significant number of London startups and SMBs. Its convenience and collaboration features make it an excellent choice—but out-of-the-box configurations often leave businesses vulnerable. Proper cloud solutions management is essential to secure these platforms.
The Security Gap
Many businesses assume that because Google is a tech giant, their Workspace is automatically secure. This misconception can be costly. While Google provides robust infrastructure security, the configuration and management of your Workspace is your responsibility.
Essential Security Settings
1. Enable 2-Step Verification (2SV)
This should be your first priority. Enforce 2-step verification for all users, ideally using security keys or the Google Authenticator app rather than SMS (which can be intercepted).
To enable: Admin console → Security → 2-Step verification → Turn on enforcement
2. Configure Security Alerts
Google can notify you of suspicious activities. Ensure these alerts are enabled and sent to the right people:
- Suspicious login activity
- Mobile device compromise
- Leaked passwords
- Government-backed attack warnings
3. Review Third-Party App Access
Users often grant access to third-party apps without understanding the implications. Review and restrict which apps can access your organisation's data:
- Navigate to Security → API controls → App access control
- Review connected apps
- Remove any untrusted or unnecessary applications
- Set policies for future app approvals
4. Configure Gmail Security
Email remains the primary attack vector. Configure these settings:
- SPF, DKIM, and DMARC: Prevent email spoofing (our cybersecurity services include email authentication setup)
- Advanced phishing protection: Enable all available filters
- Attachment security: Block risky file types
- Link protection: Enable scanning of links in emails
5. Drive Sharing Settings
Unrestricted sharing can lead to data leaks. Configure sensible defaults:
- Disable link sharing outside your organisation by default
- Require sign-in for accessing shared files
- Set expiration dates on external sharing
- Enable Drive activity auditing
Advanced Security Features
If you have Google Workspace Business Plus or Enterprise, take advantage of advanced features:
Context-Aware Access
Control access based on user identity, location, device security status, and IP address. This is particularly valuable for businesses with remote workers or BYOD policies.
Data Loss Prevention (DLP)
Automatically detect and protect sensitive data like credit card numbers, National Insurance numbers, or custom patterns specific to your business.
Security Investigation Tool
Investigate security incidents with detailed logs and take remediation actions directly from the admin console.
Regular Security Audits
Security isn't a one-time setup. Schedule quarterly reviews of:
- User accounts and access levels
- Connected third-party apps
- Security alert logs
- External sharing activity
- Admin role assignments
Getting Help
Properly configuring Google Workspace security can be complex, especially for businesses without dedicated IT staff. Working with a Google Workspace partner or managed IT provider can ensure your configuration follows best practices and remains secure as your business grows. If you're a startup looking for IT support, we can help you set up Google Workspace securely from day one.
