#collaboration #infrastructure #email #phishing #iam #mfa #authentication #zerotrust ## Video ![](https://youtu.be/3y8kwvOk-3w) ## Why Google Workspace? Founders Firewall assumes you will be using [[Google Workspace]] with at least the Plus tier. Most of what we will do with Google is possible with a Microsoft 365 account, so feel free to apply the same concepts there if you decide to use 365. The reasons we're covering Google is simply because a lot of tech startups use Google Workspace + Slack, and the reason we'll need Plus is around mobile device management, and a few other security related features. One big feature that'll still be missing is [context-aware access](https://support.google.com/a/answer/9275380?hl=en), which requires an Enterprise account, which we'll buy later as it requires contacting sales 🤢. Without it, it's not possible to restrict access to company-owned devices easily, but right now, that's not an issue seeing as we do not even own a single company laptop. In general, when getting started, using a few core tools as much as possible is easier, which is why you should buy the highest Google Workspace edition you can afford, and not start by trying to mix and match third-party offerings. ## Main goals in this episode We want a collaboration platform that is **protected from credential phishing**, does **not leak data to hundreds of unapproved third-party apps in a year** and protects us and future customers from **malicious email** both in and out. ## Buy it Go and buy Google Workspace Business Plus edition, with the appropriate amount of licenses to get started. Increasing the count later is easy, no need to overshoot. Go through the wizard, using your personal credit card if you do not have a business one yet. *Tip*: When you do get a business credit card, make it the default, but leave yours as a backup, as Google Workspace is too important to risk having it disabled over a missed payment because a card was disabled! ## Checklist This list covers changes to be made. Good defaults are simply not mentioned and can be left as is. - [ ] Google Workspace Business Plus or above acquired - [ ] Payment information provided - [ ] The "other email address" provided is a personal Gmail with a strong 2SV policy (passkeys or security keys only) - [ ] TXT record for domain verification created - [ ] MX Record to receive email created - [ ] Enabled at least a passkey on the first Google user - [ ] Optional: Enabled a security key as MFA on the first Google user - [ ] Authentication settings - [ ] Passwordless enabled - [ ] Required MFA (Or as Google calls it, 2SV) on the org - [ ] New user enrollment grace period is 0, or max of 1 day - [ ] 2-Step Verification policy suspension grace period is set to 1 day - [ ] Supported modes is security keys only - [ ] Security codes are disabled - [ ] Advanced Protection Program is allowed - [ ] Ability to generate security codes for advanced protection program users is disabled - [ ] Password Managent settings - [ ] Password minimum length changed to 16 - [ ] Access and Data Controls - [ ] API Controls: Allow users to access third-party apps that only request basic info needed for Sign in with Google - [ ] Users are allowed to request access - [ ] Session Controls - [ ] Session length has been made shorter than 14 days - [ ] Device Bound Session Credentials enabled (Even though support is limited as of this video) - [ ] Optional: Google Cloud Session Controls - [ ] Re-authentication is required every 16 hours or less - [ ] Re-authentication is only allowed with security keys - [ ] Gmail settings - [ ] Authenticate Email - [ ] DKIM Record Generated and Configured as TXT Record - [ ] Start Authentication clicked (may require 48 hours delay) - [ ] Safety - [ ] Protect against encrypted attachments from untrusted senders sends to quarantine - [ ] Protect against attachments with scripts from untrusted senders sends to quarantine - [ ] Protect from anomalous attachments types in email sends to quarantine - [ ] Apply future recommended settings automatically is enabled - [ ] IMAP link protection is enabled (even though we will disable IMAP in the next section) - [ ] Apply future recommended settings automatically is enabled - [ ] Spoofing and Authentication - [ ] Protect against domain spoofing based on similar domain names sends to quarantine - [ ] Protect against spoofing of employee names sends to quarantine - [ ] Protected against unauthenticated email is enabled and sends to spam - [ ] Protect Google Groups from spoofing your domain is enabled and sends to quarantine - [ ] Apply future recommended settings automatically is enabled - [ ] End-user access - [ ] IMAP is disabled - [ ] POP is disabled - [ ] Google Workspace Sync for Outlook is disabled - [ ] Automatic Forwarding is disabled - [ ] Spam, phishing and malware - [ ] Enhanced malware and phishing protect is enabled. - [ ] Security sandboxing/virtual execution of attachments is enabled - [ ] A DMARC policy has been published as a TXT record with a reporting email address - [ ] The reporting email address has been created as a group - [ ] An SPF record has been created - [ ] Allow Super Admin Account Recovery is disabled (users too, but they are disabled by default) ## Next episode In the next episode, we'll look at Google's device management!