Google Drive add-ons encourage a new level of collaboration and productivity, extending Drive with a range of
functionalities, from language translation tools to document signing programs. Naturally, this is great for users. In an effort to achieve business objectives through the adoption of powerful SaaS offerings, users self-select add-ons, unaware of the permissions requested and the potential security implications.
Here are three steps to begin addressing the security concerns surrounding Drive add-ons. Looking to get a jump start on securing your Google Drive domain? Try CloudLock for Google Apps free for 14 days.
1) What’s in Your Environment? Find Out.
When users enable Google Drive add-ons using their corporate credentials, a pathway is opened between their enterprise’s domain and the add-on through OAUTH. This path is open in an “always on” manner. This means that if an add-on has access to manage and delete files in a user’s drive, it may do so around the clock.
This pathway is not malicious by design, and allows for an exchange of data enabling powerful add-on functionality. Nonetheless, it creates the potential for exploitation if: 1) the add-on is not trustworthy, or 2) the add-on were compromised.
The most significant factor in determining the consequent risk is the access scope of the add-on’s permissions. To understand the potential risk these introduce, consider the following example. Many assume add-on’s are only targeting a user’s contacts, or equally harmless data.
However, some permissions enable substantially wider access and greater control, as we can see in the image. Users would be surprised, and IT would be concerned, by the access scope of many of these applications, including permission to create, manage, delete, and modify files within the domain.
We recommend a discovery to surface which add-ons are enabled by your users through their corporate credentials.
2) Separate the Good From The Bad.
The access scope of add-ons is merely a potential threat until it is realized through a compromise. Many application developers incorporate strict security practices as they release their apps. However, malicious actors have realized the substantial domain access potential and have begun to target add-on developers accordingly.
If an add-on enabled in your environment is compromised by a hacker, the hacker can act on behalf of the user by leveraging the permissions granted through OAUTH. Given the damage this could yield, organizations must minimize the potential risk surface.
While businesses can’t control the security at the developer end, they can exercise risk-appropriate controls by whitelisting and blacklisting add-ons based on corporate security policies. Additionally, consider instituting a solution to enable the automatic classification of add-ons as well as the revocation of risky ones.
One of the strongest tools in the IT Security arsenal is education. With the recent explosion of data and increase of access points into a domain, users have become an agent on behalf of IT of sorts, possessing a great deal of power to either introduce or prevent security risk. A typical user may not know even they are connecting an add-on using corporate credentials, or be aware of the potential risk associated.
Discuss excessive access scopes with users and share the potential security impact this behavior has on the organization, discussing the reasons for whitelisting or blacklisting certain add-ons. By keeping an open line of communication and incorporating education in security strategy, secure behaviors will be encouraged and the resources spent policing users will decrease.
Gaining visibility and control over Drive add-ons connected to your domain is critical to the overall security of your organization’s data. Take the following steps to make sure you’re covered:
- Discover what add-ons are connected to the domain. Understanding the scope of access for each.
- Classify each based on its potential risk and whitelist or blacklist add-ons based on your business’ classification parameters and user need.
- Control by denying the enablement of new add-ons in your domain until you review them to shift from a reactive to a proactive security strategy. Revoke access to add-ons in extreme cases.
- Educate your users. Users are likely unaware of the security implications of add-ons and may not have intended to use their corporate credentials.
Ready for More?
In our eBook, you will learn strategy and tactics every organization can leverage to complement Google’s data protection capabilities, with a specific focus on behavioral security.
The eBook discusses data security and compliance within Drive, dives into the power of securely enabling collaboration, speaks to the value, risk, and potential controls around 3rd party SaaS apps, examines the benefits of file-level encryption, and finishes with actionable tips to make it all happen.