implementing-google-workspace-admin-security

实施 Google Workspace 管理员安全

何时使用

• 为企业用途部署或加固 Google Workspace 环境
• 针对 Google Workspace 配置进行 CIS 基准合规性评估
• 防御针对 Google 账户的商业电子邮件入侵（BEC）和钓鱼攻击
• 为 Gmail 和 Google Drive 实施数据丢失防护控制
• 限制 OAuth 应用访问和第三方集成
• 通过高级保护计划注册来配置管理员账户安全

请勿使用于 Microsoft 365 环境；Google Workspace 具有独特的管理控制台设置和 API 配置，与 Azure AD/Entra ID 控制项不同。

先决条件

• Google Workspace Business Plus、Enterprise Standard 或 Enterprise Plus 许可证
• 对 Google 管理控制台（admin.google.com）的超级管理员访问权限
• 用于配置 SPF、DKIM 和 DMARC 记录的 DNS 管理访问权限
• 用于高级安全功能的 Google Cloud Identity 或 Cloud Identity Premium
• 用于超级管理员账户的 FIDO2 安全密钥（推荐 YubiKey 5 系列）

工作流

步骤 1：加固超级管理员账户

保护 Google Workspace 租户中权限最高的账户：

# Google Workspace Admin SDK - configure admin account security
# Using gam (Google Apps Manager) CLI tool

# List all super admin accounts for audit
gam print admins role "Super Admin" > super_admins.csv
echo "Review and minimize super admin count (recommended: 2-3 maximum)"

# Enforce Advanced Protection Program for super admins
# APP provides strongest account protections:
# - Requires FIDO2 security key for sign-in
# - Blocks third-party app access to Gmail and Drive
# - Enhanced account recovery verification
gam update user [email protected] \
    advanced_protection true

# Create dedicated break-glass admin account
gam create user [email protected] \
    firstname "Break" lastname "Glass Admin" \
    password "$(openssl rand -base64 32)" \
    changepassword true \
    org "/Emergency Accounts"

# Assign super admin role to break-glass account
gam create admin [email protected] "Super Admin"

# Configure admin activity alerts
# Alert Center API - create alert for admin actions
cat > admin_alert_policy.json << 'EOF'
{
  "alertPolicies": [
    {
      "name": "Super Admin Sign-In Alert",
      "conditions": {
        "eventType": "login",
        "filterCriteria": "actor.adminRole=SUPER_ADMIN"
      },
      "notifications": {
        "email": ["[email protected]"],
        "webhook": "https://siem.corp.com/webhook/google-admin"
      }
    },
    {
      "name": "Admin Role Change Alert",
      "conditions": {
        "eventType": "admin_role_change"
      },
      "notifications": {
        "email": ["[email protected]"]
      }
    }
  ]
}
EOF

步骤 2：强制执行抗钓鱼的多因素认证

配置可消除可钓鱼认证因素的多因素认证策略：

# Enforce 2-Step Verification for all organizational units
# Using Admin SDK Directory API

# Enable 2SV enforcement for the entire organization
gam update org "/" settings \
    2sv_enforcement true \
    2sv_enrollment_grace_period 14 \
    2sv_new_user_enrollment_period 1

# Configure allowed 2SV methods - restrict to phishing-resistant only
# For high-security OUs: Security keys only
gam update org "/Executive" settings \
    2sv_allowed_methods "SECURITY_KEY_ONLY"

# For general staff: Security keys or phone prompts (no SMS/voice)
gam update org "/" settings \
    2sv_allowed_methods "SECURITY_KEY,PHONE_PROMPT" \
    2sv_disallowed_methods "SMS,VOICE_CALL,BACKUP_CODES"

# Bulk check 2SV enrollment status
gam print users \
    fields primaryEmail,isEnrolledIn2Sv,isEnforcedIn2Sv \
    query "isEnrolledIn2Sv=false" > users_without_2sv.csv

# Count users without 2SV
echo "Users without 2SV enrolled:"
wc -l < users_without_2sv.csv

# Configure context-aware access policies
# Require 2SV + managed device for sensitive apps
cat > context_aware_policy.json << 'EOF'
{
  "accessLevels": [
    {
      "name": "Managed Device Required",
      "conditions": {
        "devicePolicy": {
          "requireScreenLock": true,
          "requireAdminApproval": true,
          "allowedEncryptionStatuses": ["ENCRYPTED"],
          "requireCorpOwned": false
        },
        "requiredAccessLevels": ["VERIFIED_2SV"]
      }
    }
  ],
  "applicationPolicies": [
    {
      "applications": ["Google Drive", "Gmail", "Admin Console"],
      "accessLevel": "Managed Device Required"
    }
  ]
}
EOF

步骤 3：配置电子邮件认证和反钓鱼

设置 SPF、DKIM、DMARC 以及高级钓鱼防护：

# Step 3a: Configure SPF record
# Add to DNS TXT record for corp.com
echo 'DNS TXT Record for SPF:'
echo 'corp.com TXT "v=spf1 include:_spf.google.com ~all"'
echo ''
echo 'After testing, change ~all to -all (hard fail) for enforcement'

# Step 3b: Generate and configure DKIM signing
# Generate 2048-bit DKIM key via Admin Console or API
gam create dkim domain corp.com selector google bitlength 2048

echo 'Add DKIM DNS TXT record:'
echo 'google._domainkey.corp.com TXT "v=DKIM1; k=rsa; p=<public_key_from_admin_console>"'

# Verify DKIM is working
gam info dkim domain corp.com

# Step 3c: Configure DMARC policy
echo 'DNS TXT Record for DMARC (start with monitoring):'
echo '_dmarc.corp.com TXT "v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100; adkim=s; aspf=s"'
echo ''
echo 'After 30 days monitoring, escalate to quarantine then reject:'
echo '_dmarc.corp.com TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100; adkim=s; aspf=s"'

# Step 3d: Enable advanced phishing and malware protection
# Configure in Admin Console > Security > Email Safety
gam update settings email_safety \
    protect_against_domain_spoofing true \
    protect_against_employee_spoofing true \
    protect_against_inbound_spoofing true \
    protect_unauthenticated_email true \
    identify_spoofed_groups true \
    auto_move_suspicious_to_spam true

# Configure attachment security
gam update settings email_safety \
    protect_encrypted_attachments true \
    protect_anomalous_attachment_types true \
    protect_scripts_from_untrusted true \
    whitelist_sender_domains "" \
    apply_future_recommended_settings true

步骤 4：实施数据丢失防护（DLP）

配置 DLP 规则以防止敏感数据外泄：

# Create DLP rules for Gmail and Drive
# Using Google Workspace DLP API

cat > dlp_rules.json << 'EOF'
{
  "dlpRules": [
    {
      "name": "PII Detection - SSN",
      "description": "Detect Social Security Numbers in outbound email and Drive sharing",
      "trigger": {
        "contentMatchers": [
          {
            "infoType": "US_SOCIAL_SECURITY_NUMBER",
            "likelihood": "LIKELY",
            "minMatchCount": 1
          }
        ],
        "scope": ["GMAIL_OUTBOUND", "DRIVE_EXTERNAL_SHARE"]
      },
      "action": {
        "blockAction": "QUARANTINE",
        "notifyAdmin": true,
        "notifyUser": true,
        "userMessage": "This message contains a Social Security Number and has been quarantined for review.",
        "auditLog": true
      }
    },
    {
      "name": "Credit Card Number Detection",
      "description": "Block credit card numbers in outbound communications",
      "trigger": {
        "contentMatchers": [
          {
            "infoType": "CREDIT_CARD_NUMBER",
            "likelihood": "LIKELY",
            "minMatchCount": 1
          }
        ],
        "scope": ["GMAIL_OUTBOUND", "DRIVE_EXTERNAL_SHARE", "CHAT"]
      },
      "action": {
        "blockAction": "BLOCK",
        "notifyAdmin": true,
        "notifyUser": true,
        "auditLog": true
      }
    },
    {
      "name": "Confidential Document Detection",
      "description": "Detect documents marked as Confidential or Internal Only",
      "trigger": {
        "contentMatchers": [
          {
            "customRegex": "(?i)(CONFIDENTIAL|INTERNAL ONLY|DO NOT DISTRIBUTE|RESTRICTED)",
            "minMatchCount": 2
          }
        ],
        "metadataMatchers": [
          {
            "driveLabels": ["Confidential", "Restricted"]
          }
        ],
        "scope": ["DRIVE_EXTERNAL_SHARE"]
      },
      "action": {
        "blockAction": "WARN",
        "requireJustification": true,
        "auditLog": true
      }
    }
  ]
}
EOF

echo "Apply DLP rules via Admin Console > Security > Data Protection"
echo "Or use the Google Workspace DLP API for programmatic deployment"

步骤 5：控制 OAuth 应用和第三方访问

限制哪些第三方应用可以访问组织数据：

# Configure OAuth app access control
# Admin Console > Security > API Controls > App Access Control

# Block all third-party apps by default, then allowlist approved ones
gam update org "/" settings \
    third_party_app_access "BLOCKED" \
    allow_users_to_install_apps false

# Allowlist approved applications
cat > approved_apps.json << 'EOF'
{
  "allowedApps": [
    {
      "appId": "slack-app-id",
      "name": "Slack",
      "scopes": ["gmail.readonly", "calendar.readonly"],
      "approvedBy": "security-team",
      "reviewDate": "2026-01-15"
    },
    {
      "appId": "zoom-app-id",
      "name": "Zoom",
      "scopes": ["calendar.events"],
      "approvedBy": "security-team",
      "reviewDate": "2026-01-15"
    },
    {
      "appId": "salesforce-app-id",
      "name": "Salesforce",
      "scopes": ["gmail.send", "contacts.readonly"],
      "approvedBy": "security-team",
      "reviewDate": "2026-01-15"
    }
  ]
}
EOF

# Audit current OAuth tokens granted by users
gam all users print tokens > oauth_tokens_audit.csv
echo "Review oauth_tokens_audit.csv for unauthorized third-party access"

# Revoke tokens for unapproved applications
gam all users deprovision tokens \
    clientid "unapproved-app-client-id"

# Configure API scopes restriction
# Limit which API scopes third-party apps can request
gam update org "/" settings \
    api_access_restricted true \
    allowed_api_scopes "gmail.readonly,calendar.readonly,drive.readonly"

步骤 6：配置外部共享和 Drive 安全

锁定数据共享控制项：

# Configure Google Drive sharing restrictions
gam update org "/" settings \
    drive_sharing_outside_domain "WHITELISTED_DOMAINS" \
    drive_sharing_whitelisted_domains "partner1.com,partner2.com" \
    drive_allow_file_requests false \
    drive_shared_drive_creation "ADMIN_ONLY" \
    drive_default_link_sharing "RESTRICTED"

# Configure sharing alerts
gam create alert \
    name "External Sharing Alert" \
    type "drive_external_share" \
    condition "shared_outside_domain=true AND file_type IN ('spreadsheet','document','presentation')" \
    action "notify_admin [email protected]"

# Audit current external shares
gam all users print filelist \
    fields id,name,owners,permissions \
    query "visibility='anyoneWithLink' or visibility='anyoneCanFind'" \
    > external_shares_audit.csv

echo "External shares requiring review:"
wc -l < external_shares_audit.csv

# Configure Google Groups security
gam update org "/" settings \
    groups_external_members false \
    groups_external_posting false \
    groups_creation "ADMIN_ONLY" \
    groups_allow_external_invitations false

关键概念

术语	定义
高级保护计划（APP）	Google 最强的账户安全措施，要求使用 FIDO2 安全密钥、阻止第三方应用访问，并为账户恢复增强身份验证
情境感知访问	在授予对 Google Workspace 应用的访问权限之前，评估设备状态、位置和用户身份的安全策略框架
DMARC	基于域的消息认证、报告和一致性协议，通过验证 SPF 和 DKIM 对齐来防止电子邮件域名欺骗
DLP 规则	数据丢失防护策略，扫描 Gmail、Drive 和 Chat 中的内容以查找敏感数据模式，并触发阻止、隔离或警告操作
OAuth 应用允许列表	管理员控制项，限制哪些第三方应用可以通过 Google OAuth API 范围访问组织数据
两步验证（2SV）	Google 的多因素认证实现，支持安全密钥、手机提示、TOTP 和备用验证码作为第二因素

工具与系统

• Google 管理控制台：基于 Web 的管理门户，用于管理所有 Google Workspace 安全设置、用户和组织部门
• GAM (Google Apps Manager)：用于批量 Google Workspace 管理和自动化的开源命令行工具
• Google Workspace Alert Center：集中式仪表板，用于显示安全警报，包括可疑登录活动、DLP 违规和设备入侵
• Google BeyondCorp Enterprise：与 Google Workspace 集成的零信任访问解决方案，用于情境感知访问策略

常见场景

场景：保护新收购的 Google Workspace 租户

背景：收购后的安全审计发现，被收购公司的 Google Workspace 未强制实施 MFA、外部共享处于开放状态、没有 DLP 策略，且有多个未经授权的 OAuth 应用在访问用户数据。

方法：

1. 立即使用 FIDO2 安全密钥为所有超级管理员账号强制实施 2SV
2. 将超级管理员数量缩减至 3 个（主管理员、副管理员、应急管理员）
3. 部署 SPF、DKIM 和 DMARC，先以监控模式（p=none）开始
4. 在 Email Safety 中启用所有反钓鱼和反欺骗设置
5. 审计并撤销所有未经授权的 OAuth 应用令牌
6. 将第三方应用访问设置为阻止，并使用已批准应用的白名单
7. 将外部 Drive 共享限制为仅允许已批准的合作伙伴域
8. 为 PII、财务数据和机密文档部署 DLP 规则
9. 启用上下文感知访问，要求敏感应用必须使用受管设备
10. 配置安全告警和 SIEM 集成以进行持续监控

陷阱：

• 在没有注册宽限期的情况下强制实施 MFA 会将用户锁定在账号之外
• 在监控期之前将 DMARC 设置为拒绝会导致合法邮件投递失败
• 在未识别业务关键集成的情况下阻止所有 OAuth 应用会中断工作流
• 在限制共享之前未审计现有外部共享会使数据处于暴露状态

输出格式

GOOGLE WORKSPACE SECURITY ASSESSMENT REPORT
=============================================
Tenant:            corp.com
License:           Enterprise Plus
Total Users:       3,847
Organizational Units: 12

AUTHENTICATION SECURITY
2SV Enforced:           YES (all OUs)
2SV Enrollment:         3,712 / 3,847 (96.5%)
Security Keys Only:     Executive OU (47 users)
Advanced Protection:    3 super admin accounts
Super Admin Count:      3 (within recommended limit)

EMAIL AUTHENTICATION
SPF:                    CONFIGURED (hard fail: -all)
DKIM:                   CONFIGURED (2048-bit, selector: google)
DMARC:                  ENFORCED (p=reject, 100%)
Anti-Phishing:          ALL PROTECTIONS ENABLED
Anti-Spoofing:          ENABLED (domain + employee name)

DATA PROTECTION
DLP Rules Active:       7
  PII Detection:        SSN, Credit Card, Passport
  Content Labels:       Confidential, Restricted
  Custom Patterns:      3 organization-specific rules
DLP Violations (30d):   89 (67 blocked, 22 warned)

APPLICATION CONTROL
Third-Party App Policy: BLOCKED (allowlist mode)
Approved Apps:          12
Unauthorized Tokens:    0 (all revoked)
API Scope Restrictions: ENABLED

SHARING CONTROLS
External Sharing:       RESTRICTED (allowlisted domains only)
Public Link Sharing:    DISABLED
External Group Members: DISABLED
Shared Drive Creation:  ADMIN ONLY