What is Data Loss Prevention for Google?

Data Loss Prevention for Google refers to Google Workspace DLP, a security feature within Google that detects and prevents the loss or leak of sensitive data from the Google platform.  

Google Workspace, formerly known as G Suite, is a cloud-based platform for productivity and collaboration that includes many of Google’s most-used apps, including Gmail, Calendar, Drive, Docs, Meet, Chat, Sheets, Slides, Forms and Sites.  

To prevent inadvertent or malicious leaks of sensitive information, Workspace DLP scans an organization’s Google accounts in search of any data that violates DLP policies. When a policy violation is discovered, Workspace DLP may take actions such as blocking the data from leaving the organization, quarantining an email, encrypting a file or alerting security teams. 

While Workspace DLP offers strong Data Loss Prevention for Google environments, it does not offer comprehensive DLP protection for other cloud platforms or on-premises environments. Consequently, many organizations choose to implement additional solutions for unified web, cloud, email and endpoint Data Loss Prevention. 

Sensitive data includes customer information, Social Security numbers, credit card data, intellectual property, trade secrets, financial statements, business plans and personal health information. 

Sensitive data within Google Workspace may be leaked or lost in several ways: 

• Unintentional leaks. When employees fail to follow security guidelines or practice good security hygiene, data within Google may be inadvertently shared with unauthorized users. For example, employees might send a confidential email to the wrong recipient list or forget to encrypt a file before sending it as an attachment. IT teams might fail to correctly configure permissions to folders, accidentally allowing sensitive data to be accessed by anyone. 
• Insider threats. Insider threats can be potent within Google Workspace because it’s difficult to verify that users are who they say they are. These threats include employees who send intellectual property to a competitor or copy sensitive customer information to sell on the dark web. 
• External threats. Data can be leaked or stolen by malicious actors who gain access to Google Workspace. Criminals often use social engineering attacks like phishing scams to steal credentials and gain access to online accounts to exfiltrate high-value data assets. 

Data Loss Prevention for Google Workspace (formerly Data Loss Prevention for G Suite) enables administrators to set DLP policies from the admin console. Policies include rules for how users may access and share files with people outside the company, helping to prevent accidental exposure of sensitive information. Policies include rules and triggers for different DLP incidents, with each incident triggering an action such as blocking content or alerting security teams. 

The process for achieving Data Loss Prevention in Google Workspace includes: 

• Setting rules. Administrators define a DLP rule. 
• DLP scan. Google scans the workspace environment for DLP incident triggers. 
• Action. DLP enforces the admin-defined actions. 
• Alerts and reporting. DLP alerts admins of violations. 

Data Loss Prevention for Google Workspace may be used to: 

• Inventory the sensitive content that has already been uploaded and stored within Google Drive by users. 
• Issue warnings to end users not to share sensitive content outside of Google Workspace. 
• Block users from sharing sensitive data like Social Security numbers or credit card information with external users. 
• Alert security teams and administrators about violations of DLP policies. 
• Investigate DLP incidents. 

In addition to Google Workspace DLP, Google also offers Google Cloud Data Loss Prevention, a fully managed enterprise-grade DLP service. 

Google Workspace DLP can be effective at stopping data leaks and loss within Google, but it does not provide a comprehensive solution for managing DLP across the entire organization. That means, in addition to managing Data Loss Prevention for Google data, security teams will also need to manage additional tools for other environments on-premises and in the cloud. 

Additionally, Data Loss Prevention for Google Workspace may not provide the granular control or accuracy that organizations need to ensure compliance with data privacy regulations. Workspace DLP may also fail to detect certain types of sensitive data or generate more false positives than security teams find acceptable. 

As a result, many IT teams bolster Data Loss Prevention in Google Workspace by deploying a third-party solution that offers comprehensive coverage across the organization. 

Forcepoint DLP is the industry’s most trusted solution, providing IT teams with tools to easily manage global policies for endpoint, network, web, email, private apps and cloud Data Loss Prevention. Predefined templates, policies and classifiers simplify DLP and streamline incident management. Forcepoint DLP mitigates risk by bringing visibility and control everywhere employees work and anywhere data resides. 

With Forcepoint DLP, organizations can: 

Discover, classify, monitor and protect data intuitively with zero friction to the user experience. 

Audit user behavior in real time with Risk-Adaptive Protection to stop data loss before it occurs. 

Control all data with a single policy. 

Configure DLP policies once and apply them throughout the organization. 

Simplify compliance across 80+ countries with the industry’s largest pre-defined policy library. 

Protect critical intellectual property with unsurpassed accuracy, following data in both structured and unstructured forms and stopping low and slow data theft even when users are off network. 

Contact Forcepoint to learn more about Data Loss Prevention for Office 365 as well as other cloud platforms, or to inquire about Data Loss Prevention software costs.