Embedded Files
As the Google Workspace Administrator, it’s important you’re comfortable with the Data Loss Prevention (DLP) workflow. Click on each of the cards below for a quick summary before you practice these steps in the Google Admin console:
Context-Aware Access (CAA)
Context-Aware Access (CAA)
DLP rules can be created with Context-Aware Access (CAA) conditions in the Frontline Standard and Frontline Plus, Enterprise Standard and Enterprise Plus, Education Standard and Education Plus, and Enterprise Essentials Plus Google Workspace editions.
Using CAA, you can create granular access control security policies for apps based on attributes such as user identity, location, device security status, and IP address.
Context-Aware Access conditions can be used to:
Allow access to apps only from company-issued devices.
Allow access to Drive only if a user storage device is encrypted.
Restrict access to apps from outside the corporate network.
To enforce CAA policies, you and your users must have Endpoint Verification turned on.
Let's see the scene
Let's see the scene
In this exercise, you’ll configure a DLP rule and action with Context-Aware Access.
Please note: If you enforce a desktop device policy, your users must use the Chrome browser and install the Endpoint Verification Chrome extension, but we will skip this step for the purpose of this exercise.
Lars has sent you an email asking how to enforce a new device policy.
Exercise directions
Exercise directions
Part 1: Turn on Context-Aware Access (CAA) and create an access level
Step 1
If you’re not already signed in, sign in to your domain as the Administrator at admin.google.com.
Step 2
From the main menu, navigate to Security, then select Access and data control, and click Context-Aware Access.
Step 3
If Context-Aware Access is not already turned on, click TURN ON.
Step 4
If no access levels have been created yet, click CREATE ACCESS LEVEL. Otherwise, click on the Access levels section first, before clicking CREATE ACCESS LEVEL.
Step 5
Enter Device conditions for DLP in the Access level name field.
Step 6
In the Context conditions section, under the BASIC tab, click ADD CONDITION.
Step 7
Ensure Meets all attributes (AND) is selected. From the Select attribute dropdown menu, select Device.
Step 8
From the Select condition dropdown menu, select Admin-approved.
Step 9
Click CREATE.
-- --
Part 2: Create DLP rule to enforce access level
Step 1
After creating the access level, you will be directed to a screen where you can decide how to use this access level. From this page, click CREATE RULE.
Step 2
Enter Device policy as the name for the rule.
Step 3
In the Scope section, choose All in <yourdomain>.
Step 4
Click CONTINUE.
Step 5
In the Apps section, check the box next to Drive files.
Step 6
Click CONTINUE.
Step 7
In the Context conditions section, click the radio button next to Select an access level. Then select the radio button next to the access level you just created.
Step 8
Click CONTINUE.
Step 9
In the Actions section, select Disable download, print, and copy from the dropdown menu.
Step 10
Click CONTINUE.
Step 11
Review the rules on the Review page, and click CREATE. You should now see the new rule in the Data protection rules list.
Notes
Notes
It can take up to 24 hours for a DLP policy to take effect.
DLP rules do not guarantee that all sensitive data will get caught and flagged. There might be false positives and negatives.
DLP converts Drive files into a scannable format, which includes file content and file format data, and then scans the resulting file. For a converted file larger than 1 MB, DLP scans only the first 1 MB of the converted file. Files that are larger than 50 MB aren't converted for scanning. Also, some files larger than 10 MB might not be converted. DLP will scan a file's title and labels for files of all sizes.
There is a time lag between when an alert occurs and when it is logged. Admins can receive up to 50 alerts per rule per day, receiving alerts until this threshold is met.
Help Center resources
Help Center resources
You can explore more about configuring DLP rules and context-aware access in the Google Workspace Admin Help Center.
Page updated
Report abuse