8: Enable Google Drive Security

Google Drive Security secures sensitive files synced from Google Drive. It detects files with improper sharing and excessive permissions, external applications with excessive file access, and orphaned file sharing from offboarded accounts, then allows you to take action right from Material.

File detections are enabled immediately and start identifying potential issues right after you connect your tenants, but you're not yet responding (remediating). Follow the steps in this guide to configure response and enable remediation.

Review File Detections

First, familiarize yourself with file-specific detections:

1. From the left navigation, click Detections.
2. Click Filters, then select Entity Type, then File.
3. Browse the existing detections, then update your preferred default Severity as needed.

Detection detail view

Enable Shared Drive Syncing

To send responses to Shared Drive Admins, shared drive syncing needs to be enabled. To confirm this:

1. From the left navigation, expand Google Drive Security, then click Settings.
2. Toggle Shared Drive Syncing to On.

   

Default Responses

Responses for file detections are configured per detection. Response options include:

Add Labels

Automatically add or remove labels from files that match this detection like "Sensitive," "Internal," etc.

The labels themselves are managed in your Google Admin console. In Material, choose from your existing labels.

Send email

When a file detection creates an issue, you can send an email informing the recipient of the issue and asking them to fix it if needed. Using variables, the default message informs the recipient that a specific file name has an issue, and references the detection name so they know what the issue is. It also includes a link to the file so the recipient can fix the issue.

You can customize these emails as needed, and even send multiple emails in response to one issue separated by a period of time.

Time delay

You can include a time delay before adding another action.

For example, sometimes sending an initial email then giving the recipient time to rectify the issue is the best path. Add a time delay between the initial email and another action:

Update Permissions

Automatically update permissions on files that match this Detection. Remediation will only affect the matched files and won't update permissions inherited from a parent folder or Drive.

Permissions in Google Docs

Options include:

• Revoke Permissions

  • Update general access permissions to revoke, viewer, commenter or editor
  • Update permissions for accounts with direct access (customize to internal and external access)
• Add Permissions

  • Select specific Google groups or accounts to assign permissions for this file to

Configure Default Response

1. From the left navigation, click Detections.
2. Click Filters, then select Entity Type then Files.
3. Browse the existing File Detections.
4. Open the detection then set the default response as needed:

1. Detections are enabled at out of the box; as soon as you set your default response it is enabled. From this detection detail screen, you can also disable the Detection. At deployment, we recommend you leave them enabled and let them run before revising:

At this point, you've configured default responses but you have not enabled them completely yet. Follow the steps in Enable File Remediation below to ensure you deploy completely.

Enable File Remediation

Now that you've configured your default responses, enable File Remediation so they will take affect.

Enable Remediation Globally

1. As a super admin, log in to your Material instance.
2. From the top toolbar, click Settings , then click Default Account Settings.
3. Under Remediations, toggle File Remediation to On.

   

Enable Remediation Per User or Group

Once you enable File Remediation, it's enabled globally across all tenants. However, you can also disable it for specific groups and users while maintaining the global enablement.

1. As a super admin, log in to your Material instance. If you're already logged in, navigate to the Workspace.
2. Click Explorer
3. Choose Accounts to disable for specific users, or Groups to disable for a group of users.
4. Check the boxes for the accounts or groups you want to disable, then click Edit Settings.
5. Under Remediations, select Override File Remediation, then toggle it Off.

   

Inherit maintains the Global setting for File Remediation, described above.

Google Drive Security is now enabled. Before moving on to configure Account Security, take a moment to learn about bulk remediation below:

How to Bulk Remediate

Auto-response is best practice. If you need to revoke access manually for any reason, do this in the Explorer. Try this example to familiarize yourself with this process:

1. From the workspace left navigation, click Explorer, then Files.
2. The Explorer uses MQL, a querying language unique to Material. Use the query builder to search for files with issues. In this example, we built the query shared.externally and location.is_my_drive with the Explorer tools:

   

   Search for files in the Explorer. Learn more about File Search here.
3. Check the boxes for any files you want to revoke access to immediately, then click Revoke External Access:

Revoke external access to multiple files

1. Select the domain(s) to revoke access to:

Revoke access to a specific domain

1. Optionally, revoke Set General Access to Restricted:

Toggle on to Set General Access to Restricted