Pro Tip: Exercise Caution with G Suite Marketplace Apps

Published on 23rd June 2020 Author: Rob Black

G Suite Marketplace Apps are “applications that can be added to an entire domain or to individual G Suite accounts.”

They integrate with the Admin console and make it easy to complete common tasks (mail merges, form publishing, password management, etc.) or connect to frequently used apps like Dropbox or Zoom.

And, they have a “bonus” feature: They want to take over your G Suite!

That’s because installing a G Suite App is an all or nothing proposition. You can’t cherry-pick permissions — installing one requires ceding whatever control of data and functionality the app demands.

There’s no simple way to vet the security expertise behind a given app’s creator (some of these companies are made up of just a few people), but you can mitigate your risk should one of them become compromised:

Establish an approval process. Adding apps to G Suite needs to be a centralized endeavor.
Investigate the permissions required. Do you want to install an app that can send emails on your behalf? Read and delete your Google Drive information? (I’m going to suggest “No” on both of these.)
Install nonessential apps as an “Individual Install” rather than Domain-level. This will scope permissions to a single user.
Consider creating a user with limited permissions. The installed app won’t be able to see most of your company’s folders while still allowing you to use it.

As with many security challenges, it is often our own actions that open the door to nefarious actors. Make sure you know who’s knocking!

Rob Black, CISSP

Rob founded Fractional CISO in 2017 and has helped dozens of companies improve their security posture as a vCISO. He consults, speaks, and writes on IoT and security. Rob has held product security and corporate security leadership positions at PTC ThingWorx, Axeda and RSA Security. He received his MBA from the Kellogg School of Management and holds two Bachelor of Science degrees from Washington University in St. Louis in Computer Science and System Science and Engineering. He is also a Certified Information Systems Security Professional (CISSP).