Posted by Alma Whitten, Director of Privacy, Product and Engineering

(Cross-posted on the Official Google Blog.)

Editor's note: Staying safe on the internet means being smart whenever you're online -- at home, at work and on your mobile device. The tips shared below are intended to help you protect yourself and your family. For more information about what Google does to protect our enterprise customers' data, check out our trust series on this blog and our security white paper.

Technology can sometimes be complicated, but you shouldn’t have to be a computer scientist or security expert to stay safe online. Protecting our users is one of our top priorities at Google. Whether it’s creating easy-to-use tools to help you manage your information online or fighting the bad guys behind the scenes, we’re constantly investing to make Google the best service you can rely on, with security and privacy features that are on 24-7 and working for you.

Last year, we launched Good to Know, our biggest-ever campaign focused on making the web a safer, more comfortable place. Today, on Safer Internet Day, we’re updating Good to Know to include more tips and advice to help you protect yourself and your family from identity theft, scams and online fraud. You can also learn how to make your computer or mobile device more secure, and get more out of the web — from searching more effectively to making calls from your computer. And you can find out more about how Google works to make you, your device and the whole web safer.


For example, we encrypt the Gmail and Google Search traffic between your computer and Google -- this protects your Google activity from being snooped on by others. We also make this protection, known as session-wide SSL encryption, the default when you’re signed into Google Drive. Because outdated software makes your computer more vulnerable to security problems, we built the Chrome browser to auto-update to the latest version every time you start it. It gives you up-to-date security protection without making you do any extra work.

Even if you don’t use Google, we work hard to make the web safer for you. Every day we identify more than 10,000 unsafe websites — and we inform users and other web companies what we’ve found. We show warnings on up to 14 million Google Search results and 300,000 downloads, telling our users that there might be something suspicious going on behind a particular website or link. We share that data with other online companies so they can warn their users.

We know staying safe online is important to you — and it is important to us too. That's why we've had independent third parties perform inspections and audits for the data protections in Google Apps.

Please take some time today to make your passwords stronger and turn on 2-step verification to protect your Google Account. Talk with friends and family about Internet safety. And visit our new Good to Know site to find more tips and resources to help you stay safe online.

Posted by Jack Halprin, Head of eDiscovery, Google

In March 2012, we launched Google Apps Vault, bringing enterprise-class information governance to Google Apps. Vault delivers retention, archiving and eDiscovery capabilities for email and chat messages, enabling businesses of all sizes to access and manage business-critical information. Vault offers true manage-in-place capabilities by applying retention policies directly to the Google Apps data, without the need to move, export, or create a copy of data in a separate location.

Google Apps Vault already archives, searches and manages messages in all languages that Google Apps supports (50+). Now the Google Apps Vault user interface is available in 28 languages, including double-byte languages like Japanese, Chinese and Arabic. This new, global Vault interface enables customers worldwide to more easily access and manage their data, further reducing the costs and risks that businesses today face.

"Google Apps Vault offers compelling capabilities and value for businesses around the world in preparing for litigation, investigation, and managing day-to-day business. Vault integrates seamlessly across the evolving Google platform while integrating with business and industries of all sizes. This is a key component in our forward thinking strategy to drive down costs and provide enhanced client service."

- Eric Hunter - Director of Knowledge, Innovation & Technology Strategies at Bradford & Barthel, LLP

Google Apps Vault is available for new and recent Google Apps for Business and Education customers. Existing customers will be able to deploy Google Apps Vault later this year.

Posted by Rishi Dhand, Product Manager, Google Apps

Keeping Google Apps accounts secure is important to us, and we've recently added two security features that can better protect user accounts. The first helps businesses deploy 2-step verification and the second enhances integration with Microsoft Active Directory®.

Since we launched 2-step verification, we’ve seen millions of users enable it and thousands more do so every day. 2-step verification requires two means of identification to sign in to a Google Apps account: something you know (a password) and something you have (a verification code from your mobile phone). Even if someone has stolen your password, they'll need more than that to access your account. This additional layer of security greatly reduces the chance of unauthorized access via account hijacking or other means.

Starting today, domain administrators can require the users in their domain to use 2-step verification. This new feature will help Google Apps customers accelerate their deployment of 2-step verification.

For businesses that use Microsoft Active Directory® (AD), we’ve added new capabilities to synchronize and manage passwords. Businesses can manage password policies (e.g. password strength, reset intervals, etc.) using AD and then synchronize from AD to Google Apps when passwords are changed. Passwords are transmitted hashed and encrypted during synchronization.

Learn how to configure this new 2-step verification policy in the Google Apps help center. Download the Google Apps Password Sync for Active Directory (GAPS), and learn how to configure it in the help center.

Posted by Eran Feigenbaum, Director of Security, Google Enterprise

In the early days of the cloud, security concerns were often at the top of business minds as they considered moving to Google Apps. More recently, though, security has become a major reason businesses are moving to the cloud. The reason for this shift is that businesses are beginning to realize that companies like Google can invest in security at a scale that's difficult for many businesses to achieve on their own. This investment has produced an infrastructure and a set of services with robust data protections for our customers.

Today we are proud to announce that Google Apps for Business has earned ISO 27001 certification. ISO 27001 is one of the most widely recognized, internationally accepted independent security standards and we have earned it for the systems, technology, processes and data centers serving Google Apps for Business. Our compliance with the ISO standard was certified by Ernst & Young CertifyPoint, an ISO certification body accredited by the Dutch Accreditation Council, a member of the International Accreditation Forum (IAF). Certificates issued by Ernst & Young CertifyPoint are recognized as valid certificates in all countries with an IAF member.

“As a multi-billion dollar, global provider of packaging and packaging solutions, MWV understands the value of international standards. Many of our own processes are ISO certified. So, I am thrilled that Google Apps, our core communications platform, is also now ISO certified with its recent ISO 27001 certification. This certification validates what I already knew, through due diligence, about Google Apps - that the technology, process and infrastructure offers good security and protection for the data that I store in Google Apps. I think it's important, find it assuring and am very pleased that Google Apps will be audited and certified to this Information Security Management System ISO standard on an ongoing basis”

- Chet Loveland, CISO and Global Compliance Officer, MWV

This new certification, along with our existing SSAE 16 / ISAE 3402 audits and FISMA certification for Google Apps for Government, help assure our customers that Google is committed to ongoing development and maintenance of a robust Information Security Management System (ISMS) that an independent, third-party auditor will regularly audit and certify. For more information on the security audits and certifications for Google Apps, please review our certification 1-pager.

Posted by Joe Kava, Senior Director, data center construction and operations

(Cross-posted from the Official Google Blog and the Google Green Blog.)

For the last year, our data center team has been working on a project to bring our facilities to even higher standards for environmental management and workforce safety. Recently we got the good news that our work paid off.

All of our U.S. owned and operated data centers have received ISO 14001 and OHSAS 18001 certification. We’re the first major Internet services company to gain external certification for those high standards at all of our U.S. data centers.



In a nutshell, both standards are built around a very simple concept: Say what you’re going to do, then do what you say—and then keep improving. The standards say what key elements are required, but not how to do it—that part’s up to us. So we set some challenging goals for ourselves, and we asked our auditors to confirm that we’ve followed through on them.

Here’s an example of the kind of improvements we’ve implemented: Like most data centers, ours have emergency backup generators on hand to keep things up and running in case of a power outage. To reduce the environmental impact of these generators, we’ve done two things: first, we minimized the amount of run time and need for maintenance of those generators. Second, we worked with the oil and generator manufacturers to extend the lifetime between oil changes. So far we’ve managed to reduce our oil consumption in those generators by 67 percent.

A second example: each of our servers in the data center has a battery on board to eliminate any interruptions to our power supply. To ensure the safety of the environment and our workers, we devised a system to make sure we handle, package, ship and recycle every single battery properly.

These are just two elements of what ultimately adds up to a comprehensive system of policies that our data center teams follow in their day-to-day operations. We do this because we want to be the gold standard in environmental and workforce safety, and because we care about the communities where we live and work. This is one more reason you can feel confident that when you're using our products, you're making an environmentally responsible choice.

Our data centers in the following U.S. locations have received this dual certification. We plan to pursue certification in our European data centers as well.

• The Dalles, Ore.


• Council Bluffs, Iowa


• Mayes County, Okla.


• Lenoir, N.C.


• Monck’s Corner, S.C.


• Douglas County, Ga.

Posted by Adam Swidler, Senior Manager, Google Apps Team

Editors note: This is the final post in a series that explores the top ten reasons why customers trust Google with their business data. A complete top ten list can be found here.

It’s important for all businesses regardless of size or industry to assess the risk of potential data breaches and take steps to prevent them, especially in the area of information technology. The use of laptops, smartphones, tablets and other mobile devices is increasing as users demand anytime, anywhere access to email and documents. This can increase the risk of a data breach if you’re using traditional applications which store a local copy of the data on the device and the device gets lost or stolen.

Google Apps can help reduce the risk of a data breach by limiting the data that is stored on your devices. When you check email or work on a document in a browser with Google Apps, the data is stored in our data centers, not on your device. That means that if your device gets lost or stolen, there is lower overall risk of a data breach. Similarly, if you collaborate with others in Google Docs, you don’t need to send them a copy of the document. You can enable and disable access to the document with a simple set of sharing controls and your collaborators access it from their browser. The document does not need to be stored locally on their device for them to collaborate on it.

For those times when you want to access Google Apps but you don’t have an Internet connection, we recently released an offline capability for Gmail and for Google Docs. The offline capability does involve some local data storage on devices. The amount of stored data is likely to be smaller as only a limited amount of documents and email are synchronized to the device for offline access. If you decide that this local data storage poses a risk, you can easily disable offline access.

For additional security and data protection information, including a video tour of a Google data center, you can visit our Google Apps security page.

Posted by Sam Srinivas, Product Management Director, Google Information Security Team

Editors note: This post is part of a series that explores the top ten reasons why customers trust Google with their business data. A complete top ten list can be found here.

As you compose a message in Gmail or collaborate on a document in Google Docs, you probably don’t often think about what we do to protect the data in that email or document. But behind the scenes we have an information security team that makes protecting your information its highest priority.

Information security is something that is important to every business. As Internet use has become widespread in the business world, attacks on applications and systems are becoming pervasive and sophisticated. Increasingly, monitoring and protecting applications and users against these attacks requires a great deal of infrastructure and technical expertise — usually more than one person or a small team can manage. Our information security team includes hundreds of full-time members working in close cooperation with the engineers developing Google applications. Some of the world's leading security researchers are members of our team, allowing Google to stay at the forefront of detection, response, and security software best practices.

We monitor our applications and systems continuously, using sophisticated automated systems that are designed to detect unusual activity and block it or flag it for immediate analysis by our monitoring team. We provide end-user features including 2-step verification, which defeats many common attacks such as trying to break into an account using a stolen password. Our Safe Browsing service helps protect users against malware and phishing. All of this technology and expertise comes together to enhance the security of your Google Apps data, allowing your IT staff to focus more of their attention on your business’s strategic needs.

“As the threats in the external environment change, [Google is] at the forefront of preventing, responding and anticipating. That’s one of the great things about partnering with Google - you have some of the best minds in the world working on those problems, which really frees me up to work on the problems that are unique to me and that I can really specialize in.”

- Todd Pierce, CIO of Genetech

Finally, we work to educate users about online safety. To that end, one of the most important things you can do to improve the security of your Google Apps accounts is to start using 2-step verification. We encourage you to set it up and start exploring other ways to better protect your information.

Posted by Adam Swidler, Senior Manager, Google Apps

Editors note: This post is part of a series that explores the top ten reasons why customers trust Google with their business data. A complete top ten list can be found here.

Google Apps allows you to be productive anywhere. For example, you may want to check your email or work on a document in a coffee shop, airport or hotel using a public wireless network. Google Apps protects your data in these situations by establishing an encrypted connection while you work. Without it, an unauthorized person could potentially hijack your session and gain access to your account. Using an Internet standard known as HTTPS, we encrypt your data as it travels from your browser to our servers. This makes it much harder for an imposter to access your account this way. We’ve supported encrypted connections from the day Google Apps launched over five years ago, and we made it the default setting for all users at the beginning of last year.

October is National Cyber Security Awareness Month and we’ve introduced a new Google Security center with more information on encrypted connections and other ways you can stay safe online.

Posted by Eran Feigenbaum, Director of Security, Google Enterprise

Editors note: This post is part of a series that explores the top ten reasons why customers trust Google with their business data. A complete top ten list can be found here.

We believe our customers should have lots of visibility into how we protect the data that is stored in Google Apps. And while it’s one thing for us to tell you how we protect the data, as we do in our blog posts and security white paper, it’s also helpful when independent third parties perform inspections and audits.

Cloud computing companies use the the SSAE 16 Type II audit, and its international counterpart ISAE 3402 Type II audit, to document and verify the data protections in place for their services. These auditing standards are defined by the The American Institute of Certified Public Accountants (AICPA) and the the International Auditing and Assurance Standards Board (IAASB), respectively. These audit standards have replaced the SAS 70 Type II audit, which Google Apps first completed in 2008. In our audits, we specify the confidentiality, integrity and availability controls that our customers are most concerned about, which are then verified by our auditors. We recently announced that we’ve successfully completed the SSAE 16 and ISAE 3204 Type II audits for Google Apps, Postini services, Google Apps Script, Google Storage for Developers and Google App Engine.

Google Apps for Government has also received Federal Information Security Management Act (FISMA) certification from the U.S. Government. The FISMA certification includes a rigorous evaluation of the security processes and data protections in place in Google Apps for Government and is required by U.S. federal government customers, who must comply with FISMA by law.

Third party audits are only part of the security and compliance benefits of Google Apps. For more information visit our Google Apps security page.

Posted by John Collins, Senior Global Trust PM, Google Apps

Editors note: This post is part of a series that explores the top ten reasons why customers trust Google with their business data. A complete top ten list can be found here.

Technology failures and natural disasters can significantly impact your business. Planning for them can be cumbersome and expensive. In a typical on-premise IT environment disaster recovery often means redundant infrastructure, backup tapes or storage area networks and a lot of IT complexity. Some businesses even build and manage duplicate data centers, specifically for disaster recovery, and those data centers sit idle the majority of the time.

The effectiveness of a disaster recovery plan is commonly measured in two ways: Recovery Time Objective (RTO) and Recovery Point Objective (RPO). RTO measures how long before users can access systems in the event of a failure. RPO measures how much of a time gap exists when the data is restored. Businesses that have invested lots of time and money in disaster recovery preparation are typically able to set RTO and RPO goals at a few hours or less for critical systems, with the cost increasing as those timeframes decrease. For other businesses that haven’t invested at that level, RTO and RPO can stretch into hours or days. And in extreme cases, if disaster strikes, some businesses just have to start over.

Google Apps offers a better way, with robust disaster recovery capabilities built right in. Our RPO design target is zero data loss and our RTO design target is instant failover. This means that if there is a disaster or disruption that affects one of our data centers, we are able to shift users to an alternate data center, so they can can continue working uninterrupted. And while no disaster recovery solution from any provider is perfect, we are proud of the benefits our customers gain.

In the words of Mark Switalski, Macomb County Circuit Court Chief Judge, and Carmella Sabaugh, Macomb County Clerk:

“We know that when a disaster happens, our system will not go down and because our data is in the cloud, it is protected and accessible from anywhere. After a rare tornado hit last summer, briefly disrupting power and some network services, the clerk’s Google service remained accessible via cell phone and other networks.”

Planning for disasters is a big challenge, but with Google Apps you have fewer things to worry about. Your email and documents will be accessible so your business can continue despite the disaster. It’s one of the main reasons that businesses trust Google Apps with their data.

Posted by Rishi Dhand, Product Manager, Google Apps

Editors note: This post is part of a series that explores the top ten reasons why customers trust Google with their business data. A complete top ten list can be found here.

We recently announced that more than 4 million businesses run on Google Apps and 5,000 more are signing up every day. Many of these business “go Google” for enhanced security features. One example is 2-step verification, an opt-in security feature that we added to Google Apps last year.

2-step verification adds an additional layer of protection to your account and significantly reduces the risk of unauthorized access. With 2-step verification, you sign into your account with both your password and a one time verification code you get on your phone. You can generate the code with a mobile app (on Android, iPhone and Blackberry), or get it in an SMS text message or a voice call.

This feature helps ensure that only you can sign in to your account. It also helps protect you if your password gets stolen via phishing attempts, keyloggers or other malicious software, or from another website where you might have used the same password. Without the verification code, hackers can’t access your Google Apps account—even if they have your password.

While two-factor authentication is not a new concept, many businesses have historically struggled with deploying it due to cost, IT complexity and usability issues associated with requiring users to carry separate token generators. Google Apps includes 2-step verification at no additional cost, using existing phones to make it simple and easy to deploy. It’s available in over 40 languages and in more than 150 countries.

We also support Security Assertion Markup Language (SAML)-based Single Sign-On (SSO) for businesses that already use separate authentication technologies and would like to continue using them. Google Apps for Business supports the SAML 2.0 specification and allows businesses to apply custom security features, password management policies, and their own two-factor authentication solution. This SSO capability is an alternative to the 2-step verification feature that is included with Google Apps.

Protecting your accounts with strong authentication mechanisms is a great way to help ensure your information remains safe online. If you are an existing customer, you can easily configure 2-step verification, once your administrator has enabled the feature for your domain.