Summary

Google has strengthened the security of its Workspace suite by adding new challenges that users must complete when performing sensitive actions. These challenges can include entering a verification code from Google Authenticator, using a security key, or using a recovery/signed-in device.

The new challenges are designed to catch out attackers who have hijacked a user’s account. For example, if an attacker tries to change the user’s password or add a forwarding address to their email, they will be prompted to complete a challenge. If they fail to complete the challenge, the user will be notified and the attacker will be prevented from making changes to the account.

The new challenges are available for all Workspace customers and can be customized by administrators. Note that Workspace customers include all those using products such as Gmail, Calendar, Drive, or Google Docs Editors Suite (among other apps).

New Gmail Actions that would Trigger Verification

• Filters: creating a new filter, editing an existing filter, or importing filters.

• Forwarding: Adding a new forwarding address from the Forwarding and POP/IMAP settings.

• IMAP access: Enabling the IMAP access status from the settings. (Workspace admins control whether this setting is visible to end users or not)

Existing Common Actions that would Trigger Verification

• View activity saved in your Google Account

• Change your password

• View saved passwords

• Turn on 2-Step Verification

• Download your data

• Change channel ownership on YouTube Creator Studio

• Change Google Ads account budget

• Buy any other product or service from Google

• Example: Buy a Google Pixel or Nest device from Google Store

Identity Verification

The device you use to do this must have been registered for a period of seven days minimum:

• A device associated with the recovery phone number for your account

• A device that’s signed in to your Google Account

• For accounts with 2-Step Verification turned on

1. A security key that’s been added to your Google Account

2. A verification code from Google Authenticator

Blog/News Key Points

• Google has strengthened the security of its Workspace suite by adding new challenges that users must complete when performing sensitive actions.

• The new challenges are designed to catch out attackers who have hijacked a user’s account.

• The new challenges are available for all Workspace customers and can be customized by administrators.

• Identity verification can use recovery/signed-in device or 2FA methods.