Google has announced the pilot for corporate avatars in Gmail that’s tied to DMARC adoption, a raft of new G Suite security features to protect Gmail, Meet and Chat, and new tools for admins to manage mobile devices and data leakage from Google Drive.
Google has announced the pilot of a standard it’s backing called Brand Indicators for Message Identification or BIMI for organizations that want their email to display a corporate logo in Gmail’s avatar slot.
The BIMI pilot isn’t just for marketing though as it will require participating organizations to authenticate their emails using Domain-based Message Authentication, Reporting, and Conformance or DMARC.
SEE: Information security policy (TechRepublic Premium)
The DMARC protocol can help stamp out email spoofing, a key ingredient in phishing attacks and business email compromise (BEC) scams.
But, in part because implementing DMARC isn’t easy, adoption of the email authentication protocol has remained extremely low in the private and public sectors, with the exception of US federal agencies that are subject to a 2017 DHS order mandating DMARC adoption.
Google’s brand initiative could be a carrot for DMARC adoption while helping keep email marketing relevant and protecting the medium from an erosion of trust. In China, DMARC adoption is strikingly low, likely because consumers prefer corporate communications via WeChat and SMS rather than email.
Organizations that use DMARC can submit their corporate logos to Certificate Authorities Entrust Datacard and DigiCert to validate logo ownership. Once the authenticated emails have been scanned by Google’s anti-abuse checks, Gmail will display the logo in the avatar box.
The pilot starts in a few weeks with a limited number of senders ahead of a full roll out planned in coming months. From there, organizations can choose whether they want to adopt the BIMI standard.
Google is also beefing up security controls for Google Meet, one of the options schools and workplaces have turned to for remote working during the coronavirus pandemic.
Meet hosts will gain more control over who can ‘knock’ to join a meeting. If a host boots an attendee from a meeting, that attendee can no longer rejoin the same meeting by knocking and will only be allowed back in if the host re-invites them.
Meet will also automatically block attendees from sending requests to join a meeting if their knocking request has already been denied multiple times.
And Meet hosts are gaining ‘advanced safety locks’ that allow them to decide how others can join a meeting, for example, via a calendar invite or phone. It also requires users to obtain explicit approval to join a meeting.
Safety locks block all users who are not logged into a Google account — deemed anonymous users by Google — from joining a meeting. It also offers the host the ability to control which attendees can chat and present within a meeting.
These build on the features Google announced in April to thwart pranksters engaged in ‘zoombombing’ or gatecrashing online meetings and classrooms.
To counter zoombombing, last week Google rolled out a Meet feature for Education users that prevents anonymous users from joining meetings organized by anyone with a G Suite for Education or G Suite Enterprise for Education license.
Meanwhile, Chat in Gmail is gaining the Gmail’s phishing protections. Now links sent to users in Chat will be scanned against Google Safe Browsing and flagged if it’s malicious. In the next few weeks, Chat users will also be able to report and block Chat Rooms suspected of being shady.
Finally, Google is introducing changes for G Suite admins aimed at helping them keep devices secure during this time of increased teleworking.
As part of this effort, Google is integrating with Apple Business Manager mobile device management system to improve admins’ ability to manage iPhones and iPads. This is available to G Suite Enterprise, G Suite Enterprise Essentials, Cloud Identity Premium, and G Suite Enterprise for Education admins.
Second, Google is beefing up the Data Loss Prevention feature so that admins can block users from downloading, printing or copying sensitive documents from Google Drive. Admins can also run a full scan of all files within Google Drive and automatically set controls for all users. The feature is available in beta to G Suite Enterprise, G Suite Enterprise Essentials, and G Suite Enterprise for Education customers.