implementing-google-workspace-phishing-protection

name	implementing-google-workspace-phishing-protection
description	Configure Google Workspace advanced phishing and malware protection settings including pre-delivery scanning, attachment protection, spoofing detection, and Enhanced Safe Browsing. Use when configureing google workspace advanced phishing and malware protection settings including.
domain	cybersecurity
subdomain	phishing-defense
tags	["google-workspace","gmail","phishing","email-security","safe-browsing","anti-spoofing","admin-console"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"]

Implementing Google Workspace Phishing Protection

Overview

Google Workspace provides advanced phishing and malware protection through the Admin Console under Apps > Google Workspace > Gmail > Safety. Key features include Enhanced Pre-Delivery Scanning that examines messages more thoroughly before they reach inboxes, attachment and link protection that scans for malware and checks against known malicious sites, and spoofing detection for domain and employee name impersonation. Google's Advanced Protection Program (APP) provides the strongest account security for high-privilege users.

When to Use

Trigger phrases:

• "implementing google workspace phishing protection"

• "Configure Google Workspace advanced phishing and malware protection settings inc"

• When deploying or configuring implementing google workspace phishing protection capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Google Workspace Business Standard or higher license
• Gmail Settings administrator privilege
• Understanding of organizational email flow and third-party integrations
• Access to Google Admin Console (admin.google.com)
• DNS management access for SPF, DKIM, DMARC configuration

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}

1. — ensure the malware is in a sandboxed environment with no network access