implementing-google-workspace-phishing-protection

name	implementing-google-workspace-phishing-protection
description	Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation detection, and Enhanced Safe Browsing enforcement. Use when hardening Gmail against phishing, spoofing, and malware, or when tuning Workspace email security policies.
domain	cybersecurity
subdomain	phishing-defense
tags	["google-workspace","gmail","phishing","email-security","safe-browsing","anti-spoofing","admin-console"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.AT-01","DE.CM-09","RS.CO-02","DE.AE-02"]
mitre_attack	["T1566","T1598","T1534","T1036","T1027"]
mitre_f3	{"version":"1.1","tactics":["reconnaissance","resource-development","initial-access","stealth"],"techniques":[{"id":"T1660","name":"Phishing","tactic":"initial-access","source":"attack"},{"id":"T1598","name":"Phishing for Information","tactic":"reconnaissance","source":"attack"},{"id":"T1672","name":"Email Spoofing","tactic":"stealth","source":"attack"},{"id":"F1032","name":"Impersonate Official","tactic":"initial-access","source":"f3"},{"id":"F1031","name":"Impersonate Account Holder","tactic":"initial-access","source":"f3"},{"id":"F1020.002","name":"Create Fake Materials: Fake Website","tactic":"resource-development","source":"f3"}]}

Implementing Google Workspace Phishing Protection

Overview

Google Workspace provides advanced phishing and malware protection through the Admin Console under Apps > Google Workspace > Gmail > Safety. Key features include Enhanced Pre-Delivery Scanning that examines messages more thoroughly before they reach inboxes, attachment and link protection that scans for malware and checks against known malicious sites, and spoofing detection for domain and employee name impersonation. Google's Advanced Protection Program (APP) provides the strongest account security for high-privilege users.

When to Use

• When deploying or configuring implementing google workspace phishing protection capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Google Workspace Business Standard or higher license
• Gmail Settings administrator privilege
• Understanding of organizational email flow and third-party integrations
• Access to Google Admin Console (admin.google.com)
• DNS management access for SPF, DKIM, DMARC configuration

Workflow

Step 1: Configure Advanced Phishing Protection

• Navigate to Admin Console > Apps > Google Workspace > Gmail > Safety
• Enable "Protect against domain spoofing based on similar domain names"
• Enable "Protect against spoofing of employee names"
• Enable "Protect against inbound emails spoofing your domain"
• Set action for detected spoofing: quarantine or move to spam with warning banner
• Apply settings to all organizational units or specific high-risk groups

Step 2: Enable Enhanced Pre-Delivery Scanning

• In Safety settings, enable "Enhanced pre-delivery message scanning"
• This adds additional delay (seconds) to scan messages more thoroughly
• Configure to detect phishing attempts that evade initial filters
• Enable "Identify links behind shortened URLs"
• Enable "Scan linked images" for image-based phishing detection

Step 3: Configure Attachment Protection

• Enable "Protect against encrypted attachments from untrusted senders"
• Enable "Protect against attachments with scripts from untrusted senders"
• Enable "Protect against anomalous attachment types in emails"
• Configure action: warn users, move to spam, or quarantine
• Create exceptions for known legitimate encrypted file senders