Google Turns on G Suite Alerts for State-Sponsored Attacks
5.10.2018 securityweek Attack

After rolling out an option for G Suite administrators to receive alerts on suspected government-backed attacks on their users’ accounts, Google is now turning those alerts on by default.

Google has been long warning users of attacks that it believed might be the work of state-sponsored adversaries, but only sent those alerts to the impacted users. Starting in August, however, it rolled out a new option in G Suite to also notify admins on suspected attacks on their users.

When the feature was launched in August, however, G Suite administrators had to explicitly enable the alerts to receive them, and it appears that many weren’t aware of this and never turned the option on.

“We heard that many admins weren’t aware of this alert and so weren’t receiving this critical information. As a result, we’re going to turn these alerts ON for most admins starting October 10th, 2018,” Google now says.

Admins who do not want to receive these alerts can turn them off from the Reports > Manage alerts > Government-backed attack warning option in the Admin console. They will also have the ability to opt out at any time when receiving an alert email.

The search giant also reveals that the upcoming change won’t override alert preferences that have been explicitly changed before October 10. Basically, this means that the alerts will remain off for those who previously enabled and disabled them.

“If you’d prefer not to receive these alerts after October 10th, simply turn them on and then off again in the Admin console prior to that date,” Google says.

Admins should keep in mind that, the fact that they received such an alert doesn’t necessarily mean that an account has been compromised. The warning also arrives if Google only suspects that an account was targeted by a government-backed attack. Taking additional protective measures, however, is never a bad idea.