Perfect forward secrecy

Google is the first major cloud provider to enable perfect forward secrecy, which encrypts content as it moves between our servers and those of other companies. With perfect forward secrecy, private keys for a connection are ephemeral, which in turn prevents retroactive decryption of HTTPS sessions by an adversary or even the server operator. Many industry peers have followed suit or committed to adoption in the future.

100% email encryption

Every single email message you send or receive is encrypted while moving between Google’s data centers. This ensures that your messages are safe not only when they move between your devices and Gmail’s servers, but also as they move internally within Google. We were also the first to let users know when their email was sent insecurely across providers with the introduction of our TLS indicator

Strong Authentication

step verification greatly reduces the risk of unauthorized access by asking users for additional proof of identity when signing in. Our security key enforcement offers another layer of security for user accounts by requiring a physical key. The key sends an encrypted signature and works only with the sites that it’s supposed to, helping to guard against phishing. Google workspace administrators can easily deploy, monitor, and manage the security keys at scale from within the administrator console—without installing additional software.

Centralized Cloud Access Management

With support for single sign-on (SSO), Google enables unified access to other enterprise cloud applications. Our identity and access management (IAM) service lets administrators manage all user credentials and cloud-application access in one place.

Suspicious Login Monitoring

We use our robust machine learning capabilities to help detect suspicious logins. When we discover a suspicious login, we notify administrators so they can work to ensure the accounts are secured

Enhanced Email Security

Google allows administrators to set customized rules requiring email messages to be signed and encrypted using Secure/Multipurpose Internet Mail Extensions (S/MIME). These rules can be configured to enforce S/MIME when specific content is detected in email messages.

Connect LDAP-Based apps & services

Enable authentication, authorization, and group/user lookups for legacy apps (need LDAP over SSL) using Cloud Identity. No need to create a separate user directory; existing users in Cloud Identity can authenticate to LDAP apps. Supports traditional apps and IT infrastructure hosted on-premises and in the cloud (IaaS). No end-user change management required; application configuration only

Password Vaulted apps

To make easy for admins to enable single sign-on for thousands of additional apps that don’t support modern authentication standards like SAML and OIDC, with password vaulting, admins can:

• Manage credentials in a single space,

• Securely enable access to shared credentials,

• Manage access to app credentials based on group membership, and

• Log and access reports on usage of the credentials within their organization

Web and Mobile apps (Manage SAML)

Security Assertion Markup Language, or SAML, is a standardized way to tell external applications and services that a user is who they say they are. SAML makes single sign-on (SSO) technology possible by providing a way to authenticate a user once and then communicate that authentication to multiple applications.

SAML 2.0 is the modern version of SAML