Google Security Hardening Course

Lesson 1 • Shared Responsibility Security Model

Defines what Google secures versus what the customer must configure. Clarifies accountability gaps that hardening tasks must close.

Lesson 2 • Default Security Posture Assessment

Evaluates out-of-the-box settings against security best practices. Produces a gap list that drives the hardening roadmap built in later chapters.

Lesson 3 • Google Workspace Architecture Overview

Covers tenant structure, data residency, and service boundaries within Google Workspace. Grounds all subsequent hardening decisions in platform topology.

Lesson 1 • Organisational Unit and Group Access Control

Uses organisational units and groups to segment policy application and data access. Prevents lateral movement by isolating user populations.

Lesson 2 • Single Sign-On and Identity Federation

Configures SAML-based SSO and external identity provider federation securely. Ensures federated identities inherit the same hardening controls as native accounts.

Lesson 3 • Authentication Policies and MFA Enforcement

Configures password policies, multi-factor authentication methods, and session controls. Directly reduces credential-based attack surface established in Chapter 1.

Lesson 4 • Admin Role Design and Least Privilege

Structures custom admin roles to limit blast radius of compromised accounts. Applies least-privilege principles to every administrative function.

Lesson 1 • Context-Aware Access Policies

Uses device signals and user context to grant granular, conditional access to apps. Extends least-privilege principles from Chapter 2 to the device layer.

Lesson 2 • Mobile Device Management Hardening

Applies MDM policies for corporate and bring-your-own-device scenarios. Balances security controls with user privacy requirements.

Lesson 3 • Google Endpoint Management Overview

Introduces basic and advanced endpoint management tiers and their enrolment requirements. Establishes the device trust foundation for access decisions.

Lesson 1 • DLP Rule Design for Drive and Chat

Extends DLP coverage to file sharing and messaging channels. Prevents exfiltration paths not covered by email controls.

Lesson 2 • DLP Rule Design for Gmail

Builds content-inspection rules that detect and act on sensitive data in outbound email. Covers predefined detectors, custom regex, and optical character recognition.

Lesson 3 • Data Classification and Labelling

Establishes a classification taxonomy and applies Drive labels to enforce handling rules. Classification drives all downstream DLP policy logic.

Lesson 4 • DLP Monitoring and Tuning

Analyses DLP incident reports to reduce false positives and close coverage gaps. Establishes a continuous improvement cycle for data protection rules.

Lesson 1 • Email Authentication Protocol Configuration

Deploys SPF, DKIM, and DMARC records to authenticate outbound mail and reject spoofed inbound mail. Eliminates domain impersonation as an attack vector.

Lesson 2 • Outbound Mail Control and Data Leakage

Restricts outbound mail routing and enforces TLS for sensitive destinations. Complements DLP rules from Chapter 4 at the transport layer.

Lesson 3 • Advanced Phishing and Malware Protection

Enables Gmail's advanced protection settings to sandbox attachments and flag suspicious links. Builds on authentication controls to catch threats that pass protocol checks.

Lesson 1 • Audit Log Architecture and Retention

Maps all available audit log sources and configures retention aligned with compliance requirements. Provides the data foundation for all detection use cases.

Lesson 2 • Alert Policy Configuration

Creates and tunes alert policies for high-priority events such as admin changes and data exfiltration. Ensures the right personnel are notified with actionable context.

Lesson 3 • Threat Detection Use Case Development

Builds detection rules for common Workspace attack patterns such as OAuth abuse and mass download. Operationalises monitoring into a repeatable detection engineering practice.

Lesson 4 • Security Dashboard and Investigation Tool

Uses the Security Dashboard charts and the Investigation Tool to surface anomalies. Translates raw log data into actionable security insights.

Lesson 1 • OAuth App Access Governance

Reviews and restricts third-party OAuth app permissions granted by users. Prevents unauthorised data access through over-privileged integrations.

Lesson 2 • Google Workspace Marketplace App Control

Manages which Marketplace apps users may install and what data they can access. Reduces shadow-IT risk from unsanctioned productivity tools.

Lesson 3 • Service Account and API Key Management

Audits and restricts service accounts and API keys used by internal and external applications. Applies least-privilege principles from Chapter 2 to non-human identities.

Lesson 1 • Incident Response Workflow for Workspace

Defines detection, containment, eradication, and recovery steps specific to Workspace incidents. Integrates with monitoring capabilities built in Chapter 6.

Lesson 2 • Continuous Hardening and Governance Cadence

Establishes recurring review cycles, change management gates, and ownership assignments for ongoing security maintenance. Transforms one-time hardening into a sustainable programme.

Lesson 3 • Data Breach Containment in Workspace

Stops active data exfiltration using Drive sharing revocation, DLP rule escalation, and user suspension. Limits breach scope while preserving evidence.

Lesson 4 • Security Configuration Validation and Testing

Validates hardening controls through configuration review, simulated attacks, and automated scanning. Confirms that all settings from Chapters 1–7 are correctly applied.