News
Your Gmail Isn’t Stopping as Many Attacks as You Think
March 2022 by Check Point
Does your organization use Gmail and the larger Google Workspace? If you’re a small business or tech company, you probably do. In fact, a whopping 92% of startups use
Gmail; 60% of mid-sized businesses use it as well. More than 5 million businesses use Gmail.
Despite that, a lot of the security conversation is centered around Microsoft. That’s certainly valid, but it’s time we start talking about Gmail. That’s because Gmail remains an incredibly popular email service for businesses of all sizes. Plus, attackers are not only targeting email, but the entire Google Workspace, including popular apps like Docs and Slides. Without full-suite security, your Google Workspace is at risk.
This came to a head a few weeks ago, when Avanan, acquired by Check Point Software, published an attack brief about the Google Docs comment exploit. The attack occurs when a threat actor adds a comment to a Google Doc (or any part of the Google Workspace). The target is mentioned with an @. By doing so, an email is automatically sent to that person’s inbox.
In that email, which comes from Google, the full comment, including the bad links and text, is included. Further, the email address isn’t shown, just the attackers’ name, making this ripe for impersonators.
We know, based on our research, that Google is about the middle of the road when it comes to preventing phishing emails from reaching the inbox:
Despite it faring better than other solutions, that’s still plenty of attacks. Using our Threat Miss Calculator, consider a 500-seat organization, where the average user sees about 20 emails a day. These are the results:
That’s nearly three missed attacks per user, per month.
Or take an organization with 6,500 employees:
