Educause Security Discussion mailing list archives

Re: Google Docs abuse


From: Jacob Steelsmith <jsteelsmith () EVERETTCC EDU>
Date: Tue, 24 Jul 2012 07:47:00 -0700

Google called us to see if we needed help with our migration. Then, not too
long ago, there was a problem with email delivery and I was able to call
phone support and talk to someone within 10 minutes. I have had very good
experiences with their support.

Jacob Steelsmith
Information Technology
Everett Community College
425-259-8707

Please take a minute to help us improve our IT service by completing the IT
Feedback Survey. http://goo.gl/ymrXS



On Mon, Jul 23, 2012 at 11:20 AM, Tracy Mitrano <tbm3 () cornell edu> wrote:

 Let me know when you get a live person on the phone at Google, that feat
alone is worth mentioning in my experience!

 Tracy


 On Jul 21, 2012, at 2:49 AM, Dan Han wrote:

I agree that Google should notify Google Apps administrators and perhaps
even delegate certain management rights, such as disabling a form hosted
within the institution, to the local Google Apps admin, but do we know
whether if Google actually notifies App administrators of affected
institutions, or whether if the local Google Apps admins have these
management capabilities? We are fairly new to Google Apps here, any Google
Apps veterans care to chime in? Thanks.

 -Dan

Dan Han
Information Security Officer
Virginia Commonwealth University

 On Sat, Jul 21, 2012 at 1:10 AM, Jeffrey Schiller <jis () mit edu> wrote:

On Fri, Jul 20, 2012 at 5:03 PM, Bob Bayn <bob.bayn () usu edu> wrote:

 ...

It also seems like Google should have the tools and capacity to
intervene automatically when someone makes a form that looks like a
password collector.  Or they could send us the entries for our domain when
they decide to respond to an abuse complaint.


 Having Google automatically intervene when something "looks" like a
password collector would be a horrible precedent. They should investigate
forms when an abuse complaint is made. If the complaint is for an "apps"
domain they should notify the administrator, which should respond in some
reasonable period of time.

 If Google has multiple complaints about a particular Apps domain, and
that domain's administrator(s) fail to respond, then they should take
action. That action should be spelled out in the contract for the Apps
domain.

 We should not expect someone (or worse, someTHING) at Google to act as
prosecutor, judge, jury and executioner. Just as we don't give the police
that power in the non-cyber world.

 Yes, this means that some phishing sites will be up for longer then we
might like, but that ultimately is the cost of due process.

 Because this is a security list, we should remember that one of the
important security goals is "availability". Google should not make your
services unavailable without careful consideration.

 -Jeff

  --
_______________________________________________________________________
Jeffrey I. Schiller
Information Services and Technology
Massachusetts Institute of Technology
77 Massachusetts Avenue  Room E17-110A
Cambridge, MA 02139-4307
617.253.0161 - Voice
jis () mit edu
http://jis.qyv.name
_______________________________________________________________________






Current thread: