BeyondCorp Threat and Data Protection features are available only for customers who have purchased BeyondCorp Enterprise.
You can use BeyondCorp Threat and Data Protection to integrate Chrome with a variety of security features, to enhance existing Chrome security protections or use new features with Chrome. These include additional protections against web-based threats, such as malware and social engineering, and use Data Loss Prevention (DLP) rules, security alerts, and reporting tools.
Here are steps for implementing these protections, and reporting and investigation options to explore after the protections are configured and in use.
Configure Chrome, create DLP rules, and set up alerts
Step 1: Set up Chrome Management
Set up either Cloud Management for your Chrome browser, Chrome Managed Profiles, or Chrome Device Management, depending on your supported operating system(s).
- Chrome Browser Cloud Management - for Microsoft Windows, Apple Mac OS, and Linux
- Chrome Managed Profiles - for Microsoft Windows, Apple Mac OS, and Linux
- About Chrome Device Management - for Chrome OS
Step 2: Set up Chrome browser policies
To enable additional protections against data loss and malware in Chrome, you need to enable Chrome Enterprise connectors so content gathered in Chrome is uploaded to Google Cloud for analysis. The Chrome Enterprise connectors must be enabled for DLP rules to integrate with Chrome.
These settings are in addition to any general settings you configured as part of overall Chrome Browser Cloud Management or Chrome Device Management.
- On Windows or Mac (with Chrome Browser Cloud Management configured): BeyondCorp is enabled through device or machine level cloud policies (go to Understand Chrome Policy Management for details). This means that BeyondCorp will be applied to any Chrome Browsers enrolled in Chrome Browser Cloud Management on that device.
- On Chrome OS: BeyondCorp is enabled through user-specific policies on a managed device. Chrome Enterprise connector policies apply to a specific user and only if the managed device is on the user’s domain.
Step 3: Verify that the BeyondCorp Enterprise service is enabled
In the Admin console, go to Menu AppsAdditional Google services.
- If the BeyondCorp Enterprise service is not currently ON, click the service to open its settings page.
- Click Service status.
Click On for everyone, and then click Save.
For information on how to turn a service on for specific organizational units or groups, see Turn a service on or off for Google Workspace users.
Step 4: Set up data protection rules
After you enable Chrome Enterprise Connectors, create DLP rules. These rules are specific to Chrome and warn of or block the sharing of sensitive data, or block access to URLs that are unsafe or not compliant with organizational policies. The rules trigger alerts and messages in the Chrome browser, letting users know that file uploads or downloads are blocked, or warning that sensitive data might be shared or that they're visiting unsafe or noncompliant websites.
Step 5: Set up activity alert rules
Set up alert center rules so analysts are notified of certain security events.
For details: View alert details
View the audit log and security reports, and perform investigations
After you configure BeyondCorp and events occur, you can use the Rules audit log and security dashboard security reports to monitor security events. Also, you can use the investigation tool to learn more about alert notifications.
View the Rules log events
Use the Rules audit log to track user attempts to share sensitive data. The Rules audit log tracks Device ID and Device Type audit data types for BeyondCorp-related events.
For details on DLP rules-related audit data types: Rules log events.
View security dashboard reports
View reports in the security dashboard. Security reports related to BeyondCorp are:
- Chrome threat summary
- Chrome data protection summary
- Chrome high risk users
- Chrome high risk domains
Use the investigation tool to examine security issues
You can further investigate the source of the alert in the security investigation tool, which allows you to identify, triage, and take action on security and privacy issues in your domain.
For details: About the security investigation tool
BeyondCorp Threat and Data Protection URLs
These URLs are used by Chrome to check for updates when running BeyondCorp Threat and Data Protection. Chrome must access the following URLs when BeyondCorp Threat and Data Protection is implemented.
For details: Manage Chrome updates (Windows); the URLs are listed under Questions: What URLs are used for Chrome browser updates?