In the face of continued attacks targeting its hugely popular Gmail service, Google has put together a checklist to help Gmail users better secure their accounts by looking at the settings in their inboxes, their browsers and their PCs. The security guide doesn’t automate any of these tasks for users, but instead gives them a guide comprising 18 steps to help lock down their Gmail inboxes.
The release of the Gmail checklist comes as Google has been working to fight the perception that its mail service has become a prime target for attackers. The company has added warnings to Gmail accounts that notify users when their accounts have been accessed from unknown IP addresses, and has warned some users about access attempts from China, in particular.
The Gmail checklist includes four sections of recommended actions that users can take to help secure their inboxes. The guidelines begin with simple, common-sense actions such as installing anti-malware software and keeping it up-to-date to prevent malicious software from infecting the machine and accessing the Gmail inbox. The checklist also includes recommendations to keep OS patches up-to-date and to check for browser plug-ins and extensions that you may not have updated.
The guidelines also include specific recommendations for users’ Google accounts and Gmail settings, including obvious things such as changing passwords a couple times a year. But Google also goes into slightly less well-known settings, including how to force Gmail to always use an SSL connection.
The rash of recent attacks targeting Gmail accounts has made security an even more urgent concern for Gmail users. In a recent guest column for Threatpost, Caleb Sima, CEO of Armorize, wrote about the myriad ways that an attacker could maintain persisten access to a compromised Gmail account even after the victim has changed her password.
“The best method for an attacker to get back into your account is to keep
reading your emails even after you’ve changed your password. So the
basics of any Gmail backdoor will be to setup some email forwarding
rules that send him or her a copy of your messages as they arrive –
including password reset messages. Make sure you disable these following
any compromise,” Sima wrote. “Under Settings->Forwarding and POP/IMAP
ensure that disable forwarding is selected and that your incoming email
is not being forwarded to the attacker. Next, check your filters list in
Gmail and make sure there are not any rules setup that forward email to
the attacker.”
Gmail users can access the checklist by clicking on the Help link at the top right of their inboxes and then on the Gmail security checklist link on the left side of the help page.
