Many enterprises are looking to better manage extensions on their corporate devices. Extensions themselves are a great tool for productivity and customization of Chrome. However, some extensions can have the potential for far reaching rights to sites your users visit and devices they browse from, giving IT the desire to closely manage which extensions are in their environment and how they behave. 

In an earlier post in this series, we’ve detailed how Chrome Browser Cloud Management is the easiest way to audit installed extensions and manage them. However, some enterprises may need to still use Group Policy on Windows or plists on Mac to manage extensions. So lets touch on management through those methods, for organizations that haven’t quite made the move to Chrome Browser Cloud Management yet. 

For starters, here are some of the most used options for managing extensions (some also apply to apps) via Windows Group Policy or via Plists on Macs:

Installing or allowing extensions

• Extension Install Allow List: These are the extensions that you have approved to be installed within your environment. 
• Extension Install Force List: This will install the extension in the managed instance of Chrome. This setting overrides the extension block list policy, and the extension can’t be disabled on uninstalled. 
• Extension Allowed Types: Here you can create a list of what types of extensions and apps you will allow to be installed. Extensions, themes, user scripts, hosted applications, legacy packaged applications and platform applications are the values that are supported. Note that whatever you want to allow must be included in the list. Anything left off the list will not be installed. For more information on the different types, here is a link on Extensions and Apps in the Chrome web store. 
• Extension Install Sources: This policy allows you to get that older install functionality for specific URLs that you specify in this policy. Here is a link on the URL match patterns that can be used in this policy. 

Blocking extensions

• Extension Install Block List: These are the extensions that you will not allow to be installed. If they are installed already, they will be disabled. If a user tries to install them, it will be blocked. In the Chrome web store, the Add to Chrome button will be red and advise the user that the extension can’t be installed. 
• Block External Extensions: This setting will block extensions from external sources being installed. An example of this is if an installed application is adding an extension to Chrome via the registry, this setting will block that extension from loading. 

Advanced management options

• Extensions Settings: This policy provides a varied amount of functionality and requires a JSON script to be created and formatted in a single line string. This setting can be complex. We recommend using Chrome Browser Cloud Management as almost all of the functionality is included without needing to write JSON as well as the ability to audit installed extensions. If you do want to use this policy, it is covered in detail in the Managing Extensions in your Enterprise technical document. Some of the functionality that you can use within this policy are:
  • Install types: (Allowed, Blocked, Force Installed, Normal Installed) 
    • You can also display a custom message when the extension is blocked via the blocked installed message function.
  • Prevent extensions from altering websites: You can prevent all or specific extensions from running on specific websites. 
  • Managing by permissions: You can allow or block extensions by the specific rights or “permissions” that they require to run. 
    • This provides a baseline of functionality that you will or will not allow extensions to run on your users machines. 
    • If an extension is updated, bought, sold and updates the permissions that it requires, this will dynamically protect your users from permissions that you will not allow. 

Even if you decide that on-premises policy management is how you want to manage extensions long term, you can still use Chrome Browser Cloud Management to get much needed visibility into extensions that may exist in your environment. The newly improved apps and extension list is a great way to get a view of your current extension landscape, giving you more data to make better decisions around extension management.

You can enroll browsers to see this information, but still set policy through your existing tools if that’s your preference. 

Well, that’s it for this edition of Chrome Insider. Here’s where you can find more posts in the series, or you can learn more about Chrome Browser Cloud Management.

^{A note on Google’s commitment to inclusive naming conventions. The following policies have been deprecated, however will still continue to work until Chrome 95 to give administrators time to migrate to the new policies.– ExtensionInstallWhitelist replaced with ExtensionInstallAllowlist
– ExtensionInstallBlacklist replaced with ExtensionInstallBlocklist}

For many nations, gross domestic product is the primary measure of a society’s success. The Himalayan kingdom of Bhutan gauges achievement by a different standard: gross national happiness (GNH).

The Royal Government of Bhutan’s GNH index measures a “holistic and sustainable approach to development,” prioritizing factors such as community, education, mental health, cultural heritage, and ecology. It’s a model that was endorsed by the U.N. General Assembly in 2011. Focus on GNH has enabled Bhutan to become a carbon-negative nation; nurture habitats for Bengal tigers, clouded leopards, and red pandas; and provide free healthcare to all of its 735,553 citizens.

One of the pillars of GNH in Bhutan, ranked South Asia’s least-corrupt country, is good governance. Yet as one of Asia’s least-developed nations, Bhutan needed to draw every last bit of value from public funds, while maximizing the potential of its civil servants. Turning to G Suite, it discovered powerful tools enabling communication, accountability, and cost-savings that have been vital to the mission of promoting a well-balanced society.

“G Suite collaboration tools are providing a framework that allows us to foster citizens’ happiness,” says Lobzang Jamtsho, Head of Application Division, Ministry of Information & Communication. “It’s the three C’s: collaboration, coordination, and communication. This has improved significantly with G Suite adoption.”

Freeing up resources for positive change

“When we started using Sites, we found a powerful yet simple tool that’s really a one-stop shop for sharing. You don’t have to know the development side; you just drag, drop, and build.”

—Kuenga Zam, Dy. Chief ICT Officer, Royal Civil Service Commission

From wildlife conservation, to keeping hospitals well-supplied, to the development of human resources, ensuring a correct balance between well-being and development demanded smooth coordination in the civil service. Meanwhile, everything from the cost of printing meeting agendas to investing in email servers and staff to maintain them drained resources from vital tasks such as sourcing medication.

G Suite marked a fundamental shift in the way the Royal Government of Bhutan pursued its mission, as tools such as Docs, Sheets, and Sites came together to provide a unified platform where team contributions could be seamlessly integrated in the cloud. It sparked a surge of cooperative vigor.

“In writing, for example, we collaborate in terms of drafting a proposal. And we collaborate with other parties,” says Lobzang. “It’s really helped us in terms of analyzing the decision-making process and promoting accountability, ownership, and transparency.”

G Suite is used today by 9,500 civil servants across all 67 government agencies. The benefits have been dramatic. In a survey of more than 800 civil servants, roughly 78% of respondents reported G Suite boosted productivity by more than 50%. About 80% said collaboration with colleagues increased more than 50%. And 85% of respondents agreed or strongly agreed with the statement, “my organization is more innovative.”

“G Suite has empowered both education and hospitals. We have our entire education system on the platform, all teachers and students. And processes have improved in hospitals, translating directly into an increase of happiness among citizens.”

—Lobzang Jamtsho, Head of Application Division, Ministry of Information & Communication

The Royal Civil Service Commission of the Royal Government of Bhutan organizes scholarships for civil servants to pursue long-term studies as a part of human resource development. It’s vital to the nation’s pursuit of sustainable development while preserving a unique cultural heritage.

G Suite inspired the Royal Civil Service Commission to build its own internal platform using Sites to manage scholarships, streamline processes, and boost overall HR Development Management.

“When we started using Sites, we found a powerful yet simple tool that’s really a one-stop shop for sharing,” says Kuenga Zam, Dy. Chief ICT Officer, Royal Civil Service Commission. “You don’t have to know the development side; you just drag, drop, and build. And since it’s an internal site, it helps us share from one division to another what scholarships are available for renewal.”

Human connectivity for enhancing quality of life

For the Royal Government of Bhutan, G Suite is a tool that doesn’t just facilitate better communication, it enables the whole of government to work better together. “G Suite has empowered both education and hospitals. We have our entire education system on the platform, all teachers and students,” says Lobzang. “And processes have improved in hospitals, translating directly into an increase in happiness among citizens.”

“When services are delivered better, people are happier,” adds Kuenga. “So it aligns in that way with GNH.”

Motivating team members to build a better future

Today, the Royal Government of Bhutan is writing the next chapter of its journey with G Suite, motivating civil servants to tap the platform’s creative possibilities through training programs that demonstrate why you don’t need to be an IT expert to be a digital innovator.

“We did a demo at a conference to show how we are using Sites. Our users then went forward and took that idea and built their own site,” says Kuenga. “After we show the possibilities, they have the motivation to go forward and explore.”

The next step for the Royal Government of Bhutan is to begin experimenting with Apps Script to create applications for automating workflow processes: “There’s so much potential that we haven’t explored,” says Kuenga.

Every day, we stop more than 100 million harmful emails from reaching Gmail users. Last year, during the peak of the pandemic crisis we saw 18 million daily malware and phishing emails related to COVID-19. This is in addition to more than 240 million COVID-related daily spam messages. Our ML models evolve to understand and filter new threats, and we continue to block more than 99.9% of spam, phishing, and malware from reaching our users.

We wanted to explore what factors influence being targeted by email phishing and malware and whether higher-risk users are adopting the strongest protections we have to offer. To do this, we teamed up with researchers at Stanford University to study over a billion phishing and malware emails and their anonymized targets. We recently presented our study at the Internet Measurement Conference (IMC), and it’s now available here.

We found that multiple factors correlate with higher risk: where you live, what devices you use, and whether your information appeared in previous third-party data breaches. 

Phishing and malware evolves faster than you think

We aggregated and analyzed all of the phishing and malware campaigns that Gmail automatically blocked over a five-month period to identify patterns. 

• We found that users in the United States were the most popular targets (42% of attacks), followed by the United Kingdom (10% of attacks), and Japan (5% of attacks). 
• Most attackers don’t localize their efforts, using the same English email template for users in multiple countries. 
• There is, however, some evidence of regional attackers: 78% of the attacks targeting users in Japan occurred in Japanese, while 66% of attacks targeting Brazilian users occurred in Portuguese.

We also noticed some patterns among attackers and botnets that distribute phishing and malware emails:

• They rely on fast-churning campaigns. A similar email based on a template is sent to 100–1,000 targets on average. 
• The campaigns are brief and bursty, lasting just one to three days on average.
• In a single week, these small-scale campaigns accounted for over 100 million phishing and malware emails in aggregate, targeting Gmail users around the globe.

While the users that attackers target change from week to week, in aggregate these patterns remain largely stable over time.

Factors that correlate with heightened risk

Beyond how attackers operate phishing and malware campaigns, we also analyzed what factors put a user at higher risk of attack. In order to avoid singling out any individual user or their personal data, we used an anonymization technique called “k-anonymity” to ensure any risk trends that we identified applied to a broad group of similar users. We modeled the likelihood of receiving any phishing or malware emails in a given week as a function of geographic location, demographics, security posture, device access, and prior security incidents (such as having personal data revealed by a third-party data breach).

Here is what our model found:

• Having your email or other personal details exposed in a third-party data breach increased the odds of being targeted by phishing or malware by 5X. 
• Where you live also affects risk. In Australia, users faced 2X the odds of attack compared to the United States, despite the United States being the most popular target by volume (not per capita). 
• With respect to demographics, the odds of experiencing an attack was 1.64X higher for 55- to 64-year-olds, compared to 18- to 24-year-olds.
• Mobile-only users experienced lower odds of attack: 0.80X compared to multi-device users. This may stem from socioeconomic factors related to device ownership and attackers targeting wealthier groups.

These correlations help us understand that risk is not evenly spread across geographic and demographic boundaries. 

How to stay safer

Gmail’s phishing and malware protections are automatically turned on by default. Here’s our top recommendations for what you can do today to stay safer.

For individual users:

• Complete a Security Checkup for personalized and actionable security advice.
• If appropriate, consider enrolling in Google’s Advanced Protection program, which provides Google’s strongest security to users at increased risk of targeted online attacks. 
• Enable Enhanced Safe Browsing Protection in Google Chrome to substantially increase your defenses against dangerous websites and downloads on the web.
• Browse these additional tips to manage your online security and choose the right level of protection for yourself.

For Workspace admins:

• New research reveals who’s targeted by email attacks. Take a look at our advanced phishing and malware protection. These are turned on by default across all Google Workspace licenses, and you can further customize them according to the unique needs of your organization.

The holiday season is upon us! If you are making your list and checking it twice, we’ve got a few learning gifts you can tick off the list and share with others too. For the season of giving, we’ve wrapped up some of our most popular training and certification opportunities and made them available at no-cost.

This December we’re aiming to offer something for everyone, whether you’re just getting started with cloud, or knee deep in preparing for a professional certification exam. Start with the fundamentals to gain a deeper understanding of cloud whether you’re in a business or technical role. Perhaps you’re looking to flex your data analytics and ML muscle with BigQuery and SQL, earn a Google Cloud skill badge, or enhance your technical cloud skills. Or jump into a hot topic like sustainability and learn about Google’s commitment to a clean cloud, and how to use sustainability tools. Read on to find something on your learning wishlist.

We also have a variety of learning formats to fit your needs. Complete hands-on labs, view courses and webinars, or jump into competitions like the Google Cloud Fly Cup Challenge or our most popular #GoogleClout Challenge of 2022 – and let the fun begin!

Are you ready to learn? Take a look at the training we’ve recommended below to work towards your goals as we head into the new year, with new skills, to make the most of new opportunities.

We’re giving plenty of learning gifts to choose from this month, so take your pick from the topics below:

ML, AI and data analytics

Who it’s for: ML, AI and data engineers
What you’ll take away: A deeper understanding of working in BigQuery and SQL.
Level: Foundational
Start learning now:

• Introduction to SQL for BigQuery and Cloud SQL – Get started with this one hour and 15 minute hands-on lab to learn fundamental SQL querying keywords, which you will run in the BigQuery console on a public dataset, and how to export subsets of a dataset into CSV files, then upload to Cloud SQL. You’ll also learn how to use Cloud SQL to create and manage databases and tables, with hands-on practice on additional SQL keywords that manipulate and edit data.

• Weather Data with BigQuery – In this 45 minute lab, you’ll use BigQuery to analyze historical weather observations, and run analytics on multiple datasets.
• Insights from Data with BigQuery – Earn a shareable skill badge when you complete this five hour quest. It includes interactive labs covering the basics of BigQuery, from writing SQL queries, creating and managing database tables in Cloud SQL, and querying public tables to loading sample data into BigQuery.
• The Google Cloud Fly Cup Challenge – This is a three-stage competition in the sport of drone racing in the Drone Racing League (DRL). You will use DRL’s race data to predict outcomes and give performance improvement tips to pilots (these are the best drone pilots in the world!). There’s a chance to win exclusive swag, prizes, and an expenses paid trip to the DRL World Championship. Registration closes on December 31, 2022.

CI/CD

Who it’s for: Software Developers
What you’ll take away: Take part in our most popular #GoogleClout challenge of 2022! Build a simple containerized application.
Level: Fundamental
Start learning now:

• GoogleClout – CI/CD in a Google Cloud World – Flex your #GoogleClout in this cloud puzzle that challenges you in a lab format to create a Cloud Build Trigger to rebuild a containerized application hosted on a remote repository. Register it in the Artifact Registry and deploy. You’ll be scored on your results and earn a badge to share.

Preparing for Google Cloud certification

Who it’s for: Cloud engineers and architects, network and security engineers and Google Workspace administrators
What you’ll take away: Explore the breadth and scope of the domains covered in the cloud certification exams, assess your exam readiness and create a study plan.
Level: Foundational to advanced
Start learning now:

• Preparing for Google Cloud certification – These courses are for Associate Cloud Engineers, Professional Cloud Architects, Professional Cloud Network Engineers, Professional Cloud Security Engineers, and Google Workspace Administrators preparing for Google Cloud certification exams. You’ll also earn a completion badge when you finish the course.
• Preparing for the Cloud Architect certification exam – Join this 30 minute on-demand webinar to learn about resources to maximize your study plan, and get tips from a #GoogleCloudCertified Professional Cloud Architect.

Intro to Google Cloud for technical professionals

Who it’s for: Software Developers
What you’ll take away: Boost your Google Cloud operational and efficiency skills to drive innovation by navigating the fundamentals of compute, containers, cloud storage, virtual machines, and data and machine learning services.
Level: Foundational
Start learning now:

• Getting Started with Google Cloud Fundamentals – This on-demand webinar takes a little less than three hours to complete. Navigate Compute Engine, container strategies, and cloud storage options through sessions and demos. You’ll also learn how to create VM instances, and discover Google Cloud’s big data and machine learning options.

Intro to Google Cloud for business professionals

Who it’s for: Business roles in the cloud space like HR, marketing, operations and sales
What you’ll take away: A deeper understanding of cloud computing and how Google Cloud products help achieve organizational goals.
Level: Foundational
Start learning now:

• Cloud Digital Leader learning path -There are four courses in this learning path covering digital transformation, innovating with data, infrastructure and application modernization, and Google Cloud security and operations.

• Preparing for the Cloud Digital Leader certification exam – In this 30 minute webinar continue your learning journey by preparing for the Google Cloud Digital Leader certification exam. The webinar covers all the resources we’ve made available to help you prepare.

Sustainability

Who it’s for: Software Developers
What you’ll take away: Learn how the cleanest cloud in the industry can help you save your cloud bill, and save the planet.
Level: Foundational
Start learning now

• A Tour of Google Cloud Sustainability -Work through this one hour, hands-on lab, to explore your carbon footprint data, use the Cloud Region Picker, and reduce your cloud carbon footprint with Active Assist recommendations.

Keep connected and learning with us in 2023

Accelerate your growth on Google Cloud by joining the Innovators Program. No-cost for users of Google Cloud (including Workspace), it’s for anyone who wants to advance their personal and professional development around digital transformation, drive innovation, and solve difficult business challenges.

Continue your learning with Google Cloud in 2023 by starting an annual subscription¹ with Innovators Plus benefits. Gain access to $500 in Google Cloud credits, live learning events, our entire on-demand training catalog, a certification voucher, access to special events, and other benefits.

Build your skills, reach your goals and advance your career with 12 no-cost ways to learn Google Cloud!

1. Start an annual subscription on Google Cloud Skills Boost with Innovators Plus for $299/year, subject to eligibility limitations.