ITCS 305 - Google Security: Risk Analysis and Policy Evaluation

This report provides a comprehensive analysis of Google's security policy, examining the various measures implemented to protect user information and services. It delves into risk assessment, identifying potential threats such as disgruntled employees, careless workers, mobile theft, unpatched devices, and third-party providers. The report further analyzes vulnerabilities within Google's systems and outlines the potential consequences of each threat. Mitigation strategies are proposed to address these risks, including employee training, BYOD policies, vulnerability management, and third-party validation. The report also identifies critical assets that Google needs to protect and concludes with recommendations for strengthening the organization's overall security posture. Desklib offers a wealth of similar solved assignments and past papers to aid students in their studies.

Running head: INTERNET SERVICE AND SECURITY
INTERNET SERVICE AND SECURITY
Name of the Student
Name of the University
Authors Note:

2INTERNET SERVICE AND SECURITY
Table of Contents
Introduction..........................................................................................................................3
Discussion............................................................................................................................3
Security policy of Google................................................................................................3
Analyzing risk for Google...................................................................................................7
Threats and its consequence............................................................................................7
Vulnerabilities..................................................................................................................9
Assets.............................................................................................................................11
Conclusion.........................................................................................................................13
References..........................................................................................................................15

3INTERNET SERVICE AND SECURITY
Introduction
Security policy of Google is applied to all the services which is offered by this
organization. It affiliations is inclusive of various kinds of things like YouTube, services of
Google are generally provided on various kinds of Android devices. It offers services on other
kinds of sites but it also excludes to separate privacy policy which is not incorporate in this kind
of privacy policy. The privacy policies are not applied to various kinds of services which is
offered by other kinds of organization which is inclusive of products or sites which can be easily
displayed in the various search results. It has certain number of Google services or other sites
which is linked with the services. The privacy policy does not generally cover all the information
practices of other kinds of companies and organization for which advertises our services. It can
easily focus on the use of cookies, pixel tags along with other kinds of sever and offers. Google
works hard to protect this organization from any kind of unauthorized access or any kind of
unauthorized alteration. It focuses on disclosing or destruction of information which is hold by
Google. Google puts some restriction on access to various kinds of vital or important
information.
In the coming pages of the report various kinds of security policies of Google has been
discussed in details. After that various kinds of risk has been checked with respect to given
organization that is Google. Various kinds of risk like assets, threats and vulnerabilities have
been analyzed for the given organization that is Google.

4INTERNET SERVICE AND SECURITY
Discussion
Security policy of Google
When someone makes use of Google services then one trusts the information which is
provided to them. Security Policy of google generally helps in understanding the fact that why
data is collected, what kind of data is collected and what is done with data that is collected. As
per google there are various ways by which one can make use of services for searching and
sharing of information which is used for communication with other people or creation of new
kind of content. When an individual share information with google then the organization aims in
share of those of kind of service for better kind of results. The security policy generally helps in
establishment of connection with people or sharing this kind of information with other
individual. The Security policy of google explains that following things like what kind of
information is collected and why information is collected followed by how to make use of that
information, various kinds of choices offered by google like how an individual can access and
update information.
Google collects information for providing better kinds of services for all kinds of users
round the globe which ranges from figuring out of basic kinds of things like language spoken and
complex kinds of things people who matters the most in the domain of online. Various kinds of
services need to sign up for a Google account. In this case various kinds of personal information
are required like name, email, credit card for storing of information. This organization collects
information related to device specific like hardware model, version of operating system and
various kinds of parameters like phone number. Google store the various kinds of information
like details of using of services like quires of search, internet protocol address. It also makes use
of Google services for collection and processing of information about the actual location of an

5INTERNET SERVICE AND SECURITY
individual. Google makes use of various kinds of technologies for understanding location like IP
address, GPS and other kinds of sensors. There are certain number of services which is inclusive
of unique application number.
Google makes use of information which is collected from various kinds of services for
providing, maintaining, improving it, for developing new ones. It makes use of Google profile
for providing a large number of services which is required for a Google account. When an
individual contact Google, the organization aims in keeping a record of communication for
providing help for solving any kind of problem. Google makes use of email address for
informing about all the services like any kinds of new updates. The organization makes use of
information which is collected from various cookies and other kinds of technologies like pixel
tags and improvisation of user experience and overall quality of services. One of the products
which is used by Google is its own service that is Google Analytics. The organization has
automated service like content (inclusive of email) for providing personal products like search
results, advertising products and detection of malware.
Google combines personal information from one service with information which is
inclusive of personal information like Google services for sharing of things and person known by
them. Various people round the globe have different kinds of threats and privacy concerns. The
goal of this organization is be clear about the information that is collected by them and its
meaning for how it can be used. It focuses on review and update of Google activity controls for
deciding of what kind of data like videos watched on YouTube or any kinds of past research for
the kind of data. It focuses on control for managing when certain kind of activity is generally
stored in the cookie or similar kind of technology on the device when one makes use of services
which is stored during signed out of the technology. It focuses on reviewing and control for the

6INTERNET SERVICE AND SECURITY
type of information which is associated with Google Account by making use of Dashboard of
Google. It also provides view and edit of preferences of Google for the categories which this
organization must be interested. Various kinds of services of Google provides a platform for
sharing of information with others. The various kinds of service of Google provide various kinds
of ways for sharing and removing of content. Whenever an individual makes use of services
Google aims to provide an individual for access to personal information. If anyhow the provided
information is wrong, then the organization aims in deleting or update the provide information.
Google aims to maintain the service in such a way that it can easily protect information from any
kind of accident or malicious kinds of destruction. After deletion of information of services, the
organization might not immediately remove or delete the residual copies from active kind of
server and might have remove information for backup for a system.
Google does not share any kind of personal information outside the organization and
individual outside the google until and unless a situation has taken place:
With the consent: It aims in sharing of personal information with organization or even
individual outside the organization. The organization focus in sharing of sharing of information
any kind of personal information.
Domain Administrator: In any case Google Account is managed by domain
administrator then the domain administrator can provide user support to any kind of organization
which needs to access various kinds of Google account information.
External processing: Google aims in providing personal information which is affiliated
for trust business or various kinds of person for process and it is totally based on instruction and

7INTERNET SERVICE AND SECURITY
is according to privacy policy and any other kind of confidentiality and various kinds of security
measures.
Legal reason: The organization aims to share personal kind of information with large
number of organization and individual outside the organization for having good-faith and it does
not disclose any kind of information.
Google works hard for protecting of Google and other user for any unauthorized access or any
kind of unauthorized changes.
Analyzing risk for Google
Threats and its consequence
Various kinds of threat for Google are
Disgruntled Employees: Internal kind of attack is considered to be one of the biggest
kind of threat for an organization like Google. At present human resource attention rates are
considered to be high, it is considered to be high for any kind of good practice for understanding
the sentiment status for Google1. Unhappy employees are usually considered to be harmless for
Google but in some cases it is seen that it can easily damage the reputation of the organization
and intellectual property.
Mitigation: The first step which can be used for overcoming the risk is identification of
all kinds of accounts and credentials followed by terminate of those that is no longer in use for
the organization. It focuses on connecting to employees which are no longer in organization.
1 Manhas, Saloni, and Swapnesh Taterh. "A Comparative Analysis of Various Vulnerabilities Occur in Google
Chrome." Soft Computing: Theories and Applications. Springer, Singapore, 2018. 51-59.

8INTERNET SERVICE AND SECURITY
Careless or uninformed employees: A careless worker is considered to be dangerous
for any organization like Google2. In many cases it is seen that employees leak information to the
competitor which can be considered to be dangerous for Google. In many cases it is seen that
employees are not trained to have best kind of security practices and also have weak password.
Mitigation: Various employees of Google must be trained to cyber security and also
offer ongoing kind of support. Some employees might not have any kind of idea regarding how
to protect online data and easily risk business data at risk 3. It is considered to be essential for
having training sessions for helping employees and learning how to manage password. It also
aims in hacking teaching how to manage password and avoid hacking through any kind of
criminal activity like phishing and scams.
Mobile theft: Data thefts is considered to be at high vulnerability when various kinds of
employees are making of mobile device for sharing data, accessing information of Google and
lastly neglecting of password for change mobile.
Mitigation: Google must ensure the fact that they have proper BYOD policy. With
proper kind of BYOD policy, employees must be educated on device expectation and so that
organization can easily monitor emails and documents which is being downloaded to
2 González-Orozco, Carlos E., et al. "Phylogenetic approaches reveal biodiversity threats under climate
change." Nature Climate Change 6.12 (2016): 1110.
3 Weichselbaum, Lukas, et al. "CSP is dead, long live CSP! On the insecurity of whitelists and the future of content
security policy." Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security.
ACM, 2016.

9INTERNET SERVICE AND SECURITY
organization or device of employee. In same way Google should implement mobile security
solution which protects both data and access to corporate system.
Unpatched or Unpatchable Devices: Various kinds of network devices like routers,
servers and printers which is employed by a software or firmware in their working4. It is
generally considered to patch for venerability which is not sent or created. The hardware is not
designed to enable them for updating against various kinds of vulnerabilities.
Mitigations: Google should develop vulnerability management technology for looking
into the network. Another method for overcoming situation is having a policy where everyone
has agreed for certain piece of equipment for not update or patch with certain amount of time.
Third party provider: With increase in the technology it is generally becoming for the
organization to have more outsource number and vendors for managing and maintenance of
system5. Various third parties make use of remote access tools for connecting to the network of
the organization. This threat when multiplied exponentially due to lack of vetting which is done
by organization can allow organization to have an access to network.
Mitigation: Google needs to validate any kind of third party which provides remotes
access for best kind of security polices like implementation of multifactor authentication, unique
kinds of credential for Google6. Google should disable all kinds of third party accounts when it is
4 Alexander, Jennifer L., et al. "A meta-analysis and systematic review of the literature to evaluate potential threats
to internal validity in probe procedures for chained tasks." The Journal of Special Education 49.3 (2015): 135-145.
5 Lagerström, Robert, et al. "Exploring the Relationship Between Architecture Coupling and Software
Vulnerabilities." International Symposium on Engineering Secure Software and Systems. Springer, Cham, 2017.
6 Wynne, Brian. "Misunderstood misunderstanding: Social identities and public uptake of science." Public
understanding of science (2016).

10INTERNET SERVICE AND SECURITY
not needed by them. It should focus on monitoring of login attempts followed by red flag alert
for alerting the attack which is sent on right way.
Vulnerabilities
There are many kinds of vulnerabilities for this Google organization like:
 Google finds difficulty for scalability and adaptation of existing kind of
architecture for accommodating of increased traffic and advanced technology.
The greater user traffic and greater number of complexity for products and
services. It focuses on increasing computing power along with expansion and
complex nature which results in inefficiencies or failure operation7. It also focuses
on increasing of cost or failure for accommodation of new kinds of technologies.
It focuses on changing of business requirement which can harm our present result
and financial condition.
 Google reply on various kinds of bandwidth providers, data centers and other
kinds of third aspects for analyzing process for providing products and services to
large number of users. Google needs to have some kind of control over the
various kinds of third party vendors.
 Technologies can be easily developed which can easily block the display of large
number of advertisement. Maximum amount of revenue which can be derived
from the various kinds of advertisement which is used for connection for display
of web pages.
 Proprietary documents formats can easily limit the effectiveness of search
technology by prevention of various kinds of document formats. A large amount
7

11INTERNET SERVICE AND SECURITY
of information on the domain of internet is provided by taking into proprietary
document formats like Microsoft word8. Various providers of software application
are used for creation of documents that can engineer the format of document for
prevent or interfere with large number of abilities.
 Index spammer can easily harm the integrity of web search results. It can damage
the reputation and cause of dissatisfied with various kinds of products and
services. There are large of increasing number of effort for development of ways
for manipulation for web search results. This will ultimately result in decline in
traffic which can damage the business of google.
 Privacy concern which is related to technology can easily damage the reputation
of the organization like Google. Various kinds of concern might be developed
which focus on privacy of users with respect to collection of data. It is also
possible some of the cases that certain number of jurisdiction can easily enact law
or various kinds of regulation for offering various kinds of product and services.
 Various kinds of individuals are making use of non-PC devices for accessing to
internet. Functionality and associated memory with alternative makes use of
product and services then it can make this kind of device difficult.
8 González-Orozco, Carlos E., et al. "Phylogenetic approaches reveal biodiversity threats under
climate change." Nature Climate Change 6.12 (2016): 1110.

12INTERNET SERVICE AND SECURITY
Assets
The assets of Google are nothing but various kinds of plans, procedure, knowledge bases
and policies which is used for specific and is used for performing of organization9. It is inclusive
of any kind of artificial, knowledge from various kinds of methods used for governing a project.
This kind of assets is inclusive of both formal and informal plans, policies for procedure and
knowledge bases that is used for various organization. Google should make use of asset
management company so that it can diverse all its clients10. Asset management organization
focus on investing of funds into large number of securities. It generally provides various kinds of
organization with much diversification and investing option themselves. AMC generally manage
by making use of mutual funds, plans for pension and organization can earn by charging fees or
commission to the clients. Google should appoint asset manager for research, review and
analysis of computer markets,
Asset management generally requires certain number of ways for maximizing the value
of a company by properly managing fixed and intangible kind of assets11. It is considered to be
more reliable, efficient and cheaper by evaluation of various kinds of assets of this organization.
9 Chen, Kai, et al. "Finding Unknown Malice in 10 Seconds: Mass Vetting for New Threats at the Google-Play
Scale." USENIX Security Symposium. Vol. 15. 2015.
10 Groenteman, Ronny, et al. "Assessing invasion threats: novel insect-pathogen-natural enemy
associations with native New Zealand plants in southern California." Biological Invasions17.5
(2015): 1299-1305.
11 Johnston, Allen C., et al. "Dispositional and situational factors: influences on information security policy
violations." European Journal of Information Systems 25.3 (2016): 231-251.