Responding to Compromised Email Accounts in Google Workspace | Phishing Response for Education IT

Email spoofing and account takeover are hitting schools hard — both staff and students. When one mailbox is compromised, it can send phishing to thousands. In this session, John Warf walks through MCNC's CIFER playbook — Contain, Investigate, Find, Enforce, Recover — for responding to a compromised account in oogle Workspace, followed by a live walkthrough in the Admin Console and Q&A. What you'll learn: Reading login and audit logs to spot suspicious activity Finding and removing malicious emails across your domain Enforcing 2-Step Verification (including for students) Remediating an account: passwords, sessions, forwarding rules, recovery Hardening against spoofing and building custom alert rules Presentation: https://docs.google.com/presentation/... Reference Guide: https://drive.google.com/file/d/1330B... CIFER Checklist: https://docs.google.com/document/d/1_... Presented by MCNC. Admin Console paths and settings may change as Google updates Workspace.