Granting ChatGPT access to your Google Drive account allows it to have extensive permissions across your shared drive, which introduces various cybersecurity challenges. This post discusses how to monitor ChatGPT actions directly in the Google Workspace admin console and how Nudge Security can offer comprehensive visibility into all genAI collaborations.
Since its launch in 2022, OpenAI has surprised many with consistent product updates and enhancements. A recent update on May 16, 2024, titled “Improvements to data analysis in ChatGPT,” introduced the capability to directly add files from Google Drive and Microsoft OneDrive. Similar functionalities have been added by other genAI tools like Google AI Studio and Claude Enterprise. Quite impressive, don’t you think?
By linking your Google Drive or OneDrive account to ChatGPT (or other genAI tools), you grant them broad permissions not just to your personal files but to assets throughout the shared drive. While this integration offers benefits, it also poses numerous cybersecurity challenges.
So, how can you ascertain if employees have activated the ChatGPT and Google Drive integration, and how can you track accessed files? This post illustrates the process within Google Workspace and how Nudge Security aids in uncovering all genAI applications in use along with their integrations with other apps.
Locations to Observe ChatGPT Operations in Google Workspace
In Google Workspace, there are several approaches to identify and examine activities related to ChatGPT connectivity.
Within Google Workspace’s Admin Console, proceed to Reporting > Audit and investigation > Drive log events. Here, you can view a record of resources accessed in Google Drive.
You can also delve into the activity through API requests under Reporting→Audit and investigation→ Oauth log events.
Regularly monitoring your Google Workspace admin console allows you to track ChatGPT’s resource access, but detecting this activity post-occurrence is less valuable compared to timely alerts when new ChatGPT integrations are established. This is where Nudge Security plays a crucial role.
Techniques to Identify all genAI Collaborations with Nudge Security
Nudge Security uncovers all accounts ever generated by individuals within your organization for any SaaS application, including ChatGPT and the rapidly expanding array of newly developed genAI tools, without any prior tool-specific knowledge. Through the AI-powered dashboard, users can stay updated on AI adoption and proactively counter AI security risks.
Furthermore, Nudge Security showcases all OAuth permissions from your entire organization, such as those provided to ChatGPT, within a filterable OAuth dashboard comprising grant types (sign-in or integration), activities, and risk analyses. Filter by category to review all permissions linked to AI tools:
To view detailed information about a grant, simply click on it to open a dedicated screen. Here, you can examine a risk profile, see who created the grant and when, review access details, granted scopes, and more:
You have the option to send a “nudge” to the grant creator via Slack or email, prompting them to take specific actions like restricting the grant’s scope. Alternatively, you can instantly revoke the grant directly from the Nudge Security user interface.
Moreover, you can establish a personalized rule to receive notifications when an OAuth grant for ChatGPT (or any other genAI app) is created by a user at your organization. These rules can also notify you instantly about the creation of new genAI accounts, allowing you to nudge new genAI users to acknowledge your genAI acceptable use policy.
Striking a balance between productivity and security
Although the combination of ChatGPT with Google Drive and Microsoft OneDrive promises enhanced productivity, it also poses significant security challenges. To navigate these integrations successfully, organizations must comprehend the associated risks and implement appropriate governance and security protocols.
Nudge Security furnishes insights, context, and automated mechanisms to facilitate the adoption of genAI tools by enterprises without compromising data security.
Initiate a complimentary 14-day trial now to promptly identify all genAI applications ever integrated into your organization, along with their connections to other software solutions.
About Author
