Google-Assessment-Header-v2

WELCOME BACK TO THE
GOOGLE OAuth PARTNER PROGRAM 

We are excited to work with you again to assess your application security and help you meet Google's security requirements.

Ready to start your annual security reassessment? 

Google has announced the enforcement of their Google APIs Services User Data Policy for 2021. Developers will need to reverify their apps and recertify their Letter of Assessment (LOA) to comply with this Google policy annually.

Google will be reaching out to developers individually providing dates, milestones, and expiration deadlines. To ensure developers fulfill re-certification in time, we encourage developers to keep their Project Owner and Project Editors accounts up to date in your Google Cloud Console and reply directly back to Google's email communication thread.  

How to meet your expiration deadline?

Developers that plan to continue using Google APIs must take these three steps:

STEP 1 : Reply to Google's email notification that you acknowledge receiving email notification. You do NOT need to resubmit your app through your GCP console, unless you have a new app. 

STEP 2 : A 2nd email will be sent with dates, milestone, and submission deadline. Developers are required to demonstrate continued compliance with our Additional Requirements for Specific Scopes and Limited Use requirements by completing the items listed under "ACTION REQUIRED" below.

STEP 3 : A final email with approval for developer to begin work with Bishop Fox Account Manager to prepare your Statement of Work (SOW).

ACTION REQUIRED:  Demonstrate compliance

ITEM 1  -  Add a disclosure to your app that complies with the below requirements:

  • The disclosure should clearly call out the app’s compliance/adherence to the Google API Services User Data Policy, including the Limited Use requirements.
  • Example of disclosure: “(App’s) use and transfer to any other app of information received from Google Accounts will adhere to Google API Services User Data Policy, including the Limited Use requirements.”
  • The disclosure must be accessible on or one click away from the project’s verified homepage URL that is listed on the OAuth Consent Screen configuration page in your Cloud Console.
  • The disclosure must be easily visible to all users.
  • The disclosure must be under 500 characters.
  • You must provide a link to the URL where the disclosure is hosted.
  • Note: apps distributed on Google Play are subject to the Google Play Developer Distribution Agreement.


ITEM 2  -  Let us know of any changes to your app:

  • 2a. If you have not made any changes to your app’s functionality and/or your app’s usage of Restricted scopes since your last compliance review, Please respond to the Google email to confirm your agreement using the following statement:
    “I hereby confirm that there have been no changes to my app’s functionality in relation to Restricted Scopes and/or changes to my app’s usage of Restricted Scopes since completion of my last security assessment. 
    I understand that my app may be randomly audited for continued compliance with the Google API Services User Data Policy. I understand that if my app falls out of compliance, then access to Restricted scopes will be revoked.”
  • 2b. If you have made changes to your app’s functionality, then please respond to the Google email with a YouTube video link that meets all the below requirements:
    • Video is publicly accessible
    • OAuth Consent Screen is in English
    • OAuth Consent Screen shows the App Name
    • URL bar of the OAuth Consent Screen shows the Client ID containing the project number fully displayed (Note: this is not required for native Android and iOS apps)
    • Shows the OAuth grant process that users will experience
    • Shows how the data will be used by demonstrating functionality for each sensitive and restricted scope that are being requested
    • Shows how data is accessed on each OAuth client. This is required for every OAuth client in your project

Once you respond to Google, they will review your app for compliance. In case they have further questions, their team will reach back out to you on the Google email thread. If they confirm your app is still compliant, they will respond to you with next steps on reaching out to a qualified third-party security assessor to begin the reassessment process. Please do not pursue a reassessment until further instructions from their team.

You can find more information on the OAuth Application Verification FAQ

      
Bishop Fox was an outstanding partner for us. Under strict Google deadlines, they provided timely project quotes, reasonable prices, and excellent execution. The assessment was very well guided and communicated which made it smooth for us. The assessment was extremely helpful for our company.

 

Jeff Oberlander, VP of Engineering PipelineDeals

WE DESIGNED THE PROGRAM

Bishox Fox collaborated with Google to design the Partner Security Program. We know what's needed for you to pass the testing requirements.

WE DO ONE THING

Bishop Fox was founded on the principle that all we do is advise our clients so they can make the best possible security decision.

DEEP EXPERIENCE

Our Team's technical depth and expertise means we can tailor every solution or project to your unique requirements.

SENIOR EXPERTISE

Partners and senior consultants drive service delivery, and we are committed to every project’s success. You won’t be handed off to a junior team.

Get Started

FAQs

WHERE DO I FIND MY GOOGLE PRODUCT NAME AND NUMBER?

The following page explains how a partner can find the project ID and project number:

https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects

HOW MUCH WILL THE ASSESSMENT COST?

We have negotiated discounted pricing with Google for this program, and the cost is between $15,000 and $75,000 (or more) depending on the size of the application, size of the environment, and how Google user data is utilized .

WHEN WILL THE ASSESSMENT START?

Partners will need to provide full project enablement items (e.g. credentials, test accounts, documentation, etc.) before receiving a start date. This is to ensure that there are no delays to the project schedule.

HOW LONG WILL THE ASSESSMENT TAKE?

Once all the paperwork is in place, fieldwork can typically take 1 to 4 weeks. After that, reporting and QA can take up to 1 week for report delivery. This does not include remediation time.

WHAT WILL THE SCOPE OF THE TESTING BE?

The focus of the penetration testing will be on the external perimeter internet-facing assets and applications that store Google user data on non-Google servers, a self-assessment questionnaire, and a cloud deployment review.

WHAT WILL THE SCOPING INFORMATION BE USED FOR?

Information shared with us for scoping will be used to determine overall effort required and also shorten the ramp up time needed for testing. If we can understand the environment before testing, we can spend less time on discovery/footprinting and more time and on active pen testing. The more accurate the scoping details are, the more accurate and cost sensitive we can be with the scope and quote.

DO I NEED TO PROVIDE SOURCE CODE?

We’ll leave that up to you. If you want to provide source code, it can help us be more efficient with our time and get to a deeper level of testing. That said, source code is not required for this assessment.

HOW WILL MY SENSITIVE DATA BE HANDLED?

All sensitive data including source code will be stored, processed, and transmitted securely. Your Bishop Fox engagement manager can help setup a secure file share to use throughout the project.

HOW LONG DOES REMEDIATION TAKE?

Last year, we found that partners took an average of 28 days to implement fixes and complete remediation testing. Of the 28 days, about 2-3 days were used for Bishop Fox to retest the findings and issue a remediation report. This is important to note in consideration of any Google-issued deadlines.

ONLY A SMALL PART OF MY APPLICATION USES GOOGLE APIS. DOES IT ALL GET INCLUDED IN THE SCOPE?

Yes, unless Google customer data is clearly isolated from other parts of your application, we need to test the entire application. If an attacker is able to exploit one part of your application not directly related to Google, that exploit could be used to compromise Google customer data.

WE ARE REBUILDING THE APPLICATION NOW AND/OR MIGRATING IT TO A NEW INFRASTRUCTURE. SHOULD WE DO THE TEST NOW OR LATER?

If it's possible to hold off (considering any deadlines given by Google), it would be best to have the most up-to-date version of your application and environment tested. This is to ensure we get appropriate coverage on any additional functionality or environment changes that could affect testing.

WE ARE INTERESTED IN A STANDARD LETTER OF ASSESSMENT IN ADDITION TO THE GOOGLE TESTING LETTER. DOES THIS CHANGE THE SCOPE/COST?

Yes, we will need to review the scope and determine if additional testing is required to meet our standards for a general Letter of Assessment in addition to the Google Testing Letter. If you have a particular compliance requirement, please describe it and the framework so we can consider it appropriately in scoping.


STILL HAVE QUESTIONS?

Email one of our Google security experts to learn how we can support your needs at googlepartners@bishopfox.com