Google Workspace for Education applications and Google Chrome extensions are used to add functionality to Google services and the Chrome web browser that are not already provided. Google has kept the Chrome Web Store and Google Workspace for Education Marketplace open for any developer to upload their own applications or extensions. Since this is the case, it is important to take into account the associated security risks when installing applications and extensions from the Google Workspace for Education Marketplace and the Chrome Web Store. The Division of IT (DIT) IT Compliance team performs risk assessments of third party IT products, including Google Workspace for Education applications and Google Chrome extensions. If you would like a product to be reviewed or have any questions about risk assessments, please reach out to IT-Compliance@umd.edu.
Applications can only be installed from the Google Workspace for Education Marketplace but are available to anyone with a Google account. Google Workspace for Education applications are integrated directly into the core Google services like Google Docs, Google Sheets, Google Slides, etc. Extensions can only be installed from the Chrome Web Store. Extensions are integrated into the Chrome web browser and can be accessed from outside of the Google Workspace for Education.
When installing an application from the Google Workspace for Education Marketplace, access to information on one’s Google account will be requested. The Google products that usually hold the most sensitive information are Gmail, Photos, Drive, Calendar and Contacts. It is essential to read through these permissions requests and make sure only the necessary information is given to the application. The Google support guide provides more information on Google account permissions.
Chrome extensions can have more access to the data on your device. Google assesses the risk of an extension based on the permissions the extension requests. Below are some of the permissions that may be requested and how they are ranked: