DRIVE-018: Shared Drive External-Sharing Exposure
- Platform
- Google Workspace
- Category
- Drive Security & Data Protection
- Severity
- High
- Zero Trust pillar
- Data (weight 2)
- Golden fixtures
- 4
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- original
What it checks
Enumerates every shared drive in the tenant via domain-admin access and inspects each drive's sharing restrictions. A shared drive whose restriction domainUsersOnly is not enforced permits its contents to be shared with accounts outside the organization, up to and including public 'anyone with the link' access if the domain-level sharing setting allows it. This assesses the drive-level restriction that gates external sharing; confirming an actual public file link requires a per-file permission scan this check does not perform.
Recommended value
Every shared drive restricts access to organization members (domainUsersOnly = true), or external sharing is a documented, reviewed exception
Remediation
Admin Console > Apps > Google Workspace > Drive and Docs > Manage shared drives. For each flagged shared drive, open its settings and turn off 'Sharing with people outside <organization>' (and 'Sharing with non-members') so items cannot be shared externally, or record the business exception. Enforce a domain default under Sharing settings > Shared drive creation.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| empty | PASS |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-3, AC-4
- MITRE ATT&CK
- T1537, T1567.002