DRIVE-021: Publishing Drive content to the web disabled (GWS.DRIVEDOCS.1.5)
- Platform
- Google Workspace
- Category
- Drive Security & Data Protection
- Severity
- High
- Zero Trust pillar
- Data (weight 3)
- Golden fixtures
- 5
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- baseline
What it checks
SCuBA GWS.DRIVEDOCS.1.5: publishing to the web takes a document out of the permission model entirely, making it readable by anyone holding the link and indexable by search engines, with no per-recipient record of who reached it. Reads drive_and_docs.external_sharing and fails where allowPublishingFiles is on in any policy whose externalSharingMode permits external sharing. Not applicable where external sharing is disallowed.
Recommended value
Publishing Drive content to the web is disabled
Remediation
Admin console > Apps > Google Workspace > Drive and Docs > Sharing settings > 'Published web content'. Turn off publishing so files cannot be made visible to anyone with the link.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| field-missing | Not Assessed |
| known-bad | WARN |
| not-applicable | PASS |
| not-assessed | Not Assessed |
Framework mappings
- CISA SCuBA
- GWS.DRIVEDOCS.1.5v1
- NIST SP 800-53
- AC-3, AC-4, AC-22
- MITRE ATT&CK
- T1537