GWS-K12-013: Legacy Authentication Disabled For Students
- Platform
- Google Workspace
- Category
- K12 Baseline
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 6
- Branch coverage
- Declared verdict paths, each proven by a fixture
- Provenance
- original
- Scope
- OU-scoped: requires the -StudentOU input (or the Student OUs field in Show-Guerrilla). Without it, this check reports Not Assessed.
Guerrilla K12 Baseline (candidate)
This check assesses control K12-ACCT-002 of the K12 Secure Configuration Baseline, version 0.1.0, a candidate community baseline authored by Guerrilla. It is openly published and open for comment; it is not a consensus standard, and this block is deliberately separate from the external framework mappings below.
What it checks
POP and IMAP are pre-OAuth mail-access protocols that bypass modern sign-in challenges and second factors: a valid username and password is enough. They exist for legacy desktop mail clients a student OU does not need, and leaving them on keeps a credential-only door open next to the front door the district hardened with 2SV. This check resolves the Gmail IMAP and POP end-user access settings for each student OU. App-specific passwords, a related legacy path, are not exposed by this policy surface and remain a manual review item.
Recommended value
IMAP and POP end-user access are disabled for student OUs
Remediation
Admin Console > Apps > Google Workspace > Gmail > End User Access. Select the student organizational unit and turn off both IMAP and POP access. App-specific passwords are a related legacy-access path this check cannot read; review them separately.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-policy | WARN |
| no-scope | Not Assessed |
| not-assessed | Not Assessed |
| ou-absent | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-2
- MITRE ATT&CK
- T1110, T1078.004