ADMIN-020: Access to unconfigured third-party apps blocked (GWS.COMMONCONTROLS.10.4)
- Plataforma
- Google Workspace
- Categoría
- Admin & User Management
- Severidad
- High
- Pilar de Zero Trust
- Applications & Workloads (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Rutas de veredicto declaradas, cada una probada con un fixture
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.COMMONCONTROLS.10.4 requires that users SHALL NOT be allowed to access unconfigured third-party apps, because an app that has not been explicitly reviewed can request broad OAuth scopes and become a data-exfiltration or account-takeover path. This check reads the api_controls.unconfigured_third_party_apps Cloud Identity policy and flags any organizational unit whose access level is not BLOCK_ALL_SCOPES (the value that blocks all access to unconfigured apps).
Valor recomendado
Access level for unconfigured third-party apps set to BLOCK_ALL_SCOPES in all organizational units.
Remediación
In the Google Admin console, under Security > API controls > App access control, set unconfigured third-party apps to 'Blocked', so users cannot grant any access to apps that have not been explicitly configured and reviewed.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.COMMONCONTROLS.10.4v1
- NIST SP 800-53
- AC-3, AC-6