AUTH-018: Account self-recovery disabled for users and non-super admins (GWS.COMMONCONTROLS.8.2)
- Plataforma
- Google Workspace
- Categoría
- Authentication & Access Controls
- Severidad
- Medium
- Pilar de Zero Trust
- Identity (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Rutas de veredicto declaradas, cada una probada con un fixture
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.COMMONCONTROLS.8.2 requires that account self-recovery be disabled for users and non-super-admin accounts. Self-service recovery is an account-takeover vector: an attacker who controls a recovery channel can seize the account without the help desk. This check reads the security.user_account_recovery Cloud Identity policy and flags any organizational unit where self-recovery is enabled.
Valor recomendado
Account self-recovery disabled (enableAccountRecovery = false) for users and non-super admins in all organizational units.
Remediación
In the Google Admin console, under Security > Account recovery, disable self-recovery for users (and non-super admins), so account recovery is handled through an administrator or help-desk process rather than a user-controlled channel.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.COMMONCONTROLS.8.2v1
- NIST SP 800-53
- IA-5, AC-2