DRIVE-017: Default file access set to private to owner (GWS.DRIVEDOCS.1.8)
- Plataforma
- Google Workspace
- Categoría
- Drive Security & Data Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Data (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Rutas de veredicto declaradas, cada una probada con un fixture
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.DRIVEDOCS.1.8 requires that 'Private to owner' be the default access level for newly created Drive items, so files are not shared more broadly than intended at creation time. This check reads the drive_and_docs.general_access_default Cloud Identity policy and flags any organizational unit where the default file access is not PRIVATE_TO_OWNER.
Valor recomendado
Default access level for new files set to PRIVATE_TO_OWNER (defaultFileAccess) in all organizational units.
Remediación
In the Google Admin console, under Apps > Google Workspace > Drive and Docs > Sharing settings > General access default, set the default to 'Private to owner' so newly created files start private and are shared only by deliberate action.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.DRIVEDOCS.1.8v1
- NIST SP 800-53
- AC-3, AC-6