EMAIL-030: Automatic email forwarding disabled (GWS.GMAIL.11.1)
- Plataforma
- Google Workspace
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Data (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Rutas de veredicto declaradas, cada una probada con un fixture
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.GMAIL.11.1 recommends disabling automatic email forwarding, especially to external domains. Auto-forwarding is a common data-exfiltration channel and a persistence mechanism after account takeover, because it silently copies inbound mail to an attacker-controlled address. This check reads the gmail.auto_forwarding Cloud Identity policy and flags any organizational unit where automatic forwarding is enabled.
Valor recomendado
Automatic email forwarding disabled (enableAutoForwarding = false) in all organizational units.
Remediación
In the Google Admin console, under Apps > Google Workspace > Gmail > End User Access, disable 'Allow users to automatically forward incoming email to another address', prioritizing external destinations. Review existing forwarding rules for unexpected external recipients.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.GMAIL.11.1v1
- NIST SP 800-53
- AC-4, SC-7