GROUP-001: External access to Google Groups restricted (GWS.GROUPS.1.1)
- Plataforma
- Google Workspace
- Categoría
- Collaboration
- Severidad
- High
- Pilar de Zero Trust
- Data (peso 3)
- Fixtures de referencia
- 4
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.GROUPS.1.1 requires that Groups for Business sharing be limited so groups are not accessible to people outside the organization. When the group sharing collaboration capability is not set to domain-users-only, group content — which in a school can include student and staff data — becomes reachable by external parties. This check reads the groups_for_business.groups_sharing policy from the Cloud Identity Policy API and flags any organizational unit whose collaboration capability is not DOMAIN_USERS_ONLY.
Valor recomendado
Groups sharing collaboration capability set to DOMAIN_USERS_ONLY for all organizational units
Remediación
In the Google Admin console under Apps > Google Workspace > Groups for Business > Sharing settings, set group access to be limited to users in the organization (not 'Anyone on the internet'), so external parties cannot access group content.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-policy | Not Assessed |
| not-assessed | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.GROUPS.1.1v1
- NIST SP 800-53
- AC-3, AC-22, SC-7