GROUP-005: Group conversation visibility defaults to members (GWS.GROUPS.3.1)
- Plataforma
- Google Workspace
- Categoría
- Collaboration
- Severidad
- Low
- Pilar de Zero Trust
- Data (peso 2)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA GWS.GROUPS.3.1 requires that the default permission for viewing group conversations be restricted to group members rather than the whole domain or the public. Overly-open conversation visibility exposes discussion archives — which can contain sensitive student and staff information. This check reads viewTopicsDefaultAccessLevel from the groups_for_business.groups_sharing policy and warns where the default is broader than group members.
Valor recomendado
Default conversation view access set to GROUP_MEMBERS
Remediación
In Groups for Business settings, set the default 'who can view conversations' permission to group members.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| not-assessed | Not Assessed |
| warn | WARN |
Mapeos a marcos de referencia
- CISA SCuBA
- GWS.GROUPS.3.1v1
- NIST SP 800-53
- AC-3, AC-22