GTRADE-003: Open-Join / External-Member Groups
- Plataforma
- Google Workspace
- Categoría
- Adversary Tradecraft
- Severidad
- Medium
- Pilar de Zero Trust
- Visibility & Analytics (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Groups that anyone (or anyone in the domain) can join, or that allow external members, widen the trust boundary and enable self-service access — if such a group also holds resource or IAM access, joining it inherits that access (a privilege-escalation path Google classifies as intended behavior).
Valor recomendado
Groups restricted to invited members; no anyone-can-join and no external members unless explicitly required
Remediación
Apps > Google Workspace > Groups for Business: set default 'Who can join' to 'Only invited users' and disable 'Allow external members' unless a group explicitly requires them; review groups that grant resource/IAM access.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- NIST SP 800-53
- AC-3, AC-6
- CIS Benchmark
- 1.x
- MITRE ATT&CK
- T1078, T1136