Data/AuditChecks/DriveSecurityChecks.json
|
{ "categoryId": "drive", "categoryName": "Drive Security & Data Protection", "categoryDescription": "Checks related to Google Drive sharing, access controls, DLP, and data protection settings", "checks": [ { "id": "DRIVE-001", "name": "External Sharing Defaults", "description": "Sharing outside the organization should be restricted or disabled by default to prevent accidental data exposure to external parties", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Sharing", "recommendedValue": "External sharing restricted to allowlisted domains or disabled", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings > Set sharing outside the organization to 'Off' or 'Allowlisted domains'", "compliance": { "nistSp80053": [ "AC-3", "AC-4" ], "mitreAttack": [ "T1567", "T1537" ], "cisBenchmark": [ "2.1" ], "scuba": [ "GWS.DRIVEDOCS.1.1v1", "GWS.DRIVEDOCS.1.2v1", "GWS.DRIVEDOCS.1.6v1" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-002", "name": "Link Sharing Default Settings", "description": "Default link sharing should be set to 'Restricted' (specific people) rather than broad access to prevent unintended data exposure", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Sharing", "recommendedValue": "Default link sharing set to 'Restricted' (specific people only)", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings > Set default link sharing to 'Restricted'", "compliance": { "nistSp80053": [ "AC-3", "AC-6" ], "mitreAttack": [ "T1530" ], "cisBenchmark": [ "2.2" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-003", "name": "Anyone With the Link Sharing Audit", "description": "Files shared with 'Anyone with the link' are accessible to anyone on the internet and represent a significant data exposure risk", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Sharing", "recommendedValue": "'Anyone with the link' sharing disabled or tightly controlled", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings > Disable 'Anyone with the link' option or restrict to 'Domain users with the link'", "compliance": { "nistSp80053": [ "AC-3", "AC-22" ], "mitreAttack": [ "T1530", "T1213" ], "cisBenchmark": [ "2.3" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-004", "name": "Shared Drive Creation Restrictions", "description": "Shared Drive creation should be restricted to prevent uncontrolled proliferation and ensure proper governance of shared data repositories", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Shared Drives", "recommendedValue": "Shared Drive creation restricted to specific groups or admins", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings > Shared drive creation > Restrict who can create shared drives", "compliance": { "nistSp80053": [ "CM-7", "AC-6" ], "mitreAttack": [ "T1530" ], "cisBenchmark": [ "2.4" ], "scuba": [ "GWS.DRIVEDOCS.2.1v1", "GWS.DRIVEDOCS.2.2v1" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-005", "name": "Shared Drive Member Management", "description": "Shared Drive member management should be controlled to prevent unauthorized users from being added or permissions being escalated", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Shared Drives", "recommendedValue": "Only managers can add members and change access levels", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings > Shared drive settings > Configure member management permissions", "compliance": { "nistSp80053": [ "AC-3", "AC-6(1)" ], "mitreAttack": [ "T1098" ], "cisBenchmark": [ "2.5" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-006", "name": "Shared Drive External Sharing", "description": "External sharing on Shared Drives should be restricted to prevent sensitive organizational data from being shared outside the domain", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Shared Drives", "recommendedValue": "External sharing on Shared Drives disabled or restricted to allowlisted domains", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Sharing settings > Shared drive sharing > Restrict external sharing", "compliance": { "nistSp80053": [ "AC-3", "AC-4" ], "mitreAttack": [ "T1537", "T1567" ], "cisBenchmark": [ "2.6" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-007", "name": "File Ownership Transfer Settings", "description": "File ownership transfer should be controlled to prevent unauthorized data migration and maintain proper data governance chains", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Access Control", "recommendedValue": "File ownership transfer restricted to admins or controlled process", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Transfer ownership settings > Configure restrictions", "compliance": { "nistSp80053": [ "AC-3", "MP-5" ], "mitreAttack": [ "T1537" ], "cisBenchmark": [ "2.7" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-008", "name": "Drive for Desktop Allowed/Blocked", "description": "Drive for Desktop syncs files locally and should be controlled to prevent data from being stored on unmanaged endpoints", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Access Control", "recommendedValue": "Drive for Desktop restricted to managed devices or disabled", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/drivefordesktop", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Features and Applications > Drive for Desktop > Configure access", "compliance": { "nistSp80053": [ "SC-28", "MP-7" ], "mitreAttack": [ "T1530", "T1005" ], "cisBenchmark": [ "2.8" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-009", "name": "Third-Party App Drive Access", "description": "Third-party applications with access to Drive data should be reviewed and restricted to prevent unauthorized data exfiltration", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Data Protection", "recommendedValue": "Third-party app access to Drive data restricted and reviewed", "remediationUrl": "https://admin.google.com/ac/owl/list?tab=apps", "remediationSteps": "Admin Console > Security > API controls > Third-party app access > Review and restrict apps with Drive access", "compliance": { "nistSp80053": [ "AC-3", "AC-20" ], "mitreAttack": [ "T1530", "T1567.002" ], "cisBenchmark": [ "2.9" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-010", "name": "Drive DLP Rules Audit", "description": "Data Loss Prevention rules should be configured to detect and prevent sharing of sensitive data through Google Drive", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Data Protection", "recommendedValue": "DLP rules configured for sensitive data types (PII, financial, health data)", "remediationUrl": "https://admin.google.com/ac/dp/rules", "remediationSteps": "Admin Console > Security > Data protection > Manage rules > Create rules for sensitive data types in Drive", "compliance": { "nistSp80053": [ "SC-7", "SI-4" ], "mitreAttack": [ "T1567", "T1048" ], "cisBenchmark": [ "2.10" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-011", "name": "Target Audience Settings", "description": "Target audience settings control who can be suggested when sharing files and should be configured to limit accidental sharing", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Sharing", "recommendedValue": "Target audiences configured to limit sharing suggestions appropriately", "remediationUrl": "https://admin.google.com/ac/targetaudiences", "remediationSteps": "Admin Console > Directory > Target audiences > Review and configure target audience groups", "compliance": { "nistSp80053": [ "AC-3", "AC-6" ], "mitreAttack": [ "T1530" ], "cisBenchmark": [ "2.11" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-012", "name": "Drive Add-ons Settings", "description": "Drive add-ons can access file content and should be controlled to prevent data exposure through untrusted extensions", "severity": "Low", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Access Control", "recommendedValue": "Drive add-on installation restricted to admin-approved add-ons", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/addons", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Features and Applications > Add-ons > Configure installation restrictions", "compliance": { "nistSp80053": [ "CM-7", "CM-11" ], "mitreAttack": [ "T1195.002" ], "cisBenchmark": [ "2.12" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-013", "name": "Offline Access Settings", "description": "Offline access allows Drive files to be cached locally on devices and should be controlled to prevent data exposure on shared or unmanaged devices", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Access Control", "recommendedValue": "Offline access disabled or restricted to managed devices", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/offlineaccess", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Features and Applications > Offline > Disable or restrict offline access", "compliance": { "nistSp80053": [ "SC-28", "AC-19" ], "mitreAttack": [ "T1005", "T1530" ], "cisBenchmark": [ "2.13" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-014", "name": "Drive SDK API access disabled (GWS.DRIVEDOCS.4.1)", "description": "SCuBA GWS.DRIVEDOCS.4.1: the Drive SDK lets third-party apps read and write Drive content via API, a direct data-exfiltration channel when broadly enabled. Reads drive_and_docs.drive_sdk; fails where enableDriveSdkApiAccess is on.", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 3, "subcategory": "Drive API", "recommendedValue": "Drive SDK API access disabled", "remediationSteps": "In Admin console > Apps > Google Workspace > Drive and Docs > Features and Applications, disable Drive SDK unless specific reviewed integrations require it.", "compliance": { "scuba": [ "GWS.DRIVEDOCS.4.1v1" ], "nistSp80053": [ "AC-4", "AC-3", "SC-7" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-015", "name": "Drive external-file warning enabled (GWS.DRIVEDOCS.1.9)", "description": "SCuBA GWS.DRIVEDOCS.1.9: warning users when they share files externally is a low-friction data-loss control. Reads drive_and_docs.external_file_warning; warns where highlightingEnabled is off.", "severity": "Low", "zeroTrustPillar": "Data", "zeroTrustWeight": 1, "subcategory": "Drive Sharing", "recommendedValue": "External-file sharing warning enabled", "remediationSteps": "In Drive sharing settings, enable warnings when users share files with people outside the organization.", "compliance": { "scuba": [ "GWS.DRIVEDOCS.1.9v1" ], "nistSp80053": [ "AC-22", "SI-10" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-016", "name": "Drive file security update enforced (GWS.DRIVEDOCS.3.1)", "description": "SCuBA GWS.DRIVEDOCS.3.1: the file security update tightens link-sharing on affected files; letting users remove it re-opens access. Reads drive_and_docs.file_security_update; warns where users are allowed to remove/manage the security update.", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Drive Sharing", "recommendedValue": "Security update applied and users cannot remove it", "remediationSteps": "In Drive settings, apply the file security update and do not allow users to remove it from files they own.", "compliance": { "scuba": [ "GWS.DRIVEDOCS.3.1v1" ], "nistSp80053": [ "AC-3", "CM-6" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null }, { "id": "DRIVE-017", "name": "Default file access set to private to owner (GWS.DRIVEDOCS.1.8)", "description": "SCuBA GWS.DRIVEDOCS.1.8 requires that 'Private to owner' be the default access level for newly created Drive items, so files are not shared more broadly than intended at creation time. This check reads the drive_and_docs.general_access_default Cloud Identity policy and flags any organizational unit where the default file access is not PRIVATE_TO_OWNER.", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Drive Sharing", "recommendedValue": "Default access level for new files set to PRIVATE_TO_OWNER (defaultFileAccess) in all organizational units.", "remediationSteps": "In the Google Admin console, under Apps > Google Workspace > Drive and Docs > Sharing settings > General access default, set the default to 'Private to owner' so newly created files start private and are shared only by deliberate action.", "compliance": { "scuba": [ "GWS.DRIVEDOCS.1.8v1" ], "nistSp80053": [ "AC-3", "AC-6" ] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null, "verdictPaths": [ "clean", "known-bad", "not-assessed" ] }, { "id": "DRIVE-018", "name": "Shared Drive External-Sharing Exposure", "description": "Enumerates every shared drive in the tenant via domain-admin access and inspects each drive's sharing restrictions. A shared drive whose restriction domainUsersOnly is not enforced permits its contents to be shared with accounts outside the organization, up to and including public 'anyone with the link' access if the domain-level sharing setting allows it. This assesses the drive-level restriction that gates external sharing; confirming an actual public file link requires a per-file permission scan this check does not perform.", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Shared Drives", "recommendedValue": "Every shared drive restricts access to organization members (domainUsersOnly = true), or external sharing is a documented, reviewed exception", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin Console > Apps > Google Workspace > Drive and Docs > Manage shared drives. For each flagged shared drive, open its settings and turn off 'Sharing with people outside <organization>' (and 'Sharing with non-members') so items cannot be shared externally, or record the business exception. Enforce a domain default under Sharing settings > Shared drive creation.", "compliance": { "nistSp80053": [ "AC-3", "AC-4" ], "mitreAttack": [ "T1537", "T1567.002" ], "cisBenchmark": [] }, "provenance": "original", "source_url": null, "source_read_date": null, "official_id": null, "verdictPaths": [ "clean", "known-bad", "empty", "not-assessed" ] }, { "id": "DRIVE-019", "name": "External-sharing warning enabled (GWS.DRIVEDOCS.1.3)", "description": "SCuBA GWS.DRIVEDOCS.1.3: a user sharing a file outside the organization should be told so at the moment of sharing, which is the last point at which an accidental disclosure is still cheap to stop. Reads drive_and_docs.external_sharing and pairs externalSharingMode with the warning field that mode actually uses: warnForSharingOutsideAllowlistedDomains when sharing is limited to allowlisted domains, warnForExternalSharing when sharing is open. Where external sharing is disallowed the policy cannot apply and the check reports that rather than a silent pass.", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "External Sharing", "recommendedValue": "Users are warned before sharing Drive content outside the organization", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin console > Apps > Google Workspace > Drive and Docs > Sharing settings. With sharing set to allowlisted domains, turn on 'Warn when files owned by users or shared drives are shared outside allowlisted domains'. With sharing open, turn on 'Warn when files owned by users or shared drives are shared outside <organization>'.", "compliance": { "scuba": [ "GWS.DRIVEDOCS.1.3v1" ], "nistSp80053": [ "AC-3", "AC-4", "AT-2" ], "mitreAttack": [ "T1537" ], "cisBenchmark": [] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null, "verdictPaths": [ "clean", "clean-allowlisted", "known-bad", "known-bad-allowlisted", "not-applicable", "field-missing", "not-assessed" ] }, { "id": "DRIVE-020", "name": "Sharing with non-Google accounts disabled (GWS.DRIVEDOCS.1.4)", "description": "SCuBA GWS.DRIVEDOCS.1.4: sharing to a recipient with no Google account issues a PIN-based visitor link, so access rests on possession of an emailed code rather than on an authenticated identity the organization can audit, suspend, or apply MFA to. Reads drive_and_docs.external_sharing, pairing externalSharingMode with allowNonGoogleInvitesInAllowlistedDomains or allowNonGoogleInvites as the mode dictates. Not applicable where external sharing is disallowed.", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "External Sharing", "recommendedValue": "Drive sharing is limited to recipients holding a Google account", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin console > Apps > Google Workspace > Drive and Docs > Sharing settings. Turn off 'Allow users to share files with people who aren't using a Google account' (in the allowlisted-domains section when sharing is limited to allowlisted domains).", "compliance": { "scuba": [ "GWS.DRIVEDOCS.1.4v1" ], "nistSp80053": [ "AC-3", "IA-2", "IA-8" ], "mitreAttack": [ "T1537" ], "cisBenchmark": [] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null, "verdictPaths": [ "clean", "clean-allowlisted", "known-bad", "known-bad-allowlisted", "not-applicable", "field-missing", "not-assessed" ] }, { "id": "DRIVE-021", "name": "Publishing Drive content to the web disabled (GWS.DRIVEDOCS.1.5)", "description": "SCuBA GWS.DRIVEDOCS.1.5: publishing to the web takes a document out of the permission model entirely, making it readable by anyone holding the link and indexable by search engines, with no per-recipient record of who reached it. Reads drive_and_docs.external_sharing and fails where allowPublishingFiles is on in any policy whose externalSharingMode permits external sharing. Not applicable where external sharing is disallowed.", "severity": "High", "zeroTrustPillar": "Data", "zeroTrustWeight": 3, "subcategory": "External Sharing", "recommendedValue": "Publishing Drive content to the web is disabled", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin console > Apps > Google Workspace > Drive and Docs > Sharing settings > 'Published web content'. Turn off publishing so files cannot be made visible to anyone with the link.", "compliance": { "scuba": [ "GWS.DRIVEDOCS.1.5v1" ], "nistSp80053": [ "AC-3", "AC-4", "AC-22" ], "mitreAttack": [ "T1537" ], "cisBenchmark": [] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null, "verdictPaths": [ "clean", "known-bad", "not-applicable", "field-missing", "not-assessed" ] }, { "id": "DRIVE-022", "name": "Content distribution to outside shared drives blocked (GWS.DRIVEDOCS.1.7)", "description": "SCuBA GWS.DRIVEDOCS.1.7: moving a file into a shared drive owned by another organization transfers custody of it — the receiving organization's admins control the content and the organization that created it loses the ability to revoke access or retain it. Reads drive_and_docs.external_sharing and fails where allowedPartiesForDistributingContent is anything other than NONE in a policy whose externalSharingMode permits external sharing. Not applicable where external sharing is disallowed.", "severity": "Medium", "zeroTrustPillar": "Data", "zeroTrustWeight": 2, "subcategory": "Shared Drives", "recommendedValue": "No party may upload or move content into shared drives owned by another organization", "remediationUrl": "https://admin.google.com/ac/appsettings/55656082996/sharing", "remediationSteps": "Admin console > Apps > Google Workspace > Drive and Docs > Sharing settings > 'Distributing content outside of <organization>'. Set it so that no one is allowed to distribute content to shared drives owned by another organization.", "compliance": { "scuba": [ "GWS.DRIVEDOCS.1.7v1" ], "nistSp80053": [ "AC-3", "AC-4", "SC-7" ], "mitreAttack": [ "T1537" ], "cisBenchmark": [] }, "provenance": "baseline", "source_url": null, "source_read_date": null, "official_id": null, "verdictPaths": [ "clean", "known-bad", "not-applicable", "field-missing", "not-assessed" ] } ] } |