services / Workspace / Groups

Privileges for viewing and managing groups.

Groups are identities that may be granted to users or other groups within Workspace. Groups may be granted privileges within other systems, notably Google Cloud. This catalog treats groups as system accounts for the purposes of risk assignment.

GROUPS_​ALL

Create / read / update / delete on groups. Allows modification of the group's aliases, email address, name, and description. Allows updating group settings, which can alter who can join groups, and who can approve group join requests. Lateral movement in this context indicates movement from one user or group account to the managed group account.

Risks

1. Account destruction (CRITICAL)
2. Policy destruction (CRITICAL)
3. Data manipulation (HIGH)
4. Lateral movement (BOOST)
5. Account discovery (LOW)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links