services / Workspace / Groups

Privileges for viewing and managing groups.

Groups are identities that may be granted to users or other groups within Workspace. Groups may be granted privileges within other systems, notably Google Cloud. This catalog treats groups as system accounts for the purposes of risk assignment.

GROUPS_​MANAGE_​LOCKED_​LABEL

Locked labels are labels that are used in application policies. Altering these labels allows destruction or escalation of privileges to these policies.

Risks

1. Policy destruction (CRITICAL)
2. Privilege escalation (CRITICAL)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links