services / Workspace / Groups

Privileges for viewing and managing groups.

Groups are identities that may be granted to users or other groups within Workspace. Groups may be granted privileges within other systems, notably Google Cloud. This catalog treats groups as system accounts for the purposes of risk assignment.

GROUPS_​MANAGE_​SECURITY_​LABEL

Converting a group to a security group is a one-time irreversible operation. Security groups can not be automatically joined by your organization's members, nor joined by non-security groups or users external to your organization. Since this is a non-reversible operation, converting a group to a security group can impact group access.

Risks

1. Denial-of-access (EVASION)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links