Skip to main content
AQIRA
Book a demo
AQIRA

Menu

Book a demo

Solutions / Google Workspace

Google Workspace security audit against CIS and CISA SCuBA

With read-only admin scopes delegated to a service account, AQIRA inventories users, groups, admin roles and connected OAuth apps, reads sign-in, Gmail, Drive and audit settings, and validates sharing and forwarding to benign proof.

Book a demoHow an assessment runs
You provide
A Workspace tenant
Intensity
Standard
Scored against
CIS Google Workspace, CISA SCuBA (GWS)
Plans
On Enterprise, with 2 tenants (Google Workspace or Microsoft 365), or 1 tenant as an add-on to Premium. Compare the plans
AQIRA consoleNew assessmentProduct UI, demo data
AQIRA's New assessment dialog with Google Workspace selected: the primary domain, customer ID, a read-only service account and the workloads to assess.AQIRA's New assessment dialog with Google Workspace selected: the primary domain, customer ID, a read-only service account and the workloads to assess.
The New assessment step for Google Workspace: primary domain, customer ID, service account and workloads.View full size: the New assessment screenView full size: the New assessment screen

What you hand AQIRA

On a Workspace tenant, the New assessment step asks for the following.

You provide
A service account with domain-wide delegation of read-only admin scopes, and the workloads to assess, from sign-in to Gmail, Drive and OAuth apps.
Access
Read-only scopes are delegated in your own admin console. Consent also authorises the assessment.
Authorisation
The assessment starts only once the operator confirms: I authorize a read-only assessment of this Workspace tenant.
Intensity
  • Standard. Active testing with safe, non-destructive proofs of concept.

What each input's access allows, and how AQIRA keeps it to the least it needs, is on the security page.

ORION, VEGA, ATLAS, NOVA, POLARIS, SCRIBE

What each agent does on this input

The same six agents, in the same order; on a Workspace tenant this is the work.

  1. 01ORIONOrganisation and identity inventory

    Inventories the tenant's principals, roles and applications.

    • Tenant inventory
    • Identity graphing
    • Open-source intel

  2. 02VEGACommon controls and app access

    Reads identity and collaboration workload policy.

    • Policy readout
    • Identity posture
    • Integration scanning

  3. 03ATLASGmail, Drive and audit logging

    Reviews mail flow, endpoint posture and audit logging.

    • Mail-flow review
    • Endpoint posture
    • Audit review

  4. 04NOVASharing and forwarding validation

    Validates identity attack paths to benign proof.

    • Attack-path validation
    • Breach exposure
    • Vulnerability correlation

  5. 05POLARISSCuBA GWS and CIS scoring

    Consolidates what the others found. Scores the tenant against CIS Google Workspace and CISA SCuBA.

  6. 06SCRIBEReport

    Writes the client-deliverable report from the same evidence the console shows.

AQIRA consoleLive consoleProduct UI, demo data
The AQIRA live console for the Google Workspace tenant acme-workspace.example: the service account and the workloads assessed, and the five phases from inventory to SCuBA and CIS scoring.The AQIRA live console for the Google Workspace tenant acme-workspace.example: the service account and the workloads assessed, and the five phases from inventory to SCuBA and CIS scoring.
The service account and workloads, then the five phases for a Workspace tenant.View full size: the Live console screenView full size: the Live console screen

The findings it raises

Examples of what AQIRA reports on a Workspace tenant, each with evidence, steps to reproduce, remediation in priority order and its ATT&CK technique.

  • 2-Step Verification not enforced for all users
  • SMS and voice allowed as 2-Step Verification methods
  • More than four super administrators
  • Third-party API access to Google services unrestricted
  • Less secure app access allowed
  • External automatic email forwarding not disabled
  • Drive external sharing that allows anyone
  • Audit logs not exported to a SIEM

Examples only. What an assessment finds depends on your target; the capture shows a demo assessment.

AQIRA consoleFindingsProduct UI, demo data
The findings table of an AQIRA assessment of a Google Workspace tenant: fifteen findings from 2-Step Verification not enforced for all users to audit logs not exported to a SIEM, each with severity and status.The findings table of an AQIRA assessment of a Google Workspace tenant: fifteen findings from 2-Step Verification not enforced for all users to audit logs not exported to a SIEM, each with severity and status.
The assessment's findings, each with severity, confidence and the setting it concerns.View full size: the Findings screenView full size: the Findings screen

What it maps, and where results land

Results also land on the Google Workspace screen: findings per workload, sign-in to OAuth apps, and posture against CIS Google Workspace and CISA SCuBA.

Identities and roles
Organisational units, users, groups, admin roles and the OAuth apps people have connected.
Policies and settings
Sign-in and 2-Step Verification, Gmail, Drive sharing, app access, Marketplace and audit settings.
AQIRA consoleGoogle Workspace tenantProduct UI, demo data
The AQIRA Google Workspace tenant screen: findings for each workload from sign-in to OAuth apps, and posture against CIS and CISA SCuBA.The AQIRA Google Workspace tenant screen: findings for each workload from sign-in to OAuth apps, and posture against CIS and CISA SCuBA.
Findings per workload and posture against CIS Google Workspace and SCuBA.View full size: the Google Workspace tenant screenView full size: the Google Workspace tenant screen

Mapped to what your auditors read

POLARIS maps every finding to the controls it touches, in every framework that applies.

Scored against

  • CIS Google Workspace
  • CISA SCuBA (GWS)

Every finding is also mapped to

ATT&CK, OWASP, NIST CSF, NIST SP 800-53, NIST SP 800-171 and COBIT.

Control status, owner and evidence are in compliance mapping; what reaches the client is in the reports.

Where this assessment stops

A clean result covers only what AQIRA tests on a Workspace tenant.

  1. Read-only scopes you delegate

    Read-only admin scopes, delegated to a service account in your own admin console; that consent also authorises the assessment.

  2. Settings, not people

    It reads how the tenant is configured. It does not phish or test your users.

  3. One intensity

    Workspace assessments run at Standard: reading configuration and validating sharing and forwarding to benign proof.

Limits common to every input, and how proof stays benign, are in the methodology.

The other five inputs

Next step

A demo assessment of a Workspace tenant

A demo runs one assessment in the console, with demo data: the agents at work, the evidence behind each finding, and the report.

Book a demoExplore the platform