search

cisagov / ScubaGoggles

SCuBA Security Configuration Baselines and assessment tool for Google Workspace
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
Creative Commons Zero v1.0 Universal
129 stars 13 forks source link

Google classroom baseline, two additional opinions #272

Closed joostgrunwald closed 4 days ago

joostgrunwald commented 2 months ago

At the moment you have the following two settings inside the admin console for google classroom:

Teacher permissions Users who claim to be teachers during signup are added to this group as pending members. You can approve membership to verify them. Learn more Who can create classes? Anyone in this domain

Guardian access Parents and guardians can get email summaries of student and class work. You can add guardians to Classroom and allow teachers to invite guardians. Learn more Allow parents and guardians to access Classroom information ON

Who can manage parents and guardians? All verified teachers Only domain administrators

In my opinion the first setting should probably be set to "Verified teachers only" The second setting is more debatable, but from a pure security viewpoint should probably be set to "Only domain administrators"

joostgrunwald commented 2 months ago

These two are good additions to the Google Workspace Classroom baseline in my opinion

jkaufman-mitre commented 2 months ago

Our internal team will take a look at this and decide if it should be added.

jkaufman-mitre commented 1 month ago

We will go ahead and create a policy for the "Teacher's Permissions" setting as there is a security aspect. However, for the guardian access, there is not a real security risk that our team can come up with to warrant a baseline policy since both verified teachers and domain admins seem appropriate to manage parents and guardians.