Cis Gworkspace 3.1.4.4.2

---
name: cis-gworkspace-3.1.4.4.2
description: "Ensure allow users to add and use incoming webhooks is disabled"
category: cis-gworkspace
version: "1.3.0"
author: cyberstrike-official
tags: [cis, gcp, google-workspace, google-chat, webhooks, chat-apps]
cis_id: "3.1.4.4.2"
cis_benchmark: "CIS Google Workspace Foundations Benchmark v1.3.0"
tech_stack: [gcp, google-workspace]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# Ensure allow users to add and use incoming webhooks is disabled (Manual)

## Description

Allow users to configure incoming webhooks and developers to call incoming webhooks to post content. Incoming webhooks let you send asynchronous messages into Google Chat from applications that aren't Chat apps.

## Rationale

Webhook usage should be carefully controlled (vetted and approved) since a malicious application could send bogus information to exposed webhooks and ultimately these users.

## Impact

By default users will have exposed webhooks.

## Audit Procedure

### Using Google Workspace Admin Console

1. Log in to https://admin.google.com as an administrator
2. Select `Apps`
3. Select `Google Chat and classic Hangouts`
4. Select `Chat apps`
5. Under `Chat apps access settings`, verify `Allow users to add and use incoming webhooks` is **OFF**

### Expected Result

`Allow users to add and use incoming webhooks` should be OFF.

## Remediation

### Using Google Workspace Admin Console

1. Log in to https://admin.google.com as an administrator
2. Select `Apps`
3. Select `Google Chat and classic Hangouts`
4. Select `Chat apps`
5. Under `Chat apps access settings`, set `Allow users to add and use incoming webhooks` to **OFF**

## Default Value

`Allow users to add and use incoming webhooks` is **ON**

## CIS Controls

This control does not have explicit CIS Controls mappings in the PDF.

## Profile

Level 1