Back to Checks
googleworkspace

Protection against encrypted attachments from untrusted senders is enabled

gmail_encrypted_attachment_protection_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Verifies that Gmail is configured to take a protective action (such as moving to spam, quarantining, or showing a warning) when an encrypted attachment is received from an untrusted sender. Encrypted attachments cannot be scanned for malware by security filters, making them a common vector for delivering malicious payloads.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without protection against encrypted attachments from untrusted senders, users may receive password-protected archives containing malware that bypass standard content scanning. Attackers commonly use encrypted attachments to evade detection and deliver ransomware, trojans, or other malicious payloads.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_encrypted_attachment_protection_enabled

Recommendation

Enable protection against encrypted attachments from untrusted senders and configure an appropriate action such as moving to spam or quarantining.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Attachments**
4Check **Protect against encrypted attachments from untrusted senders**
5Select the desired action (e.g., Move email to spam)
6Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_encrypted_attachment_protection_enabled(Check):
    """Check that protection against encrypted attachments from untrusted senders is enabled.

    This check verifies that Gmail is configured to take action on
    encrypted attachments from untrusted senders, helping prevent
    malware delivery via password-protected archives.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            enabled = gmail_client.policies.enable_encrypted_attachment_protection
            consequence = (
                gmail_client.policies.encrypted_attachment_protection_consequence
            )

            if enabled is False:
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against encrypted attachments from untrusted "
                    f"senders is disabled in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"Enable the protection and configure a protective action."
                )
            elif consequence == "NO_ACTION":
                report.status = "FAIL"
                report.status_extended = (
                    f"Protection against encrypted attachments from untrusted "
                    f"senders is set to take no action in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"A protective action should be configured."
                )
            elif consequence is None:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against encrypted attachments from untrusted "
                    f"senders uses Google's secure default configuration "
                    f"(enabled) in domain "
                    f"{gmail_client.provider.identity.domain}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Protection against encrypted attachments from untrusted "
                    f"senders is enabled with consequence '{consequence}' "
                    f"in domain {gmail_client.provider.identity.domain}."
                )

            findings.append(report)

        return findings

References