I just came out of a session on SharePoint permissions management, and one of the topics was on the use of SharePoint groups vs. AD groups; apparently there have been issues where, when a user is a member of >100 AD groups, SharePoint can fail to recognize their membership and thus not grant access. So we've been instructed to delete any AD groups that are no longer being used in any site, and to create SharePoint groups for any new security requirements in the future, except where one group will be used in multiple site collections.
In that session, when reviewing the process to create a SharePoint group, it was stressed that "Who can view the membership of this group?" should always be set to
This is a practice I personally agree with, but based on other questions I've seen on this site, and elsewhere on the Web, it appears that many hold the opposite opinion, that the identities of group members should generally be kept secret from some or all users.
My question is, why would I want to restrict this information? What risk is there in Joe Blow knowing who my Site Owners or my Leadership Team are?