Ensure the account owner can login only from a list of authorized countries/IP ranges

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Complete the following steps to check if you monitor the locations from which the account owner logs in to the account: First, you need to identify the email of the account owner. 1. In the Cloud UI, go to Manage, Access (IAM), then select Users. 2. Identify the user that has the tag owner. 3. Select the account owner. Then, click Details. 4. Copy the email address of the account owner. Second, launch the IBM Cloud Logs instance in the region where Frankfurt and 'global' events are routed. This is the instance where login security events are collected in the account. In the All Views section, look for a view that monitors the account owner login attempts. The search query should be set to: (action login) AND initiator.name:<email address> AND -initiator.host.address:(<list of IP addresses>), where is the account owner email address, and <list of IP addresses> is the list of authorized IP addresses that are separated by OR, for example, (xxx.xxx.xxx.xxx OR xxx.xxx.xxx.xxx). Then, check that at least one alert has been configured for audit events that deviate from the expected source IPs. Additionally, context-based restrictions protect your resources by denying access to identiti...

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Complete the following steps to monitor the locations from which the account owner logs in to the account: First, you need to identify the email of the account owner. 1. In the Cloud UI, go to Manage, Access (IAM), then select Users. 2. Identify the user that has the tag owner. 3. Select the account owner. Then, click Details. 4. Copy the email address of the account owner and the list of authorized IP addresses. 5. Launch the IBM Cloud Logs instance in the region where Frankfurt and global events are routed. This is the instance where login security events are collected in the account. 6. Create an alert based on any deviations where the Account Owner logs in from an unauthorized IP address. For example, use the following query: (action login) AND initiator.name:<email address> AND - initiator.host.address:(<list of IP addresses>). Replace with the account owner's email address. Replace <list of IP addresses> with the list of IP addresses that are separated by OR, for example, (xxx.xxx.xxx.xxx OR xxx.xxx.xxx.xxx) and configured for the account owner. Complete the following steps to monitor for context-based restriction violations that are not being enforced: First, you need to...