GitHub
TMA-GITHUB-1.4.1
Ensure administrator approval is required for every installed application
Description
Ensure an administrator approval is required when installing applications. Applications are typically automated integrations that improve the workflow of an organization. They are written by third-party developers, and therefore should be validated before using in case they're malicious or not ... Reported as a manual review item: no reliable read-only gh api check exists for this control.
How it is checked
Audit method: Manual review
Verify that applications are installed only after receiving administrator approval: a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them. b. For OAuth Apps, perform the following: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Next to the organization, click Settings. 3. In the "Third-party Access" section of the sidebar, click OAuth application policy. 4.
How it is fixed
Fix method: Guidance or infrastructure patch
Require an administrator approval for every installed application: a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them. b. For OAuth Apps, perform the following: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Next to the organization, click Settings. 3. In the "Third-party Access" section of the sidebar, click OAuth application policy. 4. Under "Third-party application access policy", click Setup application access restrictions. 5. After you review the information about third-party access restrictions, click Restrict third-party application access.
Properties
- Operating systems
- Any
- Tags
- githubsource-code
- Reference
- CIS GitHub Benchmark v1.2.0 - 1.4.1 Ensure administrator approval is required for every installed application