TMA-GITLAB-1.3.6
Ensure new members are required to be invited using company-approved email
Descripción
Existing members of an organization can invite new members to join, however new members must only be invited with their company-approved email. Ensuring new members of an organization have company-approved email prevents existing members of the organization from inviting arbitrary new users to join. Without this verification, they can invite anyone who is using the organization's version control system or has an active email account, thus allowing outside users (and potential threat actors) to easily gain access to company private code and resources. This practice will subsequently reduce the chance of human error or typos when inviting a new member.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
For each group in use, verify for every invitation that the invited email address is company-approved by performing the following: On the left sidebar, select Search or go to and find your group. Select Manage > Members. Members that are not automatically added are displayed on the Invited tab. Verify that each invitation email is company approved by your company.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
For each group, allow only users with company-approved email to be invited. If a user was invited without company-approved email, perform the following: On the left sidebar, select Search or go to and find your group. Select Manage > Members. Members that are not automatically added are displayed on the Invited tab. Verify that each invitation email is company approved by your company. To cancel the user's invitation to join your organization, click Cancel invitation.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- devsecopsgitlab
- Referencia
- CIS GitLab Benchmark v1.0.1 - 1.3.6 Ensure new members are required to be invited using company-approved email