TMA-GITHUB-1.3.1
Ensure inactive users are reviewed and removed periodically
Description
Track inactive user accounts and periodically remove them. User accounts that have been inactive for a long period of time are enlarging the surface of attack. Inactive users with high-level privileges are of particular concern, as these accounts are more likely to be targets ... Reported as a manual review item: no reliable read-only gh api check exists for this control.
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
If you have GitHub Enterprise Cloud, perform the following: 1. In the top-right corner of GitHub.com, click your profile photo, then click Your enterprises. 2. In the list of enterprises, click the enterprise you want to view. 3. In the enterprise account sidebar, click Compliance. 4. To download your Dormant Users (beta) report as a CSV file, under "Other", click Download. 5. Verify that there are no users listed.
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
If you have GitHub Enterprise Cloud, perform the following: 1. In the top-right corner of GitHub.com, click your profile photo, then click Your enterprises. 2. In the list of enterprises, click the enterprise you want to view. 3. In the enterprise account sidebar, click Compliance. 4. To download your Dormant Users (beta) report as a CSV file, under "Other", click Download. 5. Find the users listed in the file under Your organizations > your organization > People and select them. 6. Click Remove from organization and Remove members.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- githubsource-code
- Référence
- CIS GitHub Benchmark v1.2.0 - 1.3.1 Ensure inactive users are reviewed and removed periodically