TMA-GITHUB-1.4.1
Ensure administrator approval is required for every installed application
説明
Ensure an administrator approval is required when installing applications. Applications are typically automated integrations that improve the workflow of an organization. They are written by third-party developers, and therefore should be validated before using in case they're malicious or not ... Reported as a manual review item: no reliable read-only gh api check exists for this control.
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
Verify that applications are installed only after receiving administrator approval: a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them. b. For OAuth Apps, perform the following: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Next to the organization, click Settings. 3. In the "Third-party Access" section of the sidebar, click OAuth application policy. 4.
修正方法
修正方法: ガイダンスまたは IaC パッチ
Require an administrator approval for every installed application: a. For GitHub Apps, you are compliant by default. That is because by default only organization owners and administrators can install them. b. For OAuth Apps, perform the following: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Next to the organization, click Settings. 3. In the "Third-party Access" section of the sidebar, click OAuth application policy. 4. Under "Third-party application access policy", click Setup application access restrictions. 5. After you review the information about third-party access restrictions, click Restrict third-party application access.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- githubsource-code
- 参照
- CIS GitHub Benchmark v1.2.0 - 1.4.1 Ensure administrator approval is required for every installed application